What Does Domain verification Mean?
On This Page
Quick Definition
Domain verification is how you prove to Microsoft that you own a domain, like contoso.com. You add a special DNS record provided by Microsoft to your domain registrar's DNS settings. Once Microsoft finds that record, it trusts that you control the domain and lets you use it for services like custom email addresses. It’s a one-time setup needed before you can fully use your custom domain with Microsoft 365.
Commonly Confused With
DNS delegation is when you assign authority for a subdomain to a different DNS server, while domain verification simply proves ownership. Verification does not change how DNS is managed; it only checks for a specific token. Delegation involves zone transfers and NS records, which is much more complex.
If you delegate sub.contoso.com to another server, you create NS records pointing to that server. For verification, you just add a TXT record with a code, no nameserver changes.
Domain registration is the process of purchasing a domain name from a registrar, while domain verification proves you own that registered domain. You must register a domain first before you can verify it. Registration involves paying fees and setting initial DNS, whereas verification is a one-time configuration step.
You register ‘mycompany.com’ on GoDaddy for $12/year. Later, you verify it with Microsoft by adding a TXT record. They are separate actions.
An SPF record is a TXT record that specifies which servers are authorized to send email for your domain, preventing spam. Domain verification is purely about proving ownership. Both use TXT records, but the purpose and content are completely different. An SPF record has syntax like ‘v=spf1 include:spf.protection.outlook.com -all’, while a verification token looks like ‘MS=msXXXXXXXX’.
After verifying your domain with Microsoft, you might later add an SPF record to ensure your emails are not marked as spam. They are two different TXT records in the same zone.
Domain transfer moves your domain registration from one registrar to another, while domain verification does not involve changing registrars. During a transfer, you receive an authorization code and update the registrant contact. Verification is just a DNS check and stays within the current registrar.
You want to move your domain from GoDaddy to Namecheap. You initiate a domain transfer. After the transfer completes, you may need to re-verify the domain with Microsoft because the DNS zone might be new.
Must Know for Exams
The MS-102 exam, Microsoft 365 Administrator, includes domain verification as a core objective under the ‘Manage tenants’ domain. Specifically, the exam measures your ability to ‘plan and configure a Microsoft 365 tenant’ and ‘manage domains and DNS records’. You will see questions that ask you to identify the correct steps to verify a domain, the type of DNS record to use (TXT record is the primary method), and what to do if verification fails.
Scenario-based questions often present a situation where an administrator has added a domain but cannot complete setup because it remains ‘unverified’. The correct answer will involve adding a TXT record with the given value and waiting for DNS propagation. Other question types might ask about the impact of missing verification, such as why email delivery fails or why domain-based features are unavailable.
You may also need to compare domain verification with other DNS tasks, like adding an MX record for mail flow or adding a CNAME for automatic user setup. The exam expects you to know that domain verification is a prerequisite for setting the domain as the primary email domain and for configuring user sign-in with a custom domain. You should understand the concept of ‘domain ownership’ and that the verification token is unique per domain and per tenant.
Watch for questions that involve multiple domains or that ask about verifying a domain when using third-party DNS hosting versus using Microsoft 365 as the DNS provider. The exam also tests the timeline: DNS propagation can take up to 72 hours, but Microsoft typically waits for the record to appear; you might need to advise waiting before raising a support ticket. Troubleshooting questions may involve checking that the TXT record’s name and value exactly match what Microsoft provided, or ensuring that the record is placed in the correct zone (root domain vs.
subdomain). Overall, domain verification is a straightforward concept but a common point of failure on the exam if you don’t remember the details.
Simple Meaning
Think of domain verification like proving you own a piece of land before you can build a house on it. When you want to use a custom domain name (like yourcompany.com) with a service such as Microsoft 365, you first have to show that you are the rightful owner.
You do this by placing a special flag or marker on your domain’s DNS records. This marker is a unique code that Microsoft gives you. You log in to the website where you bought your domain (your domain registrar, like GoDaddy or Namecheap) and add this marker as a TXT record or MX record.
Microsoft then checks your domain’s DNS to see if that marker is present. If it finds the correct marker, it verifies your ownership. This process prevents someone else from claiming your domain and using it for their own email or services.
It’s a crucial security step. Once verified, you can set up custom email addresses like admin@yourcompany.com and use other domain-specific features. The verification only needs to happen once per domain, unless you change the DNS settings or the verification record is removed.
This simple check ensures that the domain is really yours before Microsoft allows you to manage it in their system.
Full Technical Definition
Domain verification in the context of Microsoft 365 (and specifically for the MS-102 exam) is the process of proving ownership and administrative control over a DNS domain name before it can be used to host Exchange Online mailboxes, SharePoint Online sites, or other Microsoft 365 workloads. The verification relies on the Domain Name System (DNS) and specific record types that the domain owner must create at their DNS hosting provider. When an administrator adds a custom domain (e.
g., contoso.com) to a Microsoft 365 tenant, the service generates a unique verification token, typically a string of alphanumeric characters. This token is provided to the admin, who must then create a DNS TXT record (or in some older flows, an MX record) containing that exact token.
The TXT record is placed in the root of the domain (e.g., @ or contoso.com) with a specific name and value as instructed by the Microsoft 365 admin center. Microsoft’s domain verification service then periodically queries the public DNS for that record.
Once a DNS query returns the correct TXT record value, the system confirms ownership and marks the domain as verified. This verification step is a prerequisite for setting the domain as the primary email domain or adding the domain to other services, such as Azure AD for user sign-in. The process uses standard DNS resolution, which is inherently distributed and cached; Microsoft waits for the new DNS record to propagate across the internet, which can take from a few minutes to 48 hours, though it usually completes within an hour.
After verification, the domain can be used for user principal names (UPNs), email addresses, and as a federated identity domain. The MS-102 exam expects candidates to understand the verification workflow, the specific record types used (TXT is most common), and the fact that the admin must have DNS editing privileges at the registrar. Microsoft also supports verifying domains using a Microsoft 365-provided DNS record that is automatically configured if the tenant uses Microsoft 365 as its DNS provider.
The verification status is displayed in the Microsoft 365 admin center under Settings > Domains, showing “Verified” or “Unverified”. If a domain is not verified, many features, including custom email routing and SharePoint site creation, will fail or be blocked.
Real-Life Example
Imagine you want to set up a new mailbox at your local post office, but the mailbox number you want (for example, 123 Main Street) is already assigned to someone else. The post office won't give you that mailbox unless you can prove you own the house at that address. So you go home, paint your house number on the front door, take a photo, and show it to the post office.
They see the number matches their records, so they know you really live there, and they assign you that mailbox. In the IT world, your domain is the house number, the post office is Microsoft 365, the mailbox is your custom email address, and the painted number is the TXT record you add to your DNS settings. Microsoft gives you a unique code (like a secret handshake), you put it in your DNS settings at your domain registrar (GoDaddy, Namecheap, etc.
), and then Microsoft checks the public DNS to see if that code is there. If it is, Microsoft confirms you control the domain and lets you use it for email and other services. This prevents someone from pretending to own your domain and stealing your email traffic.
Just like you wouldn't want a stranger getting your mail, Microsoft doesn't want an unauthorized person managing your custom domain. The verification is a one-time process, but if you ever move your DNS hosting or change registrars, you may need to verify again. It’s a simple but powerful security measure that protects both you and the service provider.
Why This Term Matters
Domain verification is a fundamental security gate in Microsoft 365. Without it, anyone could claim any domain and potentially intercept email intended for that domain. This would be a massive security and privacy risk.
For IT professionals, understanding domain verification is essential for any tenant setup that uses a custom domain, which is most organizations. The process ensures that only the legitimate domain owner can configure services like Exchange Online, Microsoft Teams, or SharePoint Online to use that domain. It also enables features like custom user principal names (UPNs) and federated authentication, which are critical for identity management.
If an admin fails to complete or maintain domain verification, users may experience email delivery failures, login issues, or inability to access shared resources. Domain verification is tied to the domain’s lifecycle: if the verification record is deleted, the domain will become unverified, and services relying on it will stop working. This can happen accidentally during DNS migrations or when cleaning up old records.
IT pros need to know how to verify domains, how to check verification status, and how to troubleshoot propagation delays. The MS-102 exam heavily tests this because it is a core step in tenant configuration. Mastering domain verification means you can confidently deploy and manage a secure Microsoft 365 environment from the start.
How It Appears in Exam Questions
Domain verification appears in MS-102 questions primarily as scenario-based problems or configuration steps. A typical question might describe an administrator who has added contoso.com to the Microsoft 365 admin center but sees a status of ‘Unverified’.
The question asks what the administrator should do next. The correct answer will be to add a TXT record provided by Microsoft to the public DNS zone of contoso.com. Another common pattern involves an administrator who is unable to set up custom email addresses because the domain is not verified.
The question might present multiple DNS record options (MX, CNAME, TXT, A) and ask which one is used for verification. The correct answer is TXT record. Another type asks about the format of the verification record: for example, ‘What is the name and value of the TXT record used for Microsoft 365 domain verification?
’ You need to know that the name is typically ‘@’ (or empty) and the value is a specific string like ‘MS=msXXXXXXXX’. You may also see questions about what happens if a TXT record is missing or misconfigured: email delivery fails, domain remains unverified, or users cannot sign in with the custom domain. Some questions test your understanding of propagation: ‘After adding the TXT record, how long should the administrator wait before the domain is verified?
’ The correct answer is up to 72 hours, though usually it takes much less time. There are also questions about verifying a subdomain, like mail.contoso.com, compared to the root domain.
The general rule is that verification is done at the root domain level because that proves ownership of the entire domain. The exam might combine domain verification with other domain management tasks, such as setting up DNS records for mail flow (MX), auto-discovery (CNAME), or SPF/TXT for email security. You may need to distinguish between verification records and operational records.
Finally, questions may test the scenario where the domain is already verified but later becomes unverified due to deletion of the TXT record. The solution is to re-add the same record or re-run the verification wizard. Understanding these question patterns helps you quickly identify the correct action in the exam.
Practise Domain verification Questions
Test your understanding with exam-style practice questions.
Example Scenario
Scenario: You are an IT administrator for a small company that uses Microsoft 365 Business Basic. Your company’s domain is ‘acmewidgets.com’. You have purchased the domain from GoDaddy.
You want to create email addresses like sales@acmewidgets.com and info@acmewidgets.com for your team. You log into the Microsoft 365 admin center and go to Settings > Domains. You click ‘Add domain’ and type ‘acmewidgets.
com’. The system tells you to verify ownership by adding a TXT record. It gives you a unique value: ‘MS=abc123def456’. You copy this value. Now you open a web browser and log into your GoDaddy account.
You go to the DNS management page for acmewidgets.com. You see a list of existing DNS records and click ‘Add’. You choose record type ‘TXT’. For the name, you leave it blank or enter ‘@’ (which represents the root domain).
For the value, you paste ‘MS=abc123def456’. The TTL (time to live) can be left at default, like 1 hour. You save the record. Now you wait a few minutes for the DNS to propagate. Then you go back to the Microsoft 365 admin center and click ‘Verify’ next to your domain.
The system queries the public DNS for acmewidgets.com and finds the TXT record with the matching value. It shows a green checkmark and says ‘Verified’. You can now set acmewidgets.com as your primary email domain and start creating user accounts with @acmewidgets.
com email addresses. If you had skipped verification and tried to configure email, it would fail because Microsoft would not trust that you own the domain. This simple step is the foundation for all domain-related services in Microsoft 365.
Common Mistakes
Using an MX record instead of a TXT record for verification.
Microsoft 365 domain verification explicitly requires a TXT record. An MX record is used for mail routing, not ownership proof. Using MX will not trigger successful verification because the system checks for a TXT record with a specific value.
Always use a TXT record as instructed in the Microsoft 365 admin center. Do not substitute another record type.
Adding the TXT record to a subdomain (like mail.contoso.com) instead of the root domain.
Verification must be done at the root domain (e.g., contoso.com) to prove ownership of the entire domain. Adding it to a subdomain only proves ownership of that subdomain, and Microsoft checks the root zone.
Add the TXT record at the root domain level (usually represented by an empty name or @). If your DNS provider asks for a host name, leave it blank or put @.
Not waiting for DNS propagation before verifying.
DNS changes can take minutes to hours to propagate across the internet. If you try to verify immediately after adding the record, Microsoft’s DNS query may not see it yet, resulting in a failed verification.
Wait at least 30 minutes after adding the record, or up to 24 hours in some cases, before clicking ‘Verify’. If it fails, wait longer and try again.
Copying the verification token incorrectly, including extra spaces or missing characters.
The verification value must match exactly, character for character. Any typo, extra space, or missing character will cause the check to fail because the TXT record value will not match what Microsoft expects.
Copy the token exactly as shown, without adding spaces or line breaks. Paste it directly into the record value field.
Forgetting to remove the TXT verification record after the domain is verified.
While it is not strictly required to remove it, leaving the record can occasionally cause confusion later or interfere with other services if the token is reused. More importantly, if the token is leaked or if you need to add a new verification later, having an old token could be a problem.
Once the domain shows as verified, you can safely delete the TXT record, though many admins choose to keep it as a backup. If you keep it, ensure no other service requires a token of that exact format.
Exam Trap — Don't Get Fooled
{"trap":"The exam may ask you to verify a domain using the Microsoft 365 admin center, but present an option that says ‘Add an MX record with the value provided.’","why_learners_choose_it":"Learners who are not careful may associate DNS records with email and think MX records are needed for domain setup. They might also confuse MX records (used for mail routing) with the verification step."
,"how_to_avoid_it":"Always remember that domain verification uses a TXT record, not MX, CNAME, or A. The verification process is about proving ownership, not configuring services. If the question mentions verifying a domain, the correct action is to add a TXT record with the provided token.
Look for the phrase ‘verify ownership’ or ‘verify domain’ to guide you."
Step-by-Step Breakdown
Add the custom domain in Microsoft 365
In the Microsoft 365 admin center, go to Settings > Domains and click ‘Add domain’. Enter the domain name you want to use (e.g., contoso.com). This tells Microsoft 365 that you intend to use this domain with your tenant.
Obtain the verification token
After adding the domain, the system provides a unique verification token. This typically looks like ‘MS=msXXXXXXXX’ where X is a mix of letters and numbers. The token is tied to your tenant and domain. You must copy it exactly.
Log into your domain registrar’s DNS management console
Go to the website where you registered your domain (e.g., GoDaddy, Namecheap, Cloudflare). Find the DNS settings or zone editor for your domain. You need to be able to add a TXT record.
Add a TXT record with the provided token
Create a new TXT record. Set the name/host to ‘@’ or leave it blank (representing the root domain). Set the value to the exact token you copied. Set the TTL to a reasonable time, such as 1 hour. Save the record.
Wait for DNS propagation
The TXT record must propagate across the internet to all DNS servers. This can take minutes to 72 hours, but typically under an hour. You cannot speed this up. Waiting ensures that Microsoft’s DNS query finds the record.
Verify the domain in Microsoft 365
Return to the Microsoft 365 admin center, go to the domain’s details page, and click ‘Verify’ or ‘Start verification’. The system queries the public DNS for the TXT record. If the value matches, the domain becomes verified (status shows a green check).
Complete domain setup (optional)
After verification, you can set the domain as the default email domain, add DNS records for mail flow (MX), automatic discovery (CNAME), and other services. Verification is the prerequisite for these configuration steps.
Practical Mini-Lesson
Domain verification is a straightforward process, but it requires careful attention to detail. Let’s walk through what happens behind the scenes and what can go wrong. When you add a domain to Microsoft 365, the system generates a unique token.
This token is stored in Azure AD as part of the domain’s pending verification state. The token is specific to that domain and that tenant, so it cannot be reused for another domain or tenant. The verification request is sent to a dedicated Microsoft service that queries the public DNS via standard DNS resolution.
The service looks for a TXT record at the apex of the domain (the root). If the record exists and the value matches the expected token, the service marks the domain as verified in the tenant. This verification is a prerequisite for setting the domain as ‘default’ for email, for creating user principal names (UPNs) with that domain, and for enabling features like Single Sign-On (SSO) with Azure AD.
As a professional, you must know how to troubleshoot verification failures. Common causes include typographical errors in the token, adding the record to a subdomain instead of the root, or using a different record type like MX or CNAME. Another issue is DNS caching: even after you add the record, your local DNS might not reflect the change.
Use online DNS checker tools (like dnschecker.org) to confirm the record is visible globally. If verification fails but the record is correct, wait and retry. If the domain is already verified but later becomes unverified, it could be because the TXT record was deleted or altered.
Re-add the same token or use the verification wizard to generate a new one. In some scenarios, you might need to verify a domain that is managed by a different team or department. In that case, request that the DNS admin add the TXT record and confirm propagation.
Document the verification token and the date of verification for auditing. Remember, verification is a one-time step, but it is critical for all domain-dependent services. Missteps here can delay deployments and frustrate users.
Always double-check the exact token and the record location before waiting for propagation.
Memory Tip
Verification = TXT record at the root with the exact token. TXT = Trust Xfer Token.
Covered in These Exams
Current Exam Context
Current exam versions that test this topic — use these objectives when studying.
Related Glossary Terms
Two-factor authentication (2FA) is a security method that requires two different types of proof before granting access to an account or system.
An A record is a type of DNS resource record that maps a domain name to an IPv4 address.
An AAAA record is a DNS record that maps a domain name to an IPv6 address, allowing devices to find each other over the internet using the newer IP addressing system.
802.1X is a network access control standard that authenticates devices before they are allowed to connect to a wired or wireless network.
Frequently Asked Questions
Can I use an MX record instead of a TXT record for domain verification?
No, Microsoft specifically requires a TXT record. MX records are used for mail routing and cannot prove ownership. Using an MX record will result in verification failure.
How long does it take for domain verification to complete?
DNS propagation can take from a few minutes up to 72 hours, though it usually completes within an hour. After adding the TXT record, wait at least 30 minutes before verifying. If it fails, wait longer and try again.
What happens if I delete the TXT verification record after the domain is verified?
The domain will remain verified in Microsoft 365 for some time because Microsoft remembers the verification. However, if the record is missing during a periodic check, the domain may eventually become unverified. It's best to keep the record or re-verify if needed.
Can I verify a subdomain, like mail.contoso.com?
You can verify a subdomain, but the process is the same: add a TXT record at the subdomain level. However, for most services, you need to verify the root domain (contoso.com) to prove full ownership. Verify at the root unless you specifically need a subdomain.
What if my DNS is hosted by Microsoft 365?
If you use Microsoft 365 as your DNS provider (e.g., you manage your DNS from the admin center), the verification records are added automatically. You still need to ensure that the domain is registered and that you have delegated the DNS to Microsoft's nameservers.
Why does my domain show as ‘Unverified’ even after adding the TXT record?
Common reasons include: incorrect record value, record added to a subdomain instead of root, DNS propagation delay, or the record was not saved correctly. Check the token carefully, verify the record location, and wait for propagation. Use an online DNS checker to confirm the record is visible.
Summary
Domain verification is the essential first step in using a custom domain with Microsoft 365. It proves to Microsoft that you own the domain by placing a unique TXT record in the domain’s public DNS. Without this verification, you cannot set up custom email addresses, user logins, or other domain-based features.
The process is simple: add a domain in the admin center, obtain a token, add a TXT record at your DNS registrar, wait for propagation, and verify. Common mistakes include using the wrong record type, adding the record to a subdomain, and not waiting for DNS changes to spread. The MS-102 exam tests your understanding of this process through scenario-based questions and troubleshooting situations.
As an IT professional, mastering domain verification ensures a smooth tenant setup and avoids delays. Always double-check the token and the record location, and remember that verification is a one-time setup but critical for all domain-dependent services. With this knowledge, you can confidently configure and manage custom domains in any Microsoft 365 environment.