MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
A company has just purchased Microsoft 365 Business Standard and added the custom domain 'fabrikam.com' to the tenant. They want to verify domain ownership. Which DNS record type must they add to their DNS provider?
⚠ Common exam trap
Many exam-takers confuse the TXT record used for domain verification with the SPF record, which is also a TXT record type, but SPF is specifically for email authentication and not for proving domain ownership.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
TXT record
To verify domain ownership in Microsoft 365, you must add a TXT record containing a unique verification string provided by the Microsoft 365 admin center. The TXT record is the standard DNS record type used for domain validation because it can store arbitrary text data without affecting email routing or other services. Microsoft 365 checks for this specific TXT record to confirm you control the domain.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
MX record
Why it's wrong here
MX (Mail Exchange) records specify the servers that accept incoming email for a domain and route SMTP traffic according to priority. They do not contain Microsoft's verification token, and modifying an MX record during setup could misroute your email before verification completes. Microsoft requires a TXT record for the initial domain ownership proof because MX records serve a routing function, not a validation function.
- ✗
CNAME record
Why it's wrong here
CNAME (Canonical Name) records alias one hostname to another, such as autodiscover.yourdomain.com pointing to autodiscover.outlook.com, which is used for service connectivity after verification. However, CNAMEs cannot carry the arbitrary alphanumeric verification string that Microsoft generates, nor are they queried during the ownership check. The verification process specifically looks for a TXT record; a CNAME only configures hostname aliases and cannot prove you control the domain's root.
- ✓
TXT record
Why this is correct
The TXT record is the correct method because it is designed to hold arbitrary text, allowing you to publish the exact verification string Microsoft provides (e.g., MS=ms12345678). Microsoft's directory service queries the public DNS and looks for that unique token; if found, it proves you can modify DNS records and therefore own the domain. This is the standard mechanism used by Microsoft 365 and Microsoft Entra ID to verify domain control without affecting mail routing or other services.
- ✗
SPF record
Why it's wrong here
SPF (Sender Policy Framework) is also published as a TXT record, but it is a structured email authentication directive that lists authorized sending servers (e.g., v=spf1 include:spf.protection.outlook.com ~all). It does not contain Microsoft's unique verification token, and Microsoft's verification lookup will ignore it when searching for the exact match TXT string. Using SPF for verification would fail and could introduce mail-delivery issues, as SPF is an authentication policy, not an ownership challenge.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft Loop Admin Controls
Key term
Custom domain
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
Key term
DNS record
A DNS record is a set of instructions stored on a DNS server that tells clients how to interact with a domain, most commonly by mapping a human-readable domain name to an IP address.
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.