MS-102 Deploy and manage a Microsoft 365 tenant Practice Question
An administrator wants to verify ownership of a custom domain 'adatum.com' in their Microsoft 365 tenant. They have already added the domain and received the TXT record value. However, the administrator's DNS hosting provider does not support adding a TXT record. Which alternative record type can be used for domain verification?
⚠ Common exam trap
Many exam-takers assume only TXT records can verify domain ownership, overlooking that Microsoft 365 explicitly supports MX records as an alternative when TXT records are unavailable, which is a common scenario in restrictive DNS environments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
MX record
When a DNS hosting provider does not support TXT records, Microsoft 365 allows the use of an MX record as an alternative for domain verification. The administrator creates an MX record with a specific subdomain (e.g., 'adatum-com.mail.protection.outlook.com') and a custom priority value provided in the TXT record value, which Microsoft's verification system checks to confirm domain ownership. This method is supported because MX records are widely available and can carry the necessary verification data in their format.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
record
Why it's wrong here
An A record maps a hostname to an IPv4 address and is used for name resolution, not for carrying proof-of-ownership tokens. Microsoft 365 verification requires a DNS record that contains the specific verification token (e.g., a TXT record with 'MS=msXXXXXX' or the MX record variant). Since an A record cannot encode this token, it will fail the verification process. Additionally, an A record would typically affect traffic routing if it pointed to a Microsoft service, making it unsuitable for a non-intrusive verification method.
- ✓
MX record
Why this is correct
Microsoft 365 permits two common verification methods: a TXT record containing 'MS=msXXXXXX' or an MX record pointing to 'msXXXXXX.adatum.com'. The MX verification record is a valid alternative that works by having you create a mail exchanger record with the exact verification token as the mail host. This record is non-authoritative and does not affect mail routing because it points to a Microsoft verification endpoint that only checks for the token. Once the token is confirmed, the MX record can be safely removed.
- ✗
SRV record
Why it's wrong here
An SRV record specifies the target host and port for a particular service (e.g., _sip._tls for SIP or _ldap._tcp for LDAP). It is not designed to carry arbitrary verification strings, and the Microsoft 365 domain verification process does not query SRV records when looking for proof of ownership. Unlike a TXT or MX record, there is no provision in the Microsoft 365 admin center to verify using an SRV record, so adding one would have no effect on the verification status. Therefore, choosing an SRV record will not satisfy the ownership check.
- ✗
NS record
Why it's wrong here
An NS record delegates a DNS zone or subdomain to a set of name servers, such as when you host your DNS externally. It does not contain any verification token or unique identifier that Microsoft can check against the domain. In fact, if you attempted to use an NS record for verification, you would be changing the authoritative servers for a domain, potentially breaking email and other services, rather than simply proving ownership. Microsoft 365 only accepts DNS records that include the verification code (like TXT or the special MX record), so an NS record is an unsupported and risky choice.
Visual reference
Go deeper
Related to this question
Learn chapter
Microsoft 365 Tenant Setup
Key term
Microsoft 365 tenant
A Microsoft 365 tenant is a dedicated, isolated instance of Microsoft 365 services created for an organization when they sign up for a subscription.
Key term
Custom domain
A custom domain is a personalized internet address (like contoso.com) that you can use with cloud services instead of the default domain provided by the service provider.
About these practice questions
One of 241 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.