Why Use TXT Records for Microsoft 365 Domain Verification? — Understanding the DNS Authentication Flow

About This Article
This article is organized based on Microsoft Learn as of 2026-09-06.

Verification Status: 📘 Official Specifications Confirmed / Actual Tenant Values Not Used
Actual Microsoft 365 verification TXT values and active domains are not included; dummy representations are used for explanation.

When you add a custom domain in Microsoft 365, you may be asked to add a TXT record to your DNS to verify whether you have the authorization to manage the domain. Microsoft checks that the specified value has been published to the domain’s DNS and uses it as proof of domain management rights.

Why Verification is Possible with a TXT Record

Only someone with DNS management rights for that domain can modify its DNS records.

Microsoft 365 provides a unique verification value during setup. In current Microsoft Learn documentation, the value for manual verification is guided in the following format:

MS=msXXXXXXXX

Because the actual value differs for each tenant and setup, avoid leaving real values in articles or logs, and instead use the value displayed in the Microsoft 365 admin center.

sequenceDiagram
    participant A as Microsoft 365 管理者
    participant M as Microsoft 365
    participant D as DNS provider
    participant N as Authoritative DNS

    A->>M: 独自ドメインを追加
    M-->>A: 確認用TXT値を提示
    A->>D: TXTレコードを登録
    D->>N: DNSへ反映
    A->>M: 確認を実行
    M->>N: TXTレコードを問い合わせ
    N-->>M: 指定値を返す
    M-->>A: ドメイン確認完了

The key point is not that the TXT record type itself performs identity verification, but rather that Microsoft confirms you are able to publish the specified value to the target domain’s DNS.

Domain Connect May Automate the Process

In current Microsoft 365 procedures, setup can sometimes be automated via Domain Connect if you use a supported registrar or DNS provider.

With the manual method, you add the TXT record to your DNS host yourself. The steps shown on the screen are the authoritative source for your current contract and DNS provider.

The Record May Not Be Visible Immediately After DNS Registration

DNS queries pass through multiple servers and caches. Immediately after a change, the exact same value may not be visible instantly from all query sources.

flowchart LR
    A[DNS管理画面で変更] --> B[Authoritative DNS]
    B --> C[Resolver / Cache]
    C --> D[Microsoft 365から確認]
    B --> E[手元のDNS問い合わせ]

Microsoft Learn notes that verification after adding a TXT record may take some time, and depending on your DNS host, even more time might be required.

Checking TXT Records from Your Own PC

On Windows, you can use Resolve-DnsName.

Resolve-DnsName -Name '<your-domain.example>' -Type TXT

You can also check it using nslookup.

nslookup -type=TXT <your-domain.example>

What is important here is not to carelessly paste the actual verification values shown on the Microsoft 365 screen into blogs, chats, or screenshots.

TXT Verification and DNS Settings for Email Are Different

After domain ownership verification is complete, if you plan to use Exchange Online or similar services, you will configure other DNS records such as MX, TXT for SPF, and CNAME.

flowchart TB
    A[ドメイン所有確認] --> B[確認用TXT等]
    A --> C[サービス利用設定]
    C --> D[MX]
    C --> E[SPF TXT]
    C --> F[その他CNAME等]

Having a TXT record does not necessarily mean your mail settings are complete. Think of verification records and DNS records for running actual services as separate things.

How Long is the Verification TXT Required?

Current Microsoft Learn instructions for gathering DNS information state that you can delete the verification TXT or MX record after the domain has been verified.

However, you must not delete TXT records required for service operations, such as SPF. Even if they share the same TXT format, their purposes differ, so be sure to check the value and role before deleting.

Troubleshooting Order of Operations

flowchart TB
    A[Microsoft 365で確認失敗] --> B[入力したdomainを確認]
    B --> C[DNS providerの登録値を確認]
    C --> D[TXTを外部から問い合わせ]
    D --> E{指定値が見える?}
    E -->|No| F[反映先・TTL・DNS権威を確認]
    E -->|Yes| G[Microsoft 365側で再確認]

Rather than repeatedly clicking “Verify” in Microsoft 365 while the DNS values are not visible, troubleshooting is easier if you first isolate whether the values are correctly published to DNS.

Summary

• TXT verification confirms domain management rights by leveraging the ability to modify DNS.

• Register the unique value provided by Microsoft 365 into your DNS.

• Because DNS propagation takes time, checking the TXT record from an external source makes troubleshooting easier.

• Domain verification TXT records and service operation records like MX/SPF are distinct.

• Do not include actual verification values or organizational domains directly in learning materials.

Official and Primary Sources

Microsoft Learn — Add a custom domain to Microsoft 365
https://learn.microsoft.com/en-us/microsoft-365/admin/setup/add-domain?view=o365-worldwide

Microsoft Learn — Gather the information you need to create DNS records
https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-with-domains/information-for-dns-records?view=o365-worldwide