About This Article
This article was created using an automated generation workflow powered by generative AI. It reviews Microsoft Learn's Microsoft 365 domain configuration and PowerShell DNS query methods, focusing on troubleshooting steps when a TXT record has been registered but cannot be verified in Microsoft 365.Verification Status: 📘 Confirmed by Microsoft Official Documentation / No Tenant Changes
Even after registering a TXT record for Microsoft 365 domain ownership verification, it may not be verified immediately.
Instead of simply waiting,checking which DNS server you are querying and what values are visiblehelps narrow down the cause.
1. First, check from your usual DNS server
$domain = 'example.com'
Resolve-DnsName -Name $domain -Type TXT |
Select-Object Name, Strings, TTL
Verify whether the MS=msXXXXXXXX specified in the Microsoft 365 admin center is visible.
Always use the actual values displayed in the admin center.
2. Check the authoritative DNS
Check the NS records for the domain.
Resolve-DnsName -Name $domain -Type NS |
Select-Object NameHost
The servers shown here are the authoritative DNS candidates that hold the primary source of the public DNS.
3. Query the authoritative DNS directly
$ns = (
Resolve-DnsName -Name $domain -Type NS |
Select-Object -First 1 -ExpandProperty NameHost
)
Resolve-DnsName -Name $domain -Type TXT -Server $ns |
Select-Object Name, Strings, TTL
If the new TXT record is visible on the authoritative DNS but your usual DNS returns old results, you can suspect the impact of caching or propagation time.
Separating the stages of propagation
flowchart LR A[DNS管理画面へTXT登録] --> B[権威DNS] B --> C[再帰DNS/キャッシュ] C --> D[自分のPC] B --> E[Microsoft 365の確認]
"Registered in the management console" is the completion of step A.
However, for actual verification, consider the following separately:
Whether B contains the correct value
Whether C returns the new value
Whether the record is in a state where Microsoft 365 can retrieve it
.
4. Check the TTL
DNS responses include a TTL.
TTL indicates how long a cache can retain that response.
If old values persist right after a change, TTL or propagation processing by the DNS provider may be involved.
However, you cannot simply assume that "because the TTL is 300, it will globally propagate in exactly 5 minutes." Due to propagation and caching states on each DNS host, check both official guidance and actual responses.
5. Common configuration mistakes
Incorrect name entered
Depending on the DNS provider, you may need to enter the root/apex as:
@Blank
The domain name itself
using different formats.
Edited a different DNS provider
The company where you registered the domain may be different from the company providing the actual authoritative DNS.
Even if you think you "added the TXT record to the domain management console," it will not appear on the public DNS if the actual NS points to a different service.
Incorrect value
MS=msXXXXXXXX Do not guess; verify against the value displayed in the Microsoft 365 admin center.
Practical application in your work
This troubleshooting approach applies not only to M365, but also to:
SaaS domain ownership verification
SPF
DKIM
DMARC
Search Console
Certificate DNS validation
.
The practical value lies in isolating the problem of "the service not recognizing it" acrossthe service side, authoritative DNS, caching DNS, and the client device.
Precautions
Do not paste internal-only DNS names or internal server names into articles or AI tools.
There is no need to publish actual Microsoft 365 TXT values in public logs.
DNS changes can affect mail delivery and other services, so do not carelessly modify records other than the TXT record.
Follow Microsoft's latest procedures regarding whether TXT records can be deleted after ownership verification.
Summary
Registering in the DNS management console and being visible on public DNS are two different things.
You can identify the authoritative DNS by checking the NS records.
Querying the authoritative DNS directly for TXT records makes it easier to isolate caching issues.
TTL is a reference metric, not an exact indicator of propagation completion time.
The same troubleshooting mindset applies to DNS verification issues outside of M365.
