Unable to verify custom domain name

Domain verification in Microsoft Entra depends on three things only: the TXT/MX record must be in the authoritative DNS zone, must exactly match the value provided (including the MS= prefix), and DNS changes must have propagated.

Use these steps to resolve the issue:

1. Confirm the authoritative DNS and record placement
   • Identify where the domain’s authoritative DNS is hosted (for example, Cloudflare, Microsoft 365, registrar DNS, etc.). Verification only looks at the authoritative zone; any records at non‑authoritative providers are ignored.
   • Ensure the TXT record is created in that authoritative zone for the root of the domain (host/alias @ or blank, depending on the provider), not on a subdomain.
   • For external tenants and custom URL domains, the TXT record must be associated with the hostname of the domain being verified. If the hostname is empty or @, Microsoft Entra ID can’t verify a subdomain custom domain; in that case the TXT must be on the subdomain label (for example, login or account).
2. Verify the TXT record value
   • In the DNS provider, the TXT record must be exactly what Entra shows, including the MS= prefix, for example:
     • Name/Host: @ (or the specific subdomain label if verifying login.example.com etc.)
     • Type: TXT
     • Value/Data: MS=msXXXXXXXX
     • TTL: 3600 seconds (or provider default close to that).
   • Common issues include:
     • Omitting the MS= part of the value.
     • Adding extra quotes or spaces around the value.
     • Placing the TXT on the wrong name (for example, on ocean.io. vs @ or vice versa, depending on how the provider interprets the host field).
3. Check DNS propagation from outside
   • Use a DNS lookup tool or nslookup from a terminal to query the TXT records for the domain:
     • nslookup -q=TXT ocean.io
   • Ensure the response includes the exact MS=ms… value provided by Entra. If it does not appear, Entra cannot verify the domain.
4. Wait for propagation and retry verification
   • DNS propagation can take from minutes up to several hours depending on TTL and provider.
   • Guidance for Entra and Microsoft 365 is to wait at least an hour, sometimes a few hours, before retrying verification.
   • After confirming the TXT record is visible via external lookup, return to Microsoft Entra admin center → Entra ID → Domain names → [your domain] and select Verify again.
5. Check for conflicts or prior use
   • If the TXT record is correct and visible but verification still fails, check for these conditions:
     • The domain is already verified in another Microsoft Entra directory or Microsoft 365 tenant. A domain can be verified in only one directory at a time; if it’s in another tenant, it must be removed there first.
     • There is an unmanaged tenant (for example, created by self‑service sign‑up such as Power BI). In that case, take over the unmanaged directory before verifying the domain in the new tenant.

Following these steps aligns with Microsoft’s documented troubleshooting for custom domain verification in Entra and Microsoft 365.

References:

• Add your custom domain name to your tenant
• Enable custom URL domains for apps in external tenants
• Find and fix issues after adding your domain or DNS records