Unable to verify a domain

Hello @Molly Adshead ,

I hope you are doing well.

I understand that you are currently unable to verify your new domain, even though you have already configured the required TXT and MX records and have confirmed that the domain does not appear to be associated with any other known account.

Generally, domain verification failures occur when Microsoft is unable to detect the required DNS verification record, the DNS changes have not fully propagated, or the domain is already associated with another Microsoft tenant, including an unmanaged Power BI tenant that may have been created through self-service sign-up.

Could you kindly verify the following details and help us confirm the behaviour?

1) Confirm Azure can actually see the TXT verification record

Azure verification works by trying to read a TXT token from your domain.

In the Azure portal, copy the exact proposed TXT record value/token.

Query your registrar/DNS hosting provider to confirm the TXT record is visible publicly.

From Windows CMD you can use:

nslookup -q=TXT YourCustomDomain.com

If you don’t see the exact TXT token returned in the output, Azure can’t verify the domain yet.

If your app/service verification uses a TXT token, the #1 fix is: the TXT record must exist and must match exactly (name/host + value), and it must be resolvable from the authoritative DNS.

2) Give it time for propagation (and re-validate)

Even after you add the record, verification can take time (up to ~72 hours in some Microsoft Entra scenarios; other services typically take a few minutes, but propagation delays can still apply). After adding/updating records, wait and then retry Refresh/Validate/Retry validation.

3) Make sure you didn’t configure the TXT record in the wrong place (authoritative DNS)

For some Microsoft services, if your domain’s authoritative DNS is hosted somewhere else (for example Microsoft-managed nameservers), DNS records added at the registrar may be ignored.

In those cases, the verification remains stuck because Azure keeps querying the authoritative nameservers and can’t see the TXT token there.

4) Check whether the domain is already verified with another Microsoft Entra tenant

If this is Microsoft Entra ID / Power BI–related domain verification: you generally can’t verify the same custom domain on two different Microsoft tenants. If it was previously verified elsewhere (including by a user sign-up / unmanaged tenant scenario), verification in your tenant may fail until the domain is handled from the existing tenant or via the appropriate takeover/force-takeover process.

5) Consider DNS TTL / caching effects

Sometimes you can see the record in one tool, but Azure validation still fails because the authoritative side hasn’t updated globally or the validator hits cached/negative responses. Retrying after a short period (and in some troubleshooting guidance, flushing local DNS cache) can help.

If you have any questions or concerns, please let me know.

Hello @Molly Adshead

following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

Hi @Molly Adshead

Following up to see if the above information was helpful. And, if you have any further query do let us know.

You're trying to verify a custom domain although its TXT or MX records appear correct. Microsoft Entra requires the exact verification record to be publicly visible at the authoritative DNS host; an existing mail MX record may not be that value.

Reopen the unverified domain in Entra admin center and copy the current TXT or MX value. Confirm its host/name and complete value at the authoritative nameservers, wait one TTL, then retry Verify. Either offered method is sufficient.

If the record resolves but Microsoft says the domain is in use, it belongs to another managed tenant or an unmanaged directory created through Power BI self-service signup. A domain can be verified in only one tenant. Remove it from the old tenant or perform an admin takeover of the unmanaged directory. If neither is accessible, contact Microsoft 365 support with proof of ownership; DNS changes cannot bypass an existing tenant association.