Custom Domain verification is failing

Compare the publicly returned TXT record with the current value and hostname shown in Microsoft Entra; if they match exactly, check whether the domain is already verified in another Entra tenant.

1. Validate the exact DNS challenge

A publicly visible TXT record does not necessarily mean Entra is finding the current challenge at the expected DNS name.

1. Sign in with at least the Domain Name Administrator role.
2. Go to Microsoft Entra admin center → Entra ID → Domain names → Custom domain names → your domain.
3. Copy the TXT hostname and MS=ms... value currently displayed.
4. Query the authoritative DNS name directly:

Resolve-DnsName -Name "example.com" -Type TXT
Resolve-DnsName -Name "example.com" -Type NS

5. Confirm that:
   • The returned value exactly matches the current MS=ms... token.
   • There are no extra spaces, missing characters, or obsolete Microsoft verification records.
   • The record exists in the DNS zone hosted by the authoritative name servers—not merely in the registrar’s DNS interface if the domain uses different name servers.
   • For a root domain, the record is attached to the zone apex as represented by your DNS provider. For a subdomain, it must be attached to that subdomain’s hostname.

Microsoft recommends a TTL of 3600 seconds and notes that incorrect or duplicate entries must expire before verification is retried. Propagation can take several days, but because the record has been public for two days, a stale/wrong token or different authoritative zone is more likely than ordinary propagation.^1^

After correcting any mismatch, return to Entra ID → Domain names → your domain → Verify.

2. Check whether another Entra tenant owns the domain

If authoritative DNS returns the exact current token, the next likely condition is tenant exclusivity: Microsoft Entra permits a domain to be verified in only one tenant.^2^

Use the tenant lookup referenced in the matching Q&A case to identify whether the domain is associated with another tenant: https://www.whatismytenantid.com/ (non-Microsoft site—review it before submitting the domain).^3^

Then follow the applicable branch:

Another tenant that your organization manages

Delete the domain from the old tenant before verifying it in the target tenant.

Warning: Removing a production domain can interrupt sign-in, email, federation, and applications. Inventory dependencies, coordinate with the relevant administrators, prepare a rollback plan, and perform the change during a maintenance window.

Before deletion, migrate or remove references from:

• User names, email addresses, and proxy addresses
• Group email/proxy addresses
• Application ID URIs
• Mail-enabled objects and federation configuration, where applicable

Sign in using an administrator account on the tenant’s .onmicrosoft.com domain or another domain—not the domain being removed. Entra blocks deletion while dependent resources remain.^2^

After deletion completes, add the domain to the intended tenant, publish its newly generated TXT challenge, and verify it.

An unmanaged or “shadow” tenant

This can result from users signing up independently for services such as Power BI.

For an internal administrator takeover:

1. Sign in at https://portal.office.com/admintakeover using an account from the unmanaged organization.
2. Select Yes, I want to be the admin.
3. Publish the TXT record presented by the takeover wizard.
4. After verification, manage the old tenant and remove or migrate the domain before adding it to the intended tenant.

An external administrator takeover can instead move the domain into an existing managed tenant by verifying it with forceTakeover. External takeover is not supported when the unmanaged tenant has service plans containing SharePoint, OneDrive, or Skype for Business, or when the tenants are across cloud boundaries.^4^

A managed tenant that you cannot access

There is no self-service DNS change that releases a domain from an inaccessible managed tenant. In the Microsoft Entra admin center, open Help + Support → New support request, select Microsoft Entra ID, and request assistance removing the domain from the existing tenant. Include the domain, your tenant ID, the tenant ID currently holding it if known, and correlation/request IDs from the failure.^3^

References

1. Add your custom domain name to your tenant
2. Manage custom domain names in your Microsoft Entra ID
3. Custom domain has correct DNS entries for verification, but Entra still says unverified - Microsoft Q&A
4. Take over an unmanaged directory as administrator in Microsoft Entra ID