Domain verification TXT records
Services such as Google Search Console, Microsoft 365, Apple, Meta and Stripe ask you to add a TXT record with a unique token to prove you control a domain. They look it up, and if it's there, the domain is linked to your account. A domain can have as many as you need.
| Record type | TXT (Verification is a standard carried in TXT records) |
|---|---|
| Lives at | @ (usually) |
| Used for | |
| How common | Everyday |
| Defined in | Each service's own documentation |
Format
@ <ttl> IN TXT "<service>-verification=<token>"
| Field | What it means | Accepted values |
|---|---|---|
| Name | Usually the domain itself. Some services use their own label, such as _github-challenge-org. | Whatever the service tells you. |
| Token | A unique string tied to your account at the service. | Copy it exactly; it's case sensitive. |
Check a Verification record
Type or paste a record in zone-file form (name, TTL, type, value) or just its value. Each part is explained as you type.
A valid TXT record (Domain verification).
| Part | What it means |
|---|---|
| Name@ | @ means the domain itself (the root, or apex), such as example.com. |
| TTL3600 | Resolvers may keep this answer for 1 hour before asking again. Changes can take that long to reach everyone. |
| ClassIN | Internet. Every record you'll write uses IN. |
| TypeTXT | Free text: SPF, DKIM, DMARC, verification. |
| Textgoogle-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ | 68 bytes. |
| Tokengoogle-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ | Proves to Google (Search Console or Workspace) that whoever controls the domain's DNS set up the account. Safe to keep; remove it if you stop using the service. |
Examples
@ 3600 IN TXT "google-site-verification=rXOxyZounnZasA8Z7oaD3c14JdjS9aKSWvsR1EbUSIQ"
For Search Console and Google Workspace.
Microsoft 365
@ 3600 IN TXT "MS=ms12345678"
Proves the domain to Microsoft 365 before email is set up.
GitHub organisation
_github-challenge-example-org 3600 IN TXT "8a1c3e5b7d"
Some services use their own name instead of @.
Tokens this guide recognises
The live lookup names the service behind common tokens, including Google, Microsoft, Meta, Apple, Atlassian, Stripe, DocuSign, Adobe, OpenAI, Anthropic, Zoom, Slack, Dropbox, HubSpot, Notion, Figma, Canva, Miro, Pinterest, Twilio, Shopify and Amazon SES.
See it on a real domain
TTL
Anything; 3600 is fine. Verification usually works within minutes. How TTL works
Common mistakes
- Replacing the SPF record with the verification token instead of adding a second TXT record.
- Adding it at www when the service checks the bare domain.
- Removing it after verification for services that check again later.
At your DNS host
- Add a new TXT record; don't edit an existing one. Most dashboards want the token without quotes.
Questions
Can I delete verification TXT records?
For services you no longer use, yes. For active ones, keep them: some services check again and unverify the domain if the record is gone.
Do verification records slow anything down?
No, but a long list of them makes every TXT lookup bigger. Remove the ones for services you've left.
This page is also available as Markdown.
Lemon Domains keeps every domain you own in one place, with expiry reminders, change monitoring and DNS editing from your AI assistant. Get started free