Prove a domain before trusting it

How to do it

Make a random value per organisation and domain, such as example-verification=8f3a91c2. Look up the TXT record and compare. Check again daily, and drop the claim after 7 days of failures. Never allow a claim on a public mail domain, such as gmail.com or outlook.com. A verified domain may offer joining to new sign-ups, route sign-in to the organisation's single sign-on, and require it.

Example

import { resolveTxt } from 'node:dns/promises';

export async function isDomainVerified(domain, expected) {
  const records = await resolveTxt(domain).catch(() => []);
  return records.some(parts => parts.join('') === expected);
}

import dns.resolver

def is_domain_verified(domain: str, expected: str) -> bool:
    try:
        answers = dns.resolver.resolve(domain, "TXT")
    except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
        return False
    return any(b"".join(record.strings).decode() == expected for record in answers)

How to check

Claim a test domain without the record, and verification fails. Add the record, and it passes. A claim on gmail.com is refused.