Entra ID Custom Domain Verification Failure

Question

Entra ID Custom Domain Verification Failure

Julian Lumetsberger 0

Dear Microsoft Support Team,

I am trying to verify the custom domain "logicx-ai.com" in my Entra ID tenant. The verification in the Azure Portal continuously fails, even though the required DNS records have been correctly added at my registrar (GoDaddy) and are fully propagated globally.

Steps already taken:

Added both the TXT record and the alternative MX record exactly as provided by the Azure Portal.

Deleted and re-added the unverified domain in the portal to force the generation of new verification IDs.

Waited over an hour between verification attempts to allow for propagation.

Proof of global DNS propagation (nslookup via Google DNS 8.8.8.8): As you can see from the following CMD outputs, the records are publicly resolving:

PS C:\Users\julia> nslookup -type=mx logicx-ai.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8
Nicht autorisierende Antwort:
logicx-ai.com   MX preference = 32767, mail exchanger = ms90319775.msv1.invalid
PS C:\Users\julia> nslookup -type=txt logicx-ai.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8
Nicht autorisierende Antwort:
logicx-ai.com   text =
    "MS=ms90319775"

Diagnosis: Since global public DNS servers are resolving the records correctly, but the Azure Portal continues to reject the verification, I suspect there is an issue with negative DNS caching on the Entra ID backend or a stuck verification state/token tied to my tenant.

Could you please investigate the backend, flush the negative cache for this domain verification, or manually verify the domain for my tenant?

Thank you in advance for your assistance.

Rukmini 36,445 Reputation points Microsoft External Staff Moderator

2026-04-07T08:03:06.7133333+00:00
Hey Julian, sorry you’re hitting this wall—your DNS records look perfect, so it does indeed feel like the verification state is stuck on the Entra backend. Here’s what you can try next:

Double-check no other tenant has your domain

Run in PowerShell:
Connect-MsolService Get-MsolDomain

If logicx-ai.com shows up in another tenant or in an unmanaged Power BI tenant, you’ll need to remove it there or perform a force-takeover.

Try PowerShell verification as a workaround

Add the domain and confirm in PowerShell, which sometimes bypasses portal caching:
New-MsolDomain –Name logicx-ai.com Confirm-MsolDomain –DomainName logicx-ai.com

If needed, use the –ForceAdd or –ForceTakeover parameter (for domains in another tenant).

Ask us to flush the negative DNS cache / manually verify

If PowerShell still fails, we can escalate on our side to clear the stuck verification state. To do that, please share: • Your Tenant ID • Timestamp (approx.) of your last verification attempt • Any correlation/request ID shown in the portal error

Once we have those details, we can purge the stale cache or manually flip your domain to “Verified.”

Hope that helps—let me know the info above and we’ll get it sorted!

Reference docs:

• Add & verify a custom domain in Microsoft Entra ID: https://docs.microsoft.com/azure/active-directory/active-directory-add-domain

• Troubleshoot domain verification issues: https://docs.microsoft.com/azure/active-directory/active-directory-add-domain#troubleshooting

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Julian Lumetsberger 0 Reputation points

2026-04-07T08:11:34.0233333+00:00
Hi,

Thanks for confirming! Option 1 and 2 did NOT help me :(. Let's proceed with Option 3 to clear the stuck verification state on the backend.

Here are my details:

Tenant ID: PII

Timestamp: April 7, 08:30 AM CEST

Correlation ID: Not provided in the UI error

Please let me know once the cache is purged or the domain is manually verified. Thanks!
Rukmini 36,445 Reputation points Microsoft External Staff Moderator

2026-04-08T02:26:48.1866667+00:00

Julian Lumetsberger, Lets continue over private messages!

1 answer

Your answer

Rukmini 36,445 Reputation points Microsoft External Staff Moderator

2026-04-07T08:03:06.7133333+00:00

Hey Julian, sorry you’re hitting this wall—your DNS records look perfect, so it does indeed feel like the verification state is stuck on the Entra backend. Here’s what you can try next:

Double-check no other tenant has your domain

Run in PowerShell:
Connect-MsolService Get-MsolDomain

If logicx-ai.com shows up in another tenant or in an unmanaged Power BI tenant, you’ll need to remove it there or perform a force-takeover.

Try PowerShell verification as a workaround

Add the domain and confirm in PowerShell, which sometimes bypasses portal caching:
New-MsolDomain –Name logicx-ai.com Confirm-MsolDomain –DomainName logicx-ai.com

If needed, use the –ForceAdd or –ForceTakeover parameter (for domains in another tenant).

Ask us to flush the negative DNS cache / manually verify

If PowerShell still fails, we can escalate on our side to clear the stuck verification state. To do that, please share: • Your Tenant ID • Timestamp (approx.) of your last verification attempt • Any correlation/request ID shown in the portal error

Once we have those details, we can purge the stale cache or manually flip your domain to “Verified.”

Hope that helps—let me know the info above and we’ll get it sorted!

Reference docs:

• Add & verify a custom domain in Microsoft Entra ID: https://docs.microsoft.com/azure/active-directory/active-directory-add-domain

• Troubleshoot domain verification issues: https://docs.microsoft.com/azure/active-directory/active-directory-add-domain#troubleshooting

Note: This content was drafted with the help of an AI system. Please verify the information before relying on it for decision-making.
Julian Lumetsberger 0 Reputation points

2026-04-07T08:11:34.0233333+00:00

Hi,

Thanks for confirming! Option 1 and 2 did NOT help me :(. Let's proceed with Option 3 to clear the stuck verification state on the backend.

Here are my details:

Tenant ID: PII

Timestamp: April 7, 08:30 AM CEST

Correlation ID: Not provided in the UI error

Please let me know once the cache is purged or the domain is manually verified. Thanks!
Rukmini 36,445 Reputation points Microsoft External Staff Moderator

2026-04-08T02:26:48.1866667+00:00

Julian Lumetsberger, Lets continue over private messages!

Answer 1

Domain verification for logicx-ai.com fails even though TXT and MX records resolve publicly because Microsoft Entra ID must see the verification record in the authoritative DNS zone and the domain must not already be verified in another tenant.

Based on the documented behavior, the following checks and actions are required:

Confirm the authoritative DNS and record placement
- The TXT or MX record must be created in the DNS zone that is authoritative for logicx-ai.com.
- If the domain’s nameservers point to another provider (for example, Microsoft 365 nameservers such as ns1.bdm.microsoftonline.com), then records created only at GoDaddy are ignored. In that case, the TXT/MX verification record must be created in the DNS system of the authoritative provider (for example, Microsoft 365 DNS), not just at the registrar.
- Ensure the TXT record is at the root of the domain (logicx-ai.com) and not on a subdomain, unless verifying a subdomain specifically. For Entra ID custom domain verification, the hostname must not be empty or @ when verifying a subdomain; for the root domain, it must be associated correctly with the root.
Verify the record value is exactly as provided
- The TXT value must include the full string, including the MS= prefix, for example MS=ms90319775.
- Any deviation (extra spaces, missing MS=, quotes handled incorrectly by the DNS host) will cause verification to fail.
- Microsoft 365 guidance explicitly calls out missing MS= or unsaved zone changes as common causes of verification failure.
Allow for DNS propagation and retry
- DNS propagation can take an hour or more depending on TTL and provider behavior. The guidance is to wait at least an hour and then retry verification in the Microsoft Entra admin center.
- If verification still fails, re-check the record at the authoritative DNS host (not only via public resolvers) to ensure it is present and saved.
Ensure the domain is not already verified in another directory
- A custom domain can only be verified in one Microsoft Entra tenant at a time.
- If logicx-ai.com is already verified in another Entra ID/Microsoft 365 tenant (including unmanaged tenants created by self-service sign-up, such as Power BI), verification in a new tenant will always fail.
- To resolve this, the domain must be deleted from the old tenant before it can be verified in the new one. If there is an unmanaged tenant, an admin must take over that directory and then remove the domain.
Re-run verification from the correct tenant and role
- Sign in to the Microsoft Entra admin center as at least a Domain Name Administrator.
- Confirm the correct tenant is selected.
- Go to Entra ID → Domain names → select logicx-ai.com → Verify.

If all of the above are correct (authoritative DNS, exact TXT/MX value, propagation time, and the domain is not present in any other tenant), verification should succeed. Backend “negative cache flush” or manual verification is not documented as a supported path; instead, the documented resolution is to correct DNS placement/values and remove any conflicting verification in other tenants.

References:

Share via

Entra ID Custom Domain Verification Failure

1 answer

Your answer