Microsoft Entra ID: issue adding custom domain name

Question

I'm looking for some assistance adding a custom domain name. I have added both a txt and mx record at our dns registrar but every time I try and verify it I get the same error message "Unable to verify domain name. Ensure you have added the record above at the registrar for 'domain.edu', and try again in a little while. Click here for more information." We use cloudflare for our dns setup, everything is correct although in cloudflare there are quotations marks around the destination or points to address (like this): "MS=ms93692685" but the record can't be created without those. I noticed in cloudflare the mx record doesn't have those quotes so it is exactly as Microsoft requests.

Answer 1

Dear Joel,

As a forum moderator, I genuinely wish I could directly inspect your DNS configuration and tenant to diagnose this for you. Unfortunately, my role here is limited to providing general guidance and steps you can try from your side.

From my research, the quotes shown around a TXT value in Cloudflare are normal DNS display formatting. Cloudflare stores the content as a TXT string, and DNS tools commonly display TXT values inside quotes. They are not part of the actual verification value, so this is very unlikely to be your problem. The more important question is whether Microsoft can retrieve the record publicly, rather than how Cloudflare displays it.

First, since you are using Cloudflare, it would be worth walking through Microsoft's dedicated article for this setup, just to confirm nothing has been missed in the process: Connect your DNS records at Cloudflare to Microsoft 365.

It covers the exact steps for adding the TXT verification record in Cloudflare, along with the MX and other records, so it is a useful checklist to compare against what you have configured.

Second, confirm the record is publicly resolvable

Press Windows + R, type cmd, and run:

nslookup -type=TXT domain.edu

The result should include MS=ms93692685. It is also worth testing against a public resolver directly:

nslookup -type=TXT domain.edu 8.8.8.8

If the value does not appear, please check the following:

1. Confirm that Cloudflare is authoritative for the domain. Ensure the nameservers set at your registrar match the Cloudflare nameservers assigned to the zone. Records added in Cloudflare will have no effect if another DNS provider is still authoritative. This is a common cause of Cloudflare-based verification failures.
2. Check the record is at the root host. The TXT record name should be @, not domain.edu.domain.edu. Cloudflare may display it as domain.edu after saving a root record, which is normal.
3. Check the Cloudflare proxy status. TXT records should not be proxied, though Cloudflare normally handles this automatically. Worth a quick confirmation.
4. Check for conflicting records. A CNAME at the same host can conflict with other record types. Confirm the verification record is at the exact host Entra requested.
5. Allow time for DNS propagation. After creating or correcting the record, give DNS caches time to update before retrying verification.
6. Verify the value matches exactly. If needed, remove and re-add the unverified domain in Entra, then compare the newly generated verification value against what is published in Cloudflare.

If public DNS is correct but verification still fails:

If multiple public resolvers return the exact TXT value and Entra still refuses to verify, the domain may already be associated with another Microsoft Entra tenant, including an old or unmanaged one. A custom domain cannot be verified in two Entra directories simultaneously, and this is a common cause of persistent verification failures.

It would be worth checking whether your organization previously used:

• Another Microsoft 365 tenant.
• Microsoft 365 through a reseller.
• GoDaddy Microsoft 365.
• Azure subscriptions under a different directory.
• Power BI or another Microsoft self-service signup with an address at this domain.

Given that this is a .edu domain, an unmanaged tenant created through a self-service signup by staff or students is a genuinely plausible scenario, and one that often goes unnoticed.

If the domain does belong to another tenant, an administrator there must remove all references to it from users, groups, applications, and proxy addresses, change those references to that tenant's .onmicrosoft.com domain, and then remove the custom domain.

To be upfront, DNS and Entra domain verification can involve some tenant-side specifics I cannot see from here, so if none of the above resolves it, the support route will be the most reliable path. In that case, please open a Microsoft support request for a custom domain takeover or domain release. You will need to be prepared to prove ownership through DNS. For detailed instructions on how to get support, please refer to Get support - Microsoft 365 admin. 

For additional assistance, use this link to find the appropriate contact number from your region: Global Customer Service phone numbers - Microsoft Support 

I truly hope you get your issue resolved swiftly. Please know that even though I can't directly intervene, directing you to the correct, specialized support is the most effective help I can provide from my position. Thank you for your patience and understanding. I'm looking forward to your reply.

---

If the answer is helpful, please click "Yes" and kindly upvote it. If you have extra questions about this answer, please click "Comment".  

Note: Please follow the steps in the forum documentation to enable e-mail notifications if you want to receive the related email notification for this thread.