Custom domain verification (TXT) fails in Microsoft Entra ID despite correct, confirmed DNS

Question

I'm trying to verify pearlfox.io as a custom domain in Microsoft Entra ID (Default Directory tenant), but verification fails on every attempt despite the TXT record being confirmed correct and fully propagated.

Expected TXT record: MS=ms93172186 at the domain apex (@)

Confirmed via multiple independent checks, repeated over several days:

• Live and matching at all 4 authoritative nameservers for the domain
• Live and matching via Google (8.8.8.8), Cloudflare (1.1.1.1), and local resolvers
• No DNSSEC configured on the domain (ruled out as a trust-chain issue)
• Domain is not verified or claimed in any other tenant I have access to (checked directly)
• Confirmed via the Domain Name Admin Takeover tool that the domain is not claimed by any unmanaged/shadow tenant either
• No active Azure/Entra service incidents reported during this time
• Tried from a fresh browser session (incognito) — same result
• Microsoft's own automated diagnostic on the Support + troubleshooting page reports "no issues detected"

The verification simply fails with "Unable to verify domain name. Ensure you have added the record above at the registrar for '<domain>', and try again in a little while." every time, despite this being well past the documented up-to-72-hour propagation window.

Has anyone seen domain verification get stuck like this even with DNS fully confirmed correct on Microsoft's own diagnostic? Is there a known backend issue, or something else to check beyond DNS/tenant-conflict/DNSSEC?