'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Security Implications of Adding a Cross-Company DNS TXT Record for Microsoft 365
Question details
The user wants to know the security risks of adding a cross-company DNS TXT record and how to handle domain verification when a domain is already linked to another Microsoft 365 tenant.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An administrator needs to verify control of a domain for a Microsoft 365 tenant using a DNS TXT record provided by another organization.
- Observed behavior
- Concerns exist about whether adding the TXT record grants ownership or unauthorized access to the other company, alongside conflicts arising from a domain being tied to multiple Microsoft 365 subscriptions.
Ensure you have administrative access to your domain's DNS management console and confirm which Microsoft 365 tenant is currently authorized to use the domain.
Verify Domain Safely and Resolve Tenant Conflicts
Use this method to safely add a DNS TXT record for verification and resolve any existing Microsoft 365 tenant association conflicts.
Adding a TXT record merely proves control of the domain to a service provider like Microsoft. It does not grant the requesting company ownership of your DNS zone, web hosting, or emails. However, Microsoft 365 restricts a domain to a single service tenant at a time, meaning conflicts must be resolved before verification can succeed.
Carefully examine the TXT record value provided by the other organization. It should strictly be a verification string (e.g., MS=msXXXXXXXX). Confirm that no other DNS records (such as A or MX records) are being modified.
Log into your domain registrar or DNS hosting provider, navigate to the DNS management settings, and add a new TXT record with the provided value. Save the changes and wait for DNS propagation.
Since a domain can only be associated with one Microsoft 365 tenant, you must remove the domain from any previous or conflicting tenant. Contact the previous tenant's administrator or Microsoft Support to release the domain before the new organization can complete the verification.
Looking for a Hassle-Free Office Suite? Try WPS Office
Managing enterprise subscriptions and complex domain verifications can be overwhelming for small businesses. If you are looking for a highly capable, lightweight, and user-friendly office suite without complicated administrative hurdles, WPS Office is an excellent choice. It provides powerful word processing, spreadsheet, and presentation tools that are highly compatible with Microsoft Office formats.
Frequently Asked Questions
Does adding a DNS TXT record give another company control over my website?
No. Adding a TXT record only proves to the service provider (like Microsoft) that you have administrative access to the domain's DNS. It does not grant the other company control over your web hosting, emails, or unrelated domain resources.
Can I associate my domain with multiple Microsoft 365 tenants at the same time?
No, a single domain can generally be associated with only one Microsoft 365 service tenant at a time. To use the domain with a new tenant, you must first completely remove it from the existing tenant.
Is there a workaround if two organizations have separate Microsoft 365 subscriptions but want to use the same domain?
There is no direct workaround for sharing a single domain across two completely separate Microsoft 365 subscriptions for core services like Exchange Online. The domain must be assigned to a single tenant, and you may need to rely on subdomains or cross-tenant collaboration features instead.
