Verification and Service Records

July 16, 2026 ยท View on GitHub

External services often ask you to prove control of a domain by adding a DNS record.

Add verification and service records to the external authoritative DNS zone. Do not look for these record types in DigitalPlat.

TXT Verification

Example format:

Name:  @
Type:  TXT
Value: service-verification=issued-token

The token is normally intended to be publicly readable in DNS, but it should still be copied only to the exact name specified by the service.

Verify:

dig TXT example.dpdns.org

CNAME Verification

Example format:

Name:  issued-label
Type:  CNAME
Value: issued-target.service.example

Do not create other records at the same hostname as the CNAME.

Verify:

dig CNAME issued-label.example.dpdns.org

SRV Records

Some network applications discover a service through an SRV record:

Name:     _service._tcp
Type:     SRV
Priority: 10
Weight:   5
Port:     443
Target:   host.example.dpdns.org

Priority selects preferred targets, weight distributes traffic among targets with the same priority, and port identifies the service port. The target must resolve to an address.

Safe Verification Workflow

  1. Confirm you are signed in to the intended external service account.
  2. Read the exact record name, type, and value.
  3. Check whether the DNS interface automatically appends your zone name.
  4. Save the record.
  5. Query the authoritative nameserver directly.
  6. Ask the service to verify only after DNS returns the expected value.
  7. Record whether the verification record must remain permanently.

Remove Old Records Carefully

Verification records can outlive the account or integration that created them. Review the zone periodically, but do not delete an unfamiliar record until its owner and purpose are identified.

For each service record, document:

  • Service owner
  • Record purpose
  • Creation date
  • Whether it may be removed after verification
  • Expected impact of removal

Never add a record received through an untrusted message without independently confirming it in the intended service's authenticated interface.

Continue to Part 5: Operate the Domain.