How to Add a TXT Record for Domain Verification

You've signed up for Google Search Console, Microsoft 365, or some SaaS tool, and it's asking you to "add a TXT record" to prove you own the domain. If you've never touched DNS before, that instruction alone can be enough to make you close the tab. It's a two-minute job once you know where to click — here's exactly how to do it, plus the handful of reasons verification fails even after you've added the record correctly.

What a TXT Record Actually Does

A TXT record is just a line of text attached to your domain's DNS zone. There's no visual output — nobody sees it when they visit your site. Its only job is to sit there so a service can query your DNS and read a specific string of text, usually a random token like google-site-verification=abc123XYZ.

When you click "Verify" on the other end, that service looks up your domain's TXT records and checks whether the string it gave you is present. If it is, you've proven you control the domain (or at least its DNS), and the service unlocks whatever it was gating — email delivery, a Search Console property, a Microsoft 365 tenant, an SSL certificate via DNS-01, and so on.

Common Verification TXT Records You'll See

Different services format their tokens differently, but the process of adding them is identical. A few you'll run into often:

Notice most verification records go on the root domain (@), not a subdomain — that's the single most common mistake we see, so double-check which host the service actually asked for before you save anything.

Adding the TXT Record in cPanel

If your domain uses Getwebup's nameservers, you'll add the record through cPanel's Zone Editor:

1. Log in to cPanel and open Zone Editor under the Domains section.
2. Find your domain in the list and click Manage.
3. Click + Add Record and choose TXT from the dropdown.
4. In the Name field, enter @ for the root domain, or the exact host the service specified (e.g. _acme-challenge).
5. Paste the value the service gave you into the Record field, exactly as provided — don't add or strip quotation marks yourself.
6. Leave TTL at the default (usually 14400 seconds / 4 hours) unless you're in a hurry, in which case drop it to 300 seconds temporarily.
7. Click Save Record.

You can confirm it saved correctly from the command line:

dig TXT yourdomain.com +short

For a record on a specific host like _acme-challenge:

dig TXT _acme-challenge.yourdomain.com +short

If the value you pasted shows up in the output, the record is live on your side. Go back to the service and hit verify.

If Your Domain Uses External Nameservers

If your domain's nameservers point somewhere other than Getwebup (Cloudflare, GoDaddy DNS, your registrar's own panel), cPanel's Zone Editor won't touch anything — you're editing a zone nobody queries. Log in to wherever the domain's authoritative DNS actually lives and add the TXT record there instead. Run dig NS yourdomain.com if you're not sure which nameservers are authoritative for your domain right now.

Why Verification Still Fails

You added the record, dig shows it, but the service still says "not found." A few usual suspects:

• Wrong host. You added it to www when the service wanted it on the root, or vice versa. Re-read the exact hostname requested — most services are strict about this.
• Quotation marks baked into the value. Some panels wrap TXT values in quotes automatically; if you also typed quotes into the field, you end up with literal " characters in the record. dig will show you the actual saved value — compare it character-for-character against what the service gave you.
• DNS hasn't propagated yet. Even at a 5-minute TTL, some resolvers cache old (empty) answers longer. Give it 15-30 minutes before assuming it's broken, and query a public resolver directly to rule out local caching: dig TXT yourdomain.com @8.8.8.8 +short.
• You edited the wrong zone. This happens more than you'd think when a domain was migrated between registrars or DNS providers recently, and old nameservers are still cached somewhere. Confirm with dig NS yourdomain.com that you're editing the zone that's actually authoritative.
• A stray CNAME at the root. DNS doesn't allow a CNAME to coexist with other records (including TXT) at the same host. If something set a root CNAME in the past — rare, but it happens with some site builders — the TXT record you just added can get silently ignored at that host. Check with dig CNAME yourdomain.com +short.

How Long Verification Actually Takes

Once dig confirms the record is live and correct, verification on the service's side is usually near-instant — Google and Microsoft both re-query DNS live when you click verify, they don't wait on a separate propagation window. The delay you're likely hitting is DNS propagation itself: the record needs to reach the resolver the verification service (or your own browser, if you're double-checking) happens to be using. If it's been more than an hour and dig against a public resolver like 8.8.8.8 still shows nothing, the record wasn't saved correctly — go back and re-check the zone editor rather than waiting longer.

Prevention: Keep Your TXT Records From Colliding

TXT records don't overwrite each other automatically — each one is a separate entry, and a domain can (and often does) have several at the root: SPF, one or two site-verification tokens, maybe a DMARC policy. The mistake that bites people later is pasting a new SPF value over an old one instead of merging them — SPF specifically only supports one record per host, and multiple SPF TXT records at the same host will break mail delivery rather than combine. Verification tokens from Google, Microsoft, Facebook, etc. don't have that restriction — you can stack as many as you need at the root without conflict. Keep a short note (even just a text file) of what each TXT record on your domain is for, so six months from now you don't delete one thinking it's stale.

Quick Recap

• Add TXT records through cPanel's Zone Editor if Getwebup hosts your DNS, or your DNS provider's panel if it doesn't.
• Match the host field exactly — root (@) is far more common than a subdomain for verification records.
• Verify with dig TXT yourdomain.com +short before clicking verify on the service's side.
• Watch out for accidental quote marks and root-level CNAMEs blocking the record.
• Never overwrite an existing SPF record — merge include: mechanisms into the one record instead.