Verify Domain Ownership Using DNS - Netskope Technical Documentation

When you add a sending domain to an SMTP Proxy app (Microsoft Office 365 Exchange, Google Gmail, or a Custom MSA), Netskope requires proof that your organization owns the domain. Netskope generates a unique verification value for the domain, you publish that value as a TXT record in the domain’s public DNS, and then you verify the domain in the Netskope UI. Only someone with control of the domain’s DNS can complete verification of the domain.

Customers can enable DNS-based domain verification for a stronger security posture. When enabled, it replaces the email-based method, which sends a verification code to a mailbox in the domain.

Domains that were verified using the earlier email-code method remain verified. You do not need to add a TXT record for them.

Prerequisites

Administrative access to the public DNS zone for each domain you want to verify.
The domain must be resolvable from the public internet. Domains served only by internal DNS cannot be verified.

Verify a Domain

In the Netskope UI, go to Settings > Security Cloud Platform > SMTP.
Under the app you are configuring (Microsoft Office 365 Exchange, Google Gmail, or Custom MSA), click Edit.
Under Domain, enter the domain you want to use for email processing. You can enter a domain, a subdomain, or a wildcard domain, for example example.com, mail.example.com, or *.example.com.
Click Verify. The Verify your domain ownership via DNS window opens and displays the record to create:
- Record Type: TXT
- Value: netskope-domain-verification=<token>, where <token> is a unique 64-character value generated for this domain.
Click the Copy icon to copy the value.
In your DNS provider’s console, create a TXT record:
- Host or Name: the domain you entered. For an apex domain such as example.com, use the zone apex (often shown as @). For a subdomain such as mail.example.com, create the record on that subdomain. For a wildcard such as *.example.com, create the record on the base domain example.com.
- Value: the value you copied.
Return to the Netskope UI and click Verify. The message Domain verified successfully appears and the domain shows a green check mark.
Click Save.

If verification fails, the message Domain verification failed. Please check your DNS settings appears. DNS changes can take time to propagate. Confirm the record is published, wait, and click Try Again. You can also click Verify later to save the domain without verifying it. An unverified domain is shown with a warning icon.

The SMTP Proxy processes email only from verified domains. Email sent from a domain that is saved but not verified is rejected by the SMTP Proxy because the domain is not associated with your tenant. Verify every MAIL FROM domain before routing email through the proxy.

Additional Information

Verification runs when you click Verify. Netskope does not re-check the record on a schedule.
The verification value is valid for 7 days. If you have not verified the domain within that time, generate a new value by opening the verification window again.
Each domain entered under each app receives its own verification value. If you configure the same domain under two apps, for example under Microsoft Office 365 Exchange and under a Custom MSA, you need one TXT record per app on that domain.
Each subdomain you enter as a separate domain needs its own TXT record. A single wildcard entry needs one TXT record on the base domain.

Verify a Domain

In the Netskope UI, go to Settings > Security Cloud Platform > SMTP.

Under the app you are configuring (Microsoft Office 365 Exchange, Google Gmail, or Custom MSA), click Edit.

Under Domain, enter the domain you want to use for email processing. You can enter a domain, a subdomain, or a wildcard domain, for example example.com, mail.example.com, or *.example.com.

Click Verify. The Verify your domain ownership via DNS window opens and displays the record to create:

Record Type: TXT
Value: netskope-domain-verification=<token>, where <token> is a unique 64-character value generated for this domain.

Click the Copy icon to copy the value.

In your DNS provider’s console, create a TXT record:

Host or Name: the domain you entered. For an apex domain such as example.com, use the zone apex (often shown as @). For a subdomain such as mail.example.com, create the record on that subdomain. For a wildcard such as *.example.com, create the record on the base domain example.com.
Value: the value you copied.

Return to the Netskope UI and click Verify. The message Domain verified successfully appears and the domain shows a green check mark.

Click Save.

Additional Information

Verification runs when you click Verify. Netskope does not re-check the record on a schedule.

The verification value is valid for 7 days. If you have not verified the domain within that time, generate a new value by opening the verification window again.

Each domain entered under each app receives its own verification value. If you configure the same domain under two apps, for example under Microsoft Office 365 Exchange and under a Custom MSA, you need one TXT record per app on that domain.

Each subdomain you enter as a separate domain needs its own TXT record. A single wildcard entry needs one TXT record on the base domain.