Skip to main content
Datum doesn’t host DNS for a domain until you prove you control it. Verification is a gate on the whole zone: until the domain is verified, the zone has no nameservers assigned, holds no records, and answers nothing.
A zone waiting on verification reports its status as Rejected. Nothing was refused and you did nothing wrong — the status means Datum hasn’t accepted the zone for provisioning yet, and waiting for verification is the ordinary reason. The message beside it says so:
Publish the verification record and the zone provisions itself. See Zone status.

​
Why Datum verifies domains

Without a verification gate, anyone could create a zone for any name that happens to be spelled correctly and start serving real traffic for a domain someone else controls. Requiring proof of control means the only person who can host example.com on Datum is someone who can already change example.com. Verification also unlocks the domain for other Datum services that need a hostname you own, such as Application Load Balancers.

​
What gets verified

Verification belongs to the domain, not to a zone. Verify example.com once and every zone you create for that name in the same project is unblocked. A domain tracked in a different project is a separate resource with its own token, so it’s verified separately. A subdomain zone is verified against the subdomain. A zone for staging.example.com needs the verification token published under staging.example.com, not under example.com. The name must be a registrable domain. A bare public suffix such as com is rejected as not registrable, and verification never starts for it.

​
Choose a method

You can prove control two ways. Datum checks DNS first, then HTTP if DNS hasn’t succeeded, and either one succeeding verifies the domain. You don’t need both. Datum generates a unique token for the domain and shows you the exact values to publish. Copy them from the domain’s page in the portal rather than composing them yourself.

​
Verify with a TXT record

Datum asks for a TXT record on a _datum-custom-hostname name under your domain, holding the token as its value:
Add this record at whichever provider serves DNS for the domain today. If you’re moving to Datum, that’s still your old provider — Datum isn’t authoritative for the domain until you delegate, so a verification record created inside your new Datum zone can’t be seen from the internet yet.
Many DNS providers append the zone name to whatever you type in the name field. In those interfaces, enter _datum-custom-hostname rather than the full name, or you’ll end up with _datum-custom-hostname.example.com.example.com.

​
Verify with an HTTP token

Datum fetches a URL on your domain and compares the response body to the token: Requirements:
  • The request must return HTTP 200. A 404 tells Datum the token isn’t published yet.
  • The body must be exactly the token. Surrounding whitespace and a trailing newline are ignored; anything else is a mismatch.
  • Datum requests http://. A redirect to HTTPS is followed, so serving the token only over HTTPS is fine as long as the plain HTTP URL redirects there.
  • The request times out after a few seconds, so serve the token as a static response rather than generating it on demand.

​
What happens after you publish

Datum re-checks on its own — every few seconds for the first few minutes, then about once a minute, then every five minutes. You don’t need to trigger anything. Most domains verify within a minute or two of the record becoming visible, though a long TTL on a previous lookup can delay it. When verification succeeds:
  1. The domain is marked verified.
  2. Datum provisions the zone and assigns its nameservers.
  3. Datum creates the zone’s SOA and apex NS records.
  4. The zone moves from Rejected through Pending to OK, and starts serving.
Verification is a one-time check. Datum doesn’t re-verify a domain it has already verified, so you can remove the TXT record or the HTTP token afterwards — though leaving the TXT record in place costs nothing and saves you from re-doing it if the domain is ever re-added.

​
Troubleshoot verification

Domains

Tracking the domains you own, wherever they’re registered.

DNS zones

What happens once the domain is verified.
Last modified on August 26, 2026