How to Build Bounded DNS Verification for Multi-Tenant Marketplace Subdomains

A technical guide on DEV Community outlines a structured approach to domain verification for marketplace platforms that assign subdomains to tenants. The core recommendation is to model domain proof as a bounded state machine with four states — pending, verified, expired, and cancelled — each tied to an immutable verification attempt with a fixed expiry. The guide distinguishes between platform-owned zones, where the platform controls DNS and tenant binding is the main concern, and customer-owned zones, where tenants must complete a DNS challenge to prove ownership. A key design principle is showing customers only what the verifier actually observed, using a narrow reason code like record_not_observed_yet, rather than guessing at causes such as propagation delays or misconfigurations. The approach also guards against a known failure pattern where delayed queue deliveries can mistakenly trigger authorization for abandoned hostnames if checks are left open-ended.