# Domain verification

Before installs from a website can reach Google Ads, Meta, TikTok or X Ads, you prove you control its primary domain with a DNS record.

## Add the record

**Settings → Domain verification** shows a TXT record unique to your website. Add it at your DNS provider:

```
Name   _clitrail.acme.dev
Type   TXT
Value  clitrail-site-verification=YOUR_22_CHARACTER_TOKEN
```

Then choose **Verify domain**. The service looks the record up over DNS-over-HTTPS at `cloudflare-dns.com`. New records can take a few minutes to appear; to check yourself:

```sh
dig +short TXT _clitrail.acme.dev
```

## Rules

- Only the primary website's host is verified. Additional domains need no record.
- `localhost`, `*.localhost`, `127.x.x.x` and `[::1]` count as verified, for development.
- The token stays the same for the website's lifetime. Changing the primary website URL clears the verification. Pause live Google Ads, Meta, TikTok and X Ads destinations first; otherwise the change is refused with `domain_change_requires_paused_destinations`.
- Going live without verification fails with `domain_verification_required`. GA4 and webhooks do not need it.

A failed check says why: `record_not_found` (the name or value does not match yet) or `dns_lookup_failed` (try again in a minute). Checks are recorded in the audit log.