You add contoso.com as a custom domain to Azure AD and need Azure to verify ownership. Which DNS record type should you create in your public DNS zone?

To verify ownership of a custom domain in Azure AD, you typically create either an MX (Mail Exchanger) record or a TXT record in your public DNS zone. While both can be used, the MX record is a common and accepted method. Azure AD provides specific MX record values (e.g., pointing to a unique Microsoft Online Services ID) that you must add to your domain's DNS settings. Once Azure AD detects this record, it confirms you control the domain. NSEC (Next Secure) records are part of DNSSEC and are used for authenticated denial of existence. PTR (Pointer) records are used for reverse DNS lookups, mapping an IP address to a domain name. RRSIG (Resource Record Signature) records are also part of DNSSEC and contain digital signatures for other records. None of these are used for domain ownership verification in Azure AD.