diff --git a/apps/docs/content/docs/en/platform/enterprise/verified-domains.mdx b/apps/docs/content/docs/en/platform/enterprise/verified-domains.mdx
index d56dc3230c6..fe91e17e83e 100644
--- a/apps/docs/content/docs/en/platform/enterprise/verified-domains.mdx
+++ b/apps/docs/content/docs/en/platform/enterprise/verified-domains.mdx
@@ -23,7 +23,11 @@ Go to **Settings → Security → Verified domains** in your organization settin
 3. Add that TXT record at your DNS provider.
 4. Click **Verify**. Sim looks up the record; on success the domain is marked **Verified**.
 
-DNS changes can take up to 48 hours to propagate — if verification does not succeed immediately, wait and retry. You can remove the TXT record after the domain is verified; the verification persists.
+<Callout type="warning">
+  Some DNS providers — GoDaddy, Namecheap, Hover, and most cPanel panels — append your zone to whatever you type in the host field. If yours does, enter the host with the trailing zone removed, or you will end up with `_sim-challenge.acme.com.acme.com` and verification will never succeed. Managing the `acme.com` zone, `_sim-challenge.acme.com` becomes `_sim-challenge`; verifying the subdomain `eng.acme.com` from that same zone, `_sim-challenge.eng.acme.com` becomes `_sim-challenge.eng`. Cloudflare and Route 53 take the full host as shown.
+</Callout>
+
+DNS changes can take up to 48 hours to propagate — if verification does not succeed immediately, wait and retry. Keep the TXT record published: leaving it in place means the domain stays verifiable if you ever need to verify it again.
 
 Add each domain you own separately. Subdomains (`eng.acme.com`) are verified independently of the apex.
 
diff --git a/apps/sim/ee/sso/components/domain-settings.tsx b/apps/sim/ee/sso/components/domain-settings.tsx
index 4185d96aeb8..04f10e6a8d3 100644
--- a/apps/sim/ee/sso/components/domain-settings.tsx
+++ b/apps/sim/ee/sso/components/domain-settings.tsx
@@ -21,13 +21,15 @@ interface DomainSettingsProps {
 interface CopyFieldProps {
   label: string
   value: string
+  hint?: string
 }
 
-function CopyField({ label, value }: CopyFieldProps) {
+function CopyField({ label, value, hint }: CopyFieldProps) {
   return (
     <div className='flex flex-col gap-1'>
       <span className='text-[var(--text-muted)] text-caption'>{label}</span>
       <ChipCopyInput value={value} copyLabel={`Copy ${label}`} inputClassName='font-mono' />
+      {hint ? <span className='text-[var(--text-muted)] text-caption'>{hint}</span> : null}
     </div>
   )
 }
@@ -71,7 +73,11 @@ function DomainRow({ organizationId, domain, onRemove }: DomainRowProps) {
             Add this TXT record at your DNS provider, then verify. DNS changes can take up to 48
             hours to propagate.
           </p>
-          <CopyField label='Host / name' value={domain.challengeHost} />
+          <CopyField
+            label='Host / name'
+            value={domain.challengeHost}
+            hint='Some DNS providers append your zone automatically. If yours does, enter this host with the trailing zone removed.'
+          />
           <CopyField label='Value' value={domain.txtRecordValue} />
           <div>
             <Button size='sm' onClick={handleVerify} disabled={verifyDomain.isPending}>
diff --git a/apps/sim/lib/auth/sso/domain-verification.test.ts b/apps/sim/lib/auth/sso/domain-verification.test.ts
index 3781924c137..e44dfcc8f3f 100644
--- a/apps/sim/lib/auth/sso/domain-verification.test.ts
+++ b/apps/sim/lib/auth/sso/domain-verification.test.ts
@@ -1,10 +1,24 @@
 /**
  * @vitest-environment node
  */
-import { describe, expect, it } from 'vitest'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockResolveTxt, mockSetServers } = vi.hoisted(() => ({
+  mockResolveTxt: vi.fn(),
+  mockSetServers: vi.fn(),
+}))
+
+vi.mock('node:dns/promises', () => ({
+  Resolver: class {
+    resolveTxt = mockResolveTxt
+    setServers = mockSetServers
+  },
+}))
+
 import {
   buildChallengeHost,
   buildTxtRecordValue,
+  checkDomainTxtRecord,
   generateVerificationToken,
   SSO_CHALLENGE_HOST_PREFIX,
   toDomainResponse,
@@ -76,4 +90,69 @@ describe('domain-verification helpers', () => {
       expect(verified.verifiedAt).toBe(verifiedAt.toISOString())
     })
   })
+
+  describe('checkDomainTxtRecord', () => {
+    const TOKEN = 'tok-123'
+    const EXPECTED = buildTxtRecordValue(TOKEN)
+
+    beforeEach(() => {
+      vi.clearAllMocks()
+    })
+
+    it('queries the challenge host for the domain', async () => {
+      mockResolveTxt.mockResolvedValue([[EXPECTED]])
+      await checkDomainTxtRecord('acme.com', TOKEN)
+      expect(mockResolveTxt).toHaveBeenCalledWith('_sim-challenge.acme.com')
+    })
+
+    it('verifies when the exact value is published', async () => {
+      mockResolveTxt.mockResolvedValue([[EXPECTED]])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(true)
+    })
+
+    it('joins a value split across 255-char chunks before comparing', async () => {
+      const midpoint = Math.floor(EXPECTED.length / 2)
+      mockResolveTxt.mockResolvedValue([[EXPECTED.slice(0, midpoint), EXPECTED.slice(midpoint)]])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(true)
+    })
+
+    it('finds the match among unrelated TXT records on the same host', async () => {
+      mockResolveTxt.mockResolvedValue([
+        ['v=spf1 include:_spf.google.com ~all'],
+        ['facebook-domain-verification=abc123'],
+        [EXPECTED],
+      ])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(true)
+    })
+
+    it('tolerates padding a DNS panel added around the value', async () => {
+      mockResolveTxt.mockResolvedValue([[`  ${EXPECTED}  `]])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(true)
+    })
+
+    it('rejects a near-miss value (no partial or prefix match)', async () => {
+      mockResolveTxt.mockResolvedValue([[`${EXPECTED}extra`], [EXPECTED.slice(0, -1)]])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(false)
+    })
+
+    it('rejects another org token published on the same host', async () => {
+      mockResolveTxt.mockResolvedValue([[buildTxtRecordValue('someone-elses-token')]])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(false)
+    })
+
+    it('returns false (never throws) when the record is absent', async () => {
+      mockResolveTxt.mockRejectedValue(Object.assign(new Error('no data'), { code: 'ENODATA' }))
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(false)
+    })
+
+    it('returns false (never throws) when resolution fails for an infrastructure reason', async () => {
+      mockResolveTxt.mockRejectedValue(Object.assign(new Error('timeout'), { code: 'ETIMEOUT' }))
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(false)
+    })
+
+    it('returns false when the host has no TXT records at all', async () => {
+      mockResolveTxt.mockResolvedValue([])
+      await expect(checkDomainTxtRecord('acme.com', TOKEN)).resolves.toBe(false)
+    })
+  })
 })
diff --git a/apps/sim/lib/auth/sso/domain-verification.ts b/apps/sim/lib/auth/sso/domain-verification.ts
index 76391991c86..79e8d1ef575 100644
--- a/apps/sim/lib/auth/sso/domain-verification.ts
+++ b/apps/sim/lib/auth/sso/domain-verification.ts
@@ -54,14 +54,29 @@ const TXT_VALUE_PREFIX = 'sim-domain-verification='
  * depend on (or get poisoned by) the host's local resolver/split-horizon DNS. */
 const VERIFICATION_NAMESERVERS = ['1.1.1.1', '8.8.8.8']
 
-const DNS_TIMEOUT_MS = 5000
+/**
+ * Per-attempt timeout. c-ares multiplies this across servers and retries by
+ * more than the nominal `tries` (measured ~7x with two servers), so keep the
+ * base low: 2s x 1 try over two servers bounds a fully-unreachable-resolver
+ * lookup at a few seconds rather than the ~35s a 5s/2-try config produced.
+ */
+const DNS_TIMEOUT_MS = 2000
+
+/**
+ * DNS error codes that genuinely mean "the record is not published yet" — the
+ * expected state while an admin is still adding it. Anything else (timeout,
+ * refused, SERVFAIL) indicates an infrastructure problem on our side and is
+ * logged loudly, because it is otherwise indistinguishable to the admin from a
+ * missing record.
+ */
+const RECORD_ABSENT_DNS_CODES = new Set(['ENODATA', 'ENOTFOUND', 'NXDOMAIN'])
 
 /**
  * Shared resolver pinned to the public nameservers. Its config is fully static
  * and `resolveTxt` is safe to call concurrently, so a single module-scope
  * instance avoids re-allocating one per verification.
  */
-const verificationResolver = new Resolver({ timeout: DNS_TIMEOUT_MS, tries: 2 })
+const verificationResolver = new Resolver({ timeout: DNS_TIMEOUT_MS, tries: 1 })
 verificationResolver.setServers(VERIFICATION_NAMESERVERS)
 
 /** The fully-qualified host an org must create the TXT record on. */
@@ -95,13 +110,29 @@ export async function checkDomainTxtRecord(domain: string, token: string): Promi
 
   try {
     const records = await verificationResolver.resolveTxt(host)
-    // Each TXT record may be split into multiple strings — join the chunks.
-    return records.some((chunks) => chunks.join('') === expected)
+    // Each TXT record may be split into 255-char chunks — join before comparing.
+    // Trim the joined value: several DNS panels pad the stored string, which
+    // would otherwise fail an exact match forever with no way for the admin to
+    // tell why. Concatenation happens first, so trimming cannot corrupt a
+    // legitimate chunk boundary.
+    return records.some((chunks) => chunks.join('').trim() === expected)
   } catch (error) {
-    logger.debug('TXT verification lookup failed (treated as unverified)', {
-      host,
-      error: getErrorMessage(error),
-    })
+    const code = (error as NodeJS.ErrnoException)?.code
+    if (code && RECORD_ABSENT_DNS_CODES.has(code)) {
+      logger.debug('TXT verification record not published yet', { host, code })
+    } else {
+      // Not a missing record — our resolver path itself is failing (blocked
+      // egress, timeout, SERVFAIL). Log at ERROR, not warn: the default minimum
+      // level in production is ERROR, so anything below it is dropped and the
+      // fault stays invisible while the admin is told their record "isn't
+      // published yet". This is a genuine infrastructure fault, so ERROR is also
+      // the honest severity.
+      logger.error('TXT verification lookup failed for an infrastructure reason', {
+        host,
+        code,
+        error: getErrorMessage(error),
+      })
+    }
     return false
   }
 }