007 — Claim proof via apex TXT

Context

When a hostname is already verified by another account, a claimant must prove zone control before ownership can transfer. Email setup records (SPF/DKIM/MX) are a poor proof: they conflate deliverability with ownership, and the incumbent's records may still be live.

Decision

Claims use a dedicated apex TXT challenge (sendagain-claim={code}), verified separately from email DNS setup. Claimants are excluded from normal email-record verification until the transfer succeeds.

Consequences

• Claim flow and domain verification stay independent in cron, API, and UI.
• Users publish one TXT at @ to claim; they set up sending/receiving DNS after they own the domain.