- Shipped
- May 12, 2026 at 2:48 AM UTC
- Author
- Kamo
- Commit
- 565b9e1
Child orgs that picked a Kamo web alias (e.g. gnosia.demo.kamocrm.com) were getting "TXT record found but verification code doesn't match" in the DNS setup UI. Root cause: their org_domain row had a stale verification_token and ownership_verified=false, so verifyDns ran the TXT challenge — but the customer cannot add a TXT record to a host they don't own (the parent zone is kamocrm.com, owned by the platform). Whatever shows up at _kamo-verify.<their-host> is junk the platform itself created (in this case, the value was literally the record name). Two-layer fix in DomainController: 1. **************** now self-heals stale rows for any *.kamocrm.com domain: clears the leftover verification_token and forces ownership_verified=true. Runs on every read path that already calls it (getDomainById, listDomains, verifyDns). 2. verifyDns explicitly skips the TXT block when the domain ends in .kamocrm.com, even if a token somehow survived. Belt-and-suspenders so a Kamo-owned subdomain can never gate SSL on a record the customer cannot satisfy.