Verifying a site in Search Console without handing over your DNS account
Search Console's one-click Cloudflare option is an OAuth grant that gives Google access to your whole Cloudflare DNS account, not just one record. Choose "Any DNS provider" instead, copy the TXT value, and create the record yourself. It takes the same two minutes and grants nothing beyond verification.
Verifying sites without sharing the Cloudflare login
Adding a Domain property put a one click offer in front of us: authorize Google to access the Cloudflare DNS account and it writes the TXT record itself. That grant covers the DNS account rather than the one record or the one zone, so we switched Instructions for to Any DNS provider, created the TXT record with a single API call, and confirmed it resolved before clicking Verify. Propagation was seconds, not the day the dialog warns about.
The step that paid for itself was importing the verified properties into Bing Webmaster Tools, sitemaps included, which took about a minute for an entire network. Measured across 28 days on a network of small utility sites, roughly 92 percent of organic traffic came from the Bing family, meaning Bing, DuckDuckGo and Yahoo, and about 6 percent from Google.
Adding a Domain property in Search Console requires DNS verification. If your nameservers are on Cloudflare, Google offers a convenient one click path: authorize Google to access your DNS account and it writes the record for you.
Read that offer carefully before accepting it. It is an OAuth grant covering your DNS account, not just this one record and not just this one zone. If you manage more than one domain there, you are granting access far beyond the thing you are trying to do.
The manual route, which is not harder
In the verification dialog, change Instructions for from your provider name to Any DNS provider. Search Console then shows you a TXT record value instead of a button. Copy it.
Create the record yourself:
curl -X POST "https://api.cloudflare.com/client/v4/zones/$ZONE/dns_records" \
-H "Authorization: Bearer $CF_TOKEN" -H "Content-Type: application/json" \
-d '{"type":"TXT","name":"yourdomain.com",
"content":"google-site-verification=YOUR_VALUE_HERE","ttl":1}'Confirm it is live before clicking Verify, otherwise you will be told it failed and left wondering which half went wrong:
curl -s -H "accept: application/dns-json" \
"https://cloudflare-dns.com/dns-query?name=yourdomain.com&type=TXT"Propagation is usually seconds, not the day the dialog warns about. Once the record resolves, click Verify.
Do not delete the record afterwards
Verification is continuous, not a one time check. Google re-reads that TXT record periodically, and removing it un-verifies the property, which silently cuts off your data and any linked products. Label it clearly if your DNS panel supports comments, and leave it alone during cleanups.
Domain property or URL prefix
Prefer the Domain property. It covers every subdomain and both protocols in one place, so www, apex, http and https all report together instead of fragmenting your data across several properties. The only cost is that it requires DNS verification, which you have just done.
A general habit worth keeping: when a setup flow offers a convenient integration, check what permission it is actually asking for. Convenience that costs write access to your DNS is not convenience. It is a standing risk in exchange for saving one command.
What verification gets you, and what it does not
It is worth being clear about the scope, because people treat verification as the thing that makes Google aware of their site. It is not.
Verification proves you control the domain, which unlocks the data. It gives you the performance report, the coverage report, URL inspection, sitemap submission, and the ability to link Analytics and AdSense. What it does not do is cause your site to be crawled, indexed, or ranked. A verified property with no indexed pages is a completely normal state, and the property is the instrument you use to find out why, not the cure.
The corollary catches people out in the other direction: an unverified site is still crawled and indexed normally. You are not invisible to Google before you verify. You are just blind to what Google is doing.
Add a second verification method as insurance
If the single record proving ownership disappears, the property un-verifies and every linked product stops receiving data.
The realistic ways it disappears are all mundane. Someone tidies DNS records they do not recognize. A registrar transfer drops TXT records. An automated DNS sync overwrites the zone from a config file that predates the record.
Search Console allows multiple verification methods on the same property, and any one of them holding keeps it verified. Adding an HTML file at the site root, or a meta tag in your homepage head, takes a minute and means a DNS cleanup cannot silently cut you off. On a URL-prefix property the file method is available directly; on a Domain property, DNS is the only method, which is a reason to keep the record labelled clearly rather than relying on memory.
Owners, users, and the account that actually holds the property
There are two levels of access and the distinction matters more on a small network than it seems.
A verified owner is someone who has independently proven control of the domain. Owners can add and remove users, and crucially, an owner's access does not depend on anyone else. A user has been granted access by an owner and can be removed by one. Full users see everything and can act; restricted users can view most reports and change nothing.
What goes wrong is that the property gets verified under whichever Google account happened to be signed in at the time, and that account is not the one used day to day. Months later, linking AdSense fails because the link requires the same signed-in account to hold both, and nobody remembers which login owns which product.
Work out which account owns Search Console, which owns AdSense, and which owns Analytics, and write it down somewhere durable before you need it. Reconstructing it later takes considerably longer than recording it now.
Submit the sitemap, then check that it was read
Verification and sitemap submission are separate steps and the second is easy to skip because the property looks complete without it.
Submit the full https URL of the sitemap, then come back a day later and look at the submitted-versus-discovered counts. Those two numbers are the useful part. Submitted is what your file claims. Discovered is what Google actually parsed and accepted. A gap between them means the file has entries Google would not take, and the usual causes are URLs that redirect, URLs on a different hostname than the property covers, or URLs returning anything other than 200.
That check catches the canonical and hostname mistakes that otherwise stay invisible, because a sitemap full of redirecting URLs looks perfectly fine when you open it in a browser.
Do the same thing at Bing while you are here
Bing Webmaster Tools has an import path that reads your verified Search Console properties and sets them up in one step, including the sitemaps. It takes about a minute for an entire network and it is the single highest-return minute in this whole process for a new site.
The reason is that new domains are treated very differently by the two engines. Google is slow and conservative with sites that have no history and few links. Bing is markedly faster to index and to send traffic. On a network of small utility sites measured over 28 days, roughly 92 percent of organic traffic came from the Bing family, meaning Bing, DuckDuckGo, and Yahoo, and about 6 percent from Google.
That ratio does not hold forever, and it is not an argument for ignoring Google. It is an argument against concluding that your site does not work because Google has not noticed it yet. Set up both, and measure both, or you will misread your own first three months.
What verification does not get you
Verification proves you control the domain and unlocks the data, and it does not cause your site to be crawled, indexed or ranked. A verified property with no indexed pages is a completely normal state, and the property is the instrument for finding out why rather than the cure. Two other things it leaves open: on a Domain property DNS is the only verification method, so the backup file or meta tag is not available and the record has to be labelled and left alone, and linking AdSense or Analytics later still depends on which Google account holds each product, which is worth writing down now rather than reconstructing.
Questions about Search Console DNS verification
Do I have to let Google into my Cloudflare DNS to verify a domain?
No. In the verification dialog change Instructions for from your provider name to Any DNS provider, and Search Console shows a TXT record value instead of a button. The one click path is an OAuth grant over your DNS account, not just the one record or the one zone.
Can I delete the verification TXT record once the property is verified?
No. Verification is continuous, Google re-reads the record periodically, and removing it un-verifies the property and silently cuts off your data and any linked products. Label it in your DNS panel and leave it alone during cleanups.
Should I add a Domain property or a URL prefix property?
Prefer the Domain property. It covers every subdomain and both protocols in one place, so www, apex, http and https report together instead of fragmenting across several properties, and the only cost is that it requires DNS verification.
Does verifying in Search Console get my site indexed?
No. Verification gives you the performance report, the coverage report, URL inspection, sitemap submission, and the ability to link Analytics and AdSense. It does not cause crawling, indexing or ranking.
My sitemap shows fewer discovered URLs than submitted. What does that mean?
Submitted is what your file claims and discovered is what Google parsed and accepted, so a gap means the file has entries Google would not take. The usual causes are URLs that redirect, URLs on a different hostname than the property covers, and URLs returning anything other than 200.
Is it worth setting up Bing as well as Google for a new site?
Yes. Bing Webmaster Tools can import your verified Search Console properties and sitemaps in one step, and new domains are indexed markedly faster there than at Google, so measuring only Google will make you misread your first three months.