We're almost done on creating a hosted CMS solution (something like Weebly). We offer people to create a website with 3 different options:
- If they don't have a domain yet, they can create a sub-domain
- If they don't have a domain yet, but they don't want to have a sub-domain either, they can buy their own domain (we're a re-seller of a big registrar)
- If they have a domain already which has been registered by another registrar, we want to offer a feature, so that they can use that domain with our CMS.
- If they have multiple domains, they can park'em on the same CMS instance, so that they can see their websites with many domains.
However, they should follow some steps, so that their domain name would be resolved to our servers. For example, one step is that they should change their name servers info.
But a business requirement has been posed by the stakeholders and product owner, and that is, we want to get sure that people are true owners of the domains registered by other registrars. In other words, when a user wants to add another domain to his/her CMS instance (parking a new domain) and this newly added domain is not registered by us, we want to get sure that the domain really belongs to him/her.
What options and solutions do we have? How can we get sure that Bob for example is the owner of second-domain.com domain, when he's parking this domain on his CMS (which is already accessible via first-domain.com?