Webmasters Stack Exchange is a question and answer site for webmasters. It only takes a minute to sign up.
Sign up to join this community
DNS-based domain control validation works by proving that you control the domain name because you can modify the TXT record. You would not be able to do that without being able to access the DNS settings.
How then does HTTP-based and HTML-based validation work?
If the validation code is added as a text file in the document root, or added inside a meta tag on the website, how does this verify control over the domain?
If you control the domain, you control its authoritative nameservers.
If you control authoritative nameservers, you control the content of the zone. (at which point already the DNS-01 type of validation kicks in)
If you control the content of the zone, you control the A record mapping for example.com or www.example.com or any other name in your zone to be on an IP address you control or to which you delegate control (since you can choose that IP address)
If you delegate control to a given IP address for your website, you signal you control that given website and hence every URLs reaching it.
