Facebook account trust: domains, security and permissions

Before launching, I would check the domain, two-factor authentication and access in Business Manager. Who can change settings? Who controls the Page? How do you get back in if you lose your phone? Sort this out while there is no campaign emergency.

Record who manages the domain, who controls the recovery email and who has admin access. Check former contractors too; access can remain after their work has ended.

Verify your own domain

Domain verification confirms the business’s control of a domain. It is separate from verifying the company itself.

Meta provides a DNS TXT verification route. Add the domain in the business settings, follow the offered method, put Meta’s record into DNS and run the check. First establish who can edit DNS so you are not chasing them during a launch.

• Use your domain, without an unnecessary page path.
• Copy the record from your own account in full.
• Preserve existing website and mail DNS records when adding the TXT record.
• Check the verification status, allowing for DNS updates if the record is not visible yet.

If another business has verified the domain or Meta cannot find the record, use the domain troubleshooting guide. Find the ownership or configuration issue before buying another domain.

Secure the people with access

Check two-factor authentication for yourself and your team, along with the portfolio’s security requirements. Follow the options available in Meta’s current interface.

I would use a strong available second factor and sort out recovery at the same time. Keep backup codes separate from the password. Protect the recovery email too; it matters just as much when someone loses access.

Match permissions to the job

Meta separates people added to a portfolio from partner access for another business. Individual assets also have permissions. Check each level needed for the work.

Giving everyone full control because it is easier today creates a difficult review later. Meta documents task-based permissions. Decide what the person needs to do, then assign access.

Review partners and billing separately

Removing a person does not answer every question about the partner business. Review both lists. Check current campaigns and agreements before removing access: a partner may still handle billing or active work.

With an agency account, establish which assets belong to each side. With a credit line, check who has line access and who monitors invoices.

My pre-scaling checklist

• The owner of each working asset is known.
• The domain is verified and DNS access is available.
• People with access use two-factor authentication and know the recovery process.
• Roles and former contractor access have been reviewed.
• Payment methods and invoice contacts have clear owners.
• The relevant asset statuses have been checked in Business Support Home.
• Company details are current and business verification has been completed where needed.

I include this access review in account preparation. Domain verification does not change the offer itself, so review the creative and landing page separately.

Once access is sorted, open Blueprint. It has short lessons on ads, creatives and the review process.

Prepared September 6, 2026. Links point to Meta’s help centre; some pages require Facebook sign-in.

Practical follow-up guides

• How to verify a Facebook domain with DNS TXT and troubleshoot it
• Facebook two-factor authentication: set up 2FA and recovery codes
• Business Support Home: check Facebook account restrictions

For the everyday profile and Page workflow, see Facebook account care: history checks, preparation before launch and a Page warm-up campaign.