I want to add an extra layer of security/validation into our app/network. I plan to do some mTLS in which we will provide customers with a certificate to use in the TLS handshake. However, I want the customer to pass proof of domain ownership when they initiate the request. After successfully passing the checks (including some extra onboarding things) they can perform the mTLS to get data.
I am thinking of requiring admins to upload a DV certificate which they will send to initiate a request. Another option (or an addition to the DV cert) is to check their DNS for a txt record so we can verify the domain. So if stackexchange.com join our network I want to ensure the real stackexchange is asking for data.
Would it be too cumbersome for an admin to provide their DV certificate when onboarding to our app? Would DNS check be the best option that I can check on each initiation request?