I’m out of ideas so reaching out: Cloudflare DNS, Squarespace website.
Using Facebook Business Settings → Brand Safety-> Domains
Have entered the TXT record as FB require. FB definitely read it - I get different errors if I put the record in quotes, or delete the facebook-domain-verification tag.
I’ve tried removing and re-adding the domain name in FB - so they provide a different code.
If your domain is added to your Cloudflare account and having the nameservers of Cloudflare.
Also, if the A yourdomain.com and A www records at Cloudflare DNS dashboard are being cloud (proxied via Cloudflare).
Moreover, if you added an TXT record with @ symbol and in the content you have copied the value given from Facebook Business → Domains, it should be correctly added in a few minutes or less.
Maybe you are running some Firewall Rules or other security options to protect your Website which could potentially block Facebook bot that checks for that TXT record?
Have you done it this way as step-by-step instructions for a TXT record in the article below?:
It should look like this one at the DNS tab of your Cloudflare dashboard from when adding new one:
Maybe you put an old code, or a new one and tries to check one or maybe both of them?
You can keep both of them just in case until the domain verification is successfull.
If the records are , the added TXT records at your domain seems to me it would have the same effect as you actually weren’t added them at first place, due to the A www or A yourdomain.com record is (not proxied), so I guess the Facebook tool would go to your hosting DNS and ignore the Cloudflare’s DNS records.
Maybe I am wrong about this one.
Due to Squarespace, does it mean you have got an CNAME record at your Cloudflare dashboard?
Have you followed this article how to setup Squarespace with Cloudflare (depending where your domain is registered?):
I think this must be a FB problem. I also tried using the meta tag method, and again, if I deliberately change the code by one letter, I get this response from FB:
If I use the correct code I get “Unable to verify domain” again.
It seems to me this indicates FB are reading and checking that record, and agree that it matches. So it is some other problem.