Couldn't we use domain records to verify that a website is our own for example with the TXT value provided by Anthropic?

Google does the same thing for verifying that a website is your own. Security checks by the model would only kick off if you're engaging in a property that you've validated.