Clients confirm their endorsement through cryptographic DNS records on their own domains. Records only they control.