Verify the domain
Prove that you control an application's domain through an HTTPS file or a DNS TXT record, understand the time limits and resolve verification failures.
No external pentest launches without proof that you control the target's domain. Two methods are offered; one is enough.
Choose a method#
| Method | Where to publish | When to prefer it |
|---|---|---|
| HTTPS file | On the exact origin of the application, at the indicated location | You deploy the application or its web server |
| DNS TXT record | In the DNS zone of the parent domain | You manage the DNS but not the server, or the application refuses static files |
Verify by HTTPS file#
- In the target page, choose file verification.
- Copy the code and publish it at the indicated location, on the exact origin (
https://app.exemple.fr/…), as a direct response. - Run the verification.
The verification refuses redirections and private IP addresses, and resolves the name before and after reading the file. A file served behind a redirection (for example from http to https, or to www) is not accepted: publish it on the exact origin of the target.
Verify by DNS TXT#
- Choose verification by TXT record.
- Add the dedicated record (name and value provided) in the DNS zone of the parent domain.
- Wait for propagation, then run the verification.
The verification requires two concordant resolvers. If your zone is served by several providers, publish the record on all of them.
Time limits#
| Item | Duration |
|---|---|
| Verification code | 72 hours. Afterwards, generate a new code and publish it. |
| Accepted proof | 90 days. A notification warns you 7 days before expiry. |
| Check at launch | 5 minutes. At launch time, SpectrAI rechecks the proof; this check must be fresh. |
Resolve a failure#
| Message | What to do |
|---|---|
| Expired code | Generate a new code, publish it and run the verification again. |
| Redirection detected (file) | Serve the file on the exact origin, without redirection. |
| Resolvers disagree (DNS) | Wait for propagation to finish or check that all your DNS servers publish the record. |
| Private address | The target must respond on a public IPv4 address. |
| Proof invalidated | A proof can stop being valid (domain change, expiry). Create a new code to resume the journey. |
After verification#
The Guidance becomes available. You can also order an evaluation from the application's page. The proof only covers the verified domain: another application is another target, with its own proof.