# Verify the domain

> Prove that you control an application's domain through an HTTPS file or a DNS TXT record, understand the time limits and resolve verification failures.

No external pentest launches without proof that you control the target's domain. Two methods are offered; one is enough.

## Choose a method

| Method | Where to publish | When to prefer it |
|---|---|---|
| HTTPS file | On the exact origin of the application, at the indicated location | You deploy the application or its web server |
| DNS TXT record | In the DNS zone of the parent domain | You manage the DNS but not the server, or the application refuses static files |

## Verify by HTTPS file

1. In the target page, choose file verification.
2. Copy the code and publish it at the indicated location, on the exact origin (`https://app.exemple.fr/…`), as a direct response.
3. Run the verification.

The verification refuses redirections and private IP addresses, and resolves the name before and after reading the file. A file served behind a redirection (for example from `http` to `https`, or to `www`) is not accepted: publish it on the exact origin of the target.

## Verify by DNS TXT

1. Choose verification by TXT record.
2. Add the dedicated record (name and value provided) in the DNS zone of the parent domain.
3. Wait for propagation, then run the verification.

The verification requires two concordant resolvers. If your zone is served by several providers, publish the record on all of them.

## Time limits

| Item | Duration |
|---|---|
| Verification code | 72 hours. Afterwards, generate a new code and publish it. |
| Accepted proof | 90 days. A notification warns you 7 days before expiry. |
| Check at launch | 5 minutes. At launch time, SpectrAI rechecks the proof; this check must be fresh. |

> [!WARNING]
> An expired proof blocks any new launch, including a scheduled pentest, which is then paused with a notification. Renew the proof, then launch again.

## Resolve a failure

| Message | What to do |
| --- | --- |
| Expired code | Generate a new code, publish it and run the verification again. |
| Redirection detected (file) | Serve the file on the exact origin, without redirection. |
| Resolvers disagree (DNS) | Wait for propagation to finish or check that all your DNS servers publish the record. |
| Private address | The target must respond on a public IPv4 address. |
| Proof invalidated | A proof can stop being valid (domain change, expiry). Create a new code to resume the journey. |

## After verification

The Guidance becomes available. You can also order an evaluation from the application's page. The proof only covers the verified domain: another application is another target, with its own proof.

---

https://docs.spectr-ai.eu/en/pentest-externe/verifier-le-domaine