Docs

How Domainly verifies a domain.

How we verify a domain

  1. 1. Domain shape

    We normalize whatever you type — lowercasing it, stripping any scheme, path, port, or trailing dot — then check it's a syntactically valid DNS name before anything else runs.

  2. 2. Public suffix boundary

    We reject domains that are themselves a — a like co.uk that many independent registrants sit below, or a hosting/CDN provider's shared DNS zone like vercel.app. Claiming one of those would imply authority over every domain beneath it, not just yours.

  3. 3. DNS delegation

    Before we hand you a token, we confirm the domain is — it needs working nameservers before it's able to serve the we're about to ask for.

  4. 4. The TXT challenge

    We generate a one-time token and ask you to publish it as a at a Domainly-specific name (_domainly-verify.yourdomain.com), never at your domain's apex — so it can't collide with your other DNS records and can't be mistaken for anyone else's challenge.

  5. 5. DNSSEC validation

    Every DNS lookup we perform — delegation and the TXT challenge alike — goes through a resolver that validates signatures. If your domain is signed and its records fail to validate, we treat that answer as untrustworthy and refuse to confirm the claim, rather than trusting a DNS answer we can't verify. Unsigned domains aren't penalized — DNSSEC is validated when present, never required.