Glossary

Short explanations of terms you'll see around Domainly.

Domainly terms

Claim: A claim is the ownership-proving flow: we generate a token and a record name for you to publish as a , then check DNS until it matches. Succeeding marks the domain as claimed and gives you an ownership proof — a secret shown once that lets you create for the domain later without repeating the DNS challenge. You can only have one pending claim per domain at a time.
One-time certificate: A certificate is a secret you generate and hand to someone else, instead of giving them your ownership proof directly. There's no page to open with it — the holder pairs it with your domain and calls our API to confirm the domain is claimed. It can't be used to claim anything or generate certificates of its own. A certificate only works once: the first successful check consumes it, so the same certificate can't be checked again afterward. If it's never checked, it expires 7 days after creation. Either way, it also stops working immediately if the domain's is revoked. A domain can have up to 5 live certificates at once.

DNS concepts

DNS-delegated: A domain is "DNS-delegated" when a or resolves for it — in other words, its registry points to nameservers that actually answer for it. This is a precondition for publishing any DNS record on the domain, including the we ask you to add. It says nothing about whether the domain is verified with us, and nothing about email, web hosting, or any other DNS record — only that the domain has working nameservers behind it.
NS record: An NS (nameserver) record tells the rest of the internet "these servers are in charge of answering DNS questions for this domain." It's set at your domain registrar or DNS provider, and it's what points a domain at the nameservers that serve all its other records — including the you publish. No NS record means no nameservers are in charge, so nothing can resolve for the domain at all (see ).
SOA record: A Start of Authority (SOA) record exists once per and identifies the primary nameserver responsible for it, along with some housekeeping values (like how often other nameservers should refresh their copy of the zone). Alongside an , its presence is one of the two signals we check to decide a domain is .
DNS zone: A DNS zone is a portion of the domain namespace with its own and marking who's authoritative for it. Splitting a domain into zones is how a subdomain — say, mail.example.com — can be delegated to a completely different set of nameservers than example.com itself, with neither zone needing to know about the other.
TXT record: A TXT record holds free-form text at a given name within a . We ask you to publish your verification token as a TXT record at a Domainly-specific name, never at your domain's apex, so it can't collide with other TXT records you might already have (SPF, DKIM, and the like) and can't be mistaken for anyone else's challenge.
Public suffix: A public suffix is a that unrelated people or organizations independently register names under — an ICANN suffix like co.uk or com, or a private one operated by a hosting/CDN provider, like vercel.app. We reject claims for a domain that is itself a public suffix, since claiming it would imply authority over every domain registered beneath it.
DNSSEC: DNSSEC (DNS Security Extensions) lets a domain owner sign their records, and lets a resolver verify those signatures against a chain of trust back to the DNS root. We route every DNS lookup we make through a DNSSEC-validating resolver, so if a signed domain's records fail to validate, we treat the answer as untrustworthy instead of acting on it. DNSSEC isn't required — most domains still aren't signed — but we validate it whenever it's present.