Verifying domain ownership

Before we send a single packet to your site, you have to prove you control the domain. This protects you (nobody else can scan your site through us) and keeps us on the right side of the line legally. You only verify once per domain; after that, re-scans and scheduled scans reuse the proof.

Method 1 — DNS TXT record

We give you a token. Add it as a TXT record and we confirm it over DNS:

• Host / name: _cyber-report-verify.yourdomain.com
• Value: cyber-report-verify=<your-token>

This is the most robust method — it survives re-scans and is what scheduled scans re-check. DNS changes can take a few minutes to propagate; if the first check fails, wait and retry.

Leave the record in place. Every re-scan and scheduled scan re-checks it silently, so deleting it means verifying again by hand next time.

If your domain is on Cloudflare

We can add the record for you. On the verification page, open Your domain is on Cloudflare? and paste a Cloudflare API token. Create a scoped token — in Cloudflare, My Profile → API Tokens → Create Token, using the Edit zone DNS template restricted to the one domain.

Never paste a Global API Key, here or anywhere else — it grants access to your entire Cloudflare account, and we refuse it if you try. We use the scoped token once to write the record and then discard it: it is never stored, and we never need it again. You can delete it in Cloudflare the moment verification finishes.

Writing the record doesn't itself prove anything to us — we still confirm it by reading public DNS, the same as if you'd added it yourself. The connector only saves you a trip to your DNS panel, and adding the record by hand works exactly as well.

Method 2 — HTML file upload

Prefer not to touch DNS? Host a small verification file on the site itself at the path we show you. We fetch it over HTTPS and confirm the token matches. Handy when you have web access but not DNS.

Method 3 — Email at the domain

If your domain runs its own email (not a shared or public-email provider), you can verify by receiving a one-time code at an address on that domain — for example [email protected]. Enter the code we email you and you’re verified. This option is hidden automatically for shared/public-email domains, where an address doesn’t prove control of the domain.

If verification keeps failing

• Double-check the record name and value for stray spaces or quotes.
• Give DNS time to propagate before retrying.
• There’s a cap on verification attempts per scan; if you hit it, just start a new scan.