A target is only scanned once its organization proves it controls the host. Scans of a target that isn't verified are refused, scheduled or not.
Proving control is step 2 of adding a target, with the two ways side by side. For a target added earlier, it's on its Scans page.
One click
Where your DNS provider supports Domain Connect, the DNS record card shows Set up with your provider. It opens your provider with the record filled in; you sign in there, approve it, and come back, and the record is checked at once. Nothing changes at your provider until you approve.
Elsewhere the card links straight to your DNS host's settings (Namecheap, GoDaddy, Route 53, Azure DNS, IONOS, Wix and others), with the record to add below. If your domain is registered at one company and its DNS is at another (bought at GoDaddy, DNS at Cloudflare, say), the card says so: add the record where the DNS is, since records added at the registrar have no effect.
For the hosts it knows, the card also gives the steps in that host's own words: where its DNS records are, which of its fields each value goes in (with a copy button on each), the Name written the way that host wants it (usually without your domain, which it adds itself), and anything easy to miss, such as Cloudflare's proxy that must be off for these records. For a host it doesn't know, it shows your domain's name servers, so you can tell where your DNS is managed.
By DNS record
Under DNS TXT record, the TXT record to publish:
| Name | Value |
|---|---|
_akadenia-security.<host> |
akadenia-security-verification=<token> |
- Add that TXT record at your DNS provider.
- Choose Check now. It asks your domain's own nameservers, so a record you just saved is usually found right away, even if you checked before adding it.
If it isn't found, check the record's Name. Most DNS providers add your domain to the name for you, so pasting the full name gives _akadenia-security.example.com.example.com. Akadenia Security spots that and tells you the Name to use instead (for example _akadenia-security). The same goes for the email records (DMARC, SMTP TLS reporting and MTA-STS).
The record is checked again every day, so removing it stops the scans. Keep it for as long as you want the target scanned.
By emailed code
If publishing a DNS record is hard, verify by email instead:
- Under Email code, pick one of the addresses offered and choose Send code. The addresses are
admin@,administrator@,webmaster@,hostmaster@orpostmaster@the host, or a parent domain up to the registered one. These are the addresses certificate authorities accept; no other address can be used. - Enter the 6-digit code from the email and choose Verify. A code works for 30 minutes and 5 tries.
A target verified by email stays verified for a year. Add the DNS record before then, or verify by email again, to keep scanning.
Names on shared platforms (for example myshopify.com or herokuapp.com) can't be verified by email: their admins don't speak for their customers.
Subdomains
Once a domain is verified in your organization, its subdomains are verified through it, with no record of their own: with example.com verified, api.example.com is too. That holds wherever the subdomain points, such as a load balancer, a CDN or a hosted service.
If the domain's target is removed or stops being verified, its subdomains need their own record from their next scan.
Hosts that can't be verified
- Private addresses: a host that resolves to a private, loopback or reserved address fails verification and is never scanned.
- IP addresses: an IP address target needs an exemption from Akadenia with a recorded reason. Contact us if you need one.
- A subdomain that doesn't resolve isn't verified.
A domain with no website (no A or AAAA record) is verified by its TXT record alone. Its email, lookalike and subdomain checks still run; scanners that connect to the host don't.