---
title: "Domain Verification"
description: "Verify you own or are authorized to test a domain before starting a pentest - the required first step, using a DNS TXT record or cloud-provider OAuth verification."
canonical: https://turbopentest.com/docs/account/domain-verification
source: "TurboPentest Docs"
---

# Domain Verification

Domain verification proves you own or are authorized to test a domain. This is required before starting any pentest.

## TLD verification hierarchy

TurboPentest uses a top-level domain (TLD) verification model. You verify a root domain once and all subdomains are automatically covered:

- Verify **example.com** (the top-level domain)
- All subdomains are automatically authorized - **api.example.com**, **app.example.com**, **staging.example.com**, etc.
- No need to verify each subdomain individually

This means you can add new pentest targets under a verified domain at any time without repeating the verification process.

## DNS TXT record method

1. Register your top-level domain with TurboPentest
2. Add a TXT record to your domain's DNS
3. Trigger the verification check

### Step-by-step

```bash title="Terminal"
# 1. Register your domain and get the verification token
curl -X POST https://turbopentest.com/api/tlds \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'
```

Response:
```json title="Response"
{
  "id": "1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70",
  "domain": "example.com",
  "verificationToken": "abc123def456",
  "status": "pending"
}
```

```bash title="Terminal"
# 2. Add DNS TXT record (using your DNS provider)
# Record type: TXT
# Host: @ (or example.com)
# Value: turbopentest-verify=abc123def456
# TTL: 300

# 3. Wait for DNS propagation (typically 1-5 minutes), then verify
curl -X POST https://turbopentest.com/api/tlds/1f0c9c4e-7a2b-4d3e-9f1a-2b3c4d5e6f70/verify \
  -H "Authorization: Bearer $TURBOPENTEST_API_KEY"
```

## Cloud-provider verification

If you connect a cloud provider for External Attack Surface Management (EASM), assets discovered through that authenticated connection are verified via the cloud provider's OAuth authorization instead of a DNS TXT record - proving control of the account is enough to authorize testing of the assets it owns. DNS TXT verification and cloud-provider OAuth verification are the two supported methods.

## Expiration

Domain verifications are valid for **1 year** from the date of verification. You will receive reminder emails before expiration:

| Reminder | When |
|----------|------|
| First reminder | 60 days before expiry |
| Second reminder | 30 days before expiry |
| Final reminder | 7 days before expiry |

When a verification expires, **all scheduled pentests under that domain are automatically paused**. You will need to re-verify the domain to resume them. Re-verification follows the same DNS TXT record process - your existing TXT record may still be in place, so you can often just trigger the verify check again.

## Limitations

- IP addresses cannot be verified (domain must be a hostname)
- The TXT record must be on the root domain, not a subdomain
- You must register the top-level domain - subdomains cannot be registered directly