Verify your domain in AYAsec using Cloudflare

Before AYAsec scans a domain, you need to prove you control it. This takes about two minutes in Cloudflare, and usually verifies within a minute of saving the record.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

Before you start

Access to the Cloudflare account that manages your domain's DNS, with permission to edit DNS records
Your verification token from AYAsec - step 1 shows where to find it
The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have Cloudflare access? - there is a message you can forward.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page.
Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - <host>, select DNS Record.
Copy the two values shown:

- Record name: _ayasec-verified.yourdomain.com - Record value: ayasec-verified-<asset UUID>

Both have a copy button. Keep the tab open - you come back to it in step 3.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - <apex> and says Verifying <apex> covers all N targets in this group; its action is Verify now. Use ayasec-verified-group-<group UUID> as a separate TXT record at the same name - do not replace an existing asset token.

Step 2 · Add the TXT record in Cloudflare

Sign in at dash.cloudflare.com and select your domain.
In the left sidebar, open DNS → Records.
Click Add record.
Fill in the fields:

Field	What to enter
Type	`TXT`
Name	`_ayasec-verified`
Content	The token you copied
TTL	Leave on Auto

Click Save.

Two things people get wrong here

Do not type the full domain in the Name field. Cloudflare adds it for you. Enter _ayasec-verified and it becomes _ayasec-verified.yourdomain.com. Paste the whole thing and the record can end up as _ayasec-verified.yourdomain.com.yourdomain.com.

Do not add quotes around the token. Cloudflare handles the quoting itself. This is the opposite of what AWS Route 53 requires, which catches people who have done both.

There is no proxy setting to worry about. TXT records are never proxied, so the orange cloud toggle does not appear here.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs.

Cloudflare runs its own DNS, so new records are usually live within seconds. If the check fails on the first try, wait a minute and try again before changing anything.

Check the record yourself

To confirm the record is visible before clicking Verify:

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

Your token should appear in the output. Nothing returned means the record has not saved or has not propagated.

If verification fails

What you see	What it usually means	Fix
Record not found	The record has not saved, or the name is wrong	Check it reads `_ayasec-verified.yourdomain.com`, including the underscore
Token doesn't match	The value was pasted with extra characters	Re-copy from AYAsec. Watch for a trailing space or added quotes
Domain unreachable	DNS for the domain is not resolving	Confirm the domain resolves at all, and that Cloudflare is its authoritative nameserver
Timed out	Temporary lookup problem	Wait a minute and try again

Still stuck after a few tries? Send us the domain and the method you used, and we will look at what our checker sees.

Don't have Cloudflare access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one DNS record in Cloudflare?

Type: TXT
Name: _ayasec-verified
Content: ayasec-verified-<paste token>
TTL: Auto

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
Meta tag - <meta name="ayasec-verified" content="your-token"> on your homepage

Both prove the same thing. If you can deploy to the website but not to DNS, the meta tag is usually quickest.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for AWS Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy, Hetzner and Contabo.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan