Verify your domain in AYAsec using DigitalOcean

Before AYAsec scans a domain, you need to prove you control it. In DigitalOcean that is one TXT record, and it is usually live within a minute or two.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

Before you start

Access to the DigitalOcean account holding the domain, with permission to edit DNS
Your verification token from AYAsec
The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have access? - there is a message you can forward.

First, check DigitalOcean is actually serving your DNS

Do this before anything else, because it is the difference between two minutes and an afternoon.

DigitalOcean only answers DNS queries for domains whose nameservers point at DigitalOcean. Plenty of people host with DigitalOcean while their domain stays with the registrar that sold it, and in that case the DNS section here is not what the internet is reading. A record added in the wrong place looks perfectly correct and is never seen.

Check your domain's nameservers at your registrar. If they are not DigitalOcean's, the record belongs wherever they point, and one of the other provider guides will apply.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page. Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - <host>, select DNS Record. Copy the two values shown:

Record name: _ayasec-verified.yourdomain.com
Record value: ayasec-verified-<asset UUID>

Keep the tab open.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - <apex> and says Verifying <apex> covers all N targets in this group; its action is Verify now. Use ayasec-verified-group-<group UUID> as a separate TXT record at the same name - do not replace an existing asset token.

Step 2 · Add the record

In the DigitalOcean control panel, go to Networking → Domains.
Select your domain.
Choose the TXT tab.
Fill in:

Field	What to enter
Hostname	`_ayasec-verified` - DigitalOcean appends your domain
Value	Your token
TTL	Leave the default

Click Create Record.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs. DigitalOcean is usually quick to serve a new record. If the first attempt fails, wait a moment and retry before changing anything.

Check the record yourself

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

Your token should appear. Nothing returned usually means either the record has not saved, or the nameserver situation described above.

If verification fails

What you see	What it usually means	Fix
Record not found	Nameservers do not point at DigitalOcean, or the hostname is wrong	Check nameservers first, then that the hostname reads `_ayasec-verified`
Token doesn't match	Extra characters in the value	Re-copy from AYAsec. Check for a trailing space
Domain unreachable	DNS is not resolving at all	Confirm the domain resolves before looking at the record
Timed out	Temporary lookup problem	Wait a minute and retry

Don't have access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one DNS record in DigitalOcean?

Hostname: _ayasec-verified
Type: TXT
Value: ayasec-verified-<paste token>
TTL: default

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
Meta tag - <meta name="ayasec-verified" content="your-token"> on your homepage

Both prove the same thing. If you can deploy to the website but not to DNS, the meta tag is usually quickest.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, GoDaddy, Hetzner and Contabo.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan