Verify your domain in AYAsec using Azure DNS

Add one TXT record set in Azure DNS to prove you control your domain. Takes about three minutes, with the record set behaviour explained.

Before AYAsec scans a domain, you need to prove you control it. In Azure DNS that is one TXT record set, and it is usually live within a minute or two.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

Before you start

  • Access to the Azure subscription holding the DNS zone, with permission to edit records
  • Your verification token from AYAsec
  • The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have Azure DNS access? - there is a message you can forward.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page. Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - , select DNS Record. Copy the two values shown:

  • Record name: _ayasec-verified.yourdomain.com (your apex domain, for example example.com, also when you verify www.example.com or another subdomain: one record verifies the apex and every subdomain)
  • Record value: the value shown in the verification dialog (it looks like ayasec-verification= followed by 32 characters)

Keep the tab open.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - and says Verifying covers all N targets in this group; its action is Verify now. The record value is the same ayasec-verification= value as for a single asset, so if you already added it for this domain you do not need another record.

Step 2 · Add the record set in Azure

  • In the Azure portal, open your DNS zone.
  • Select Record sets, then + Add. The pane that opens is titled Add a record set.
  • Fill in:

Field - What to enter

Name - _ayasec-verified

Type - TXT

TTL - Leave the default

Value - Your token

  • Select Add.

If you later edit the set rather than create it, Azure saves with Apply at the bottom of the page - not a Save or OK button. People miss it and assume the change went through.

Azure groups records into sets

This is the part that works differently from most providers, and it matters if you use TXT records for anything else.

Azure DNS does not store individual records - it stores record sets. One set holds every value for a given name and type. If a TXT record set already exists at _ayasec-verified, add your token as an additional value inside that set rather than creating a second one. Azure will not let you create two sets with the same name and type, and trying is the usual source of confusion here.

For the same reason, deleting the set later removes every value in it, not only ours.

An empty record set can also exist without being published to the nameservers, so a set that looks present in the portal is not proof that anything resolves.

The Azure trap: the same zone can exist more than once

This is the one worth reading even if you skip everything else.

Azure lets you create a DNS zone for a domain you do not own, and it lets the same zone name exist in different resource groups or different subscriptions. Each of those copies gets its own set of nameserver addresses, and only one of those sets can be the one configured at your registrar.

The result is a record that is perfectly correct and completely invisible. You add the TXT record, the portal shows it, and nothing resolves - because the zone you edited is not the zone the internet reads.

If verification fails and the record looks right, compare the nameservers on the zone overview with the nameservers the domain actually uses:

dig NS yourdomain.com +short

If they do not match, you are in the wrong copy of the zone.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs. Azure usually serves a new record within a minute or two. If the first attempt fails, wait briefly and retry before changing anything.

Check the Azure DNS record yourself

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

Your token should appear. Nothing returned means the record has not saved or has not propagated.

If Azure DNS verification fails

What you see - What it usually means - Fix

Record not found - Record not saved, or the name is wrong - Check it reads _ayasec-verified, including the underscore

Token doesn't match - Extra characters in the value - Re-copy from AYAsec. Check for a trailing space

Domain unreachable - DNS is not resolving - Confirm the domain's nameservers point at this Azure zone

Timed out - Temporary lookup problem - Wait a minute and retry

The most common cause of a record that saves cleanly and cannot be found: the domain was registered elsewhere and delegated to Azure incompletely, so the zone exists in Azure but is not the one answering queries. Check the nameservers on the domain at the registrar before assuming anything is wrong with the record.

If you have several subscriptions, also confirm you are editing the zone in the right one.

Don't have Azure DNS access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one record set in our Azure DNS zone?

Name: _ayasec-verified

Type: TXT

Value: ayasec-verification=

TTL: default

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

  • File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
  • Meta tag - on your homepage

Both prove the same thing. If you can deploy to the website but not to DNS, the meta tag is usually quickest.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for Cloudflare, AWS Route 53, Google Cloud DNS, DigitalOcean, GoDaddy, Hetzner and Contabo.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan