Verify your domain in AYAsec using Hetzner

Add one TXT record in the Hetzner DNS Console to prove you control your domain. Two minutes - starting with which Hetzner console you need.

Before AYAsec scans a domain, you need to prove you control it. In Hetzner that is one TXT record, usually live within a minute or two.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

Start in the right console

Hetzner moved DNS. If you are following older instructions, this is the step that will not match.

DNS now lives in the unified Hetzner Console at console.hetzner.com, inside a project, on the DNS entry in the left menu - alongside your Cloud resources rather than in a separate product. Hetzner's current documentation describes only this console.

If you have API tokens or integrations from the old DNS Console, note that Hetzner states those tokens do not work with the new API, and several integration names changed with the move.

Before you start

  • Access to the Hetzner account holding the DNS zone
  • Your verification token from AYAsec
  • The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have Hetzner access? - there is a message you can forward.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page. Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - , select DNS Record. Copy the two values shown:

  • Record name: _ayasec-verified.yourdomain.com (your apex domain, for example example.com, also when you verify www.example.com or another subdomain: one record verifies the apex and every subdomain)
  • Record value: the value shown in the verification dialog (it looks like ayasec-verification= followed by 32 characters)

Keep the tab open.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - and says Verifying covers all N targets in this group; its action is Verify now. The record value is the same ayasec-verification= value as for a single asset, so if you already added it for this domain you do not need another record.

Step 2 · Add the TXT record in Hetzner

  • In Hetzner Console, open your project, select DNS, then select your zone.
  • Click the Type field to open the list of record types and choose TXT.
  • Fill in:

Field - What to enter

Type - TXT

Name - _ayasec-verified - see the suffix rule below

Value - Your token, in double quotes

TTL - Leave the default

  • Click Add.

Two Hetzner rules worth knowing before you save

Quotes are required. Hetzner's documentation states that a TXT value has to be quoted, and every example in their docs is wrapped in double quotes. Enter "ayasec-verified-..." with the quotes. This matches AWS Route 53 and is the opposite of Cloudflare, which adds the quoting itself.

A trailing dot changes the meaning. Hetzner appends the zone to anything that does not end in a dot, and uses it verbatim if it does. So _ayasec-verified becomes _ayasec-verified.yourdomain.com, which is what you want. The column is labelled *Name (use @ for root)* - @ means the apex, and you do not need it here.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs. Hetzner usually serves a new record within a minute or two. If the first attempt fails, wait briefly and retry before changing anything.

Check the Hetzner record yourself

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

Your token should appear. Nothing returned means the record has not saved or has not propagated.

If Hetzner verification fails

What you see - What it usually means - Fix

Record not found - Record added in a zone that is not authoritative, or the name is wrong - Check the domain's nameservers point at Hetzner, then check the name reads _ayasec-verified

Token doesn't match - Extra characters in the value - Re-copy from AYAsec. Check for a trailing space

Domain unreachable - DNS is not resolving - Confirm the domain resolves before looking at the record

Timed out - Temporary lookup problem - Wait a minute and retry

If you registered the domain elsewhere and only host with Hetzner, the zone that matters may still be at your registrar. The nameservers on the domain tell you which one the internet is reading.

The Hetzner trap worth knowing about. If the domain's nameservers never get pointed at Hetzner, the zone you just edited is not the one the internet reads - verification will keep failing no matter how correct the record is. Hetzner also does not keep such a zone indefinitely: their FAQ describes zones that stay improperly delegated for more than 28 days being deleted automatically, after warning emails.

So a record that never verifies is worth investigating within days rather than weeks. Take the nameserver addresses from the zone's own Name servers tab rather than from a list - Hetzner publishes several sets, including a separate one for konsoleH customers.

Don't have Hetzner access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one DNS record? DNS is in the Hetzner Console at console.hetzner.com, under DNS in the project menu.

Type: TXT

Name: _ayasec-verified

Value: ayasec-verification=

TTL: default

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

  • File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
  • Meta tag - on your homepage

Both prove the same thing. If you can deploy to the website but not to DNS, the meta tag is usually quickest.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for Cloudflare, AWS Route 53, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy and Contabo.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan