AYAsec domain verification - AWS Route 53

Add one TXT record in Route 53 to prove you control your domain. Takes about three minutes - including the quoting rule that catches most people.

Before AYAsec scans a domain, you need to prove you control it. In Route 53 that is one TXT record, and the record is usually live within a minute of saving.

Why we ask. Verification is what stops AYAsec from being pointed at infrastructure you do not own. A scanner that will check any domain on request is a reconnaissance tool for whoever asks, which is why the source of an asset list matters. Requiring proof of ownership is what separates a security product from a reconnaissance service.

You verify each asset once. Verifying an apex domain automatically verifies its subdomains, so verifying example.com covers api.example.com, www.example.com and the rest. New subdomains added later do not need their own record. Re-verify only if you edit the hostname or delete and re-add the asset, because the new asset has a new UUID token.

After successful verification, you can remove the record. AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you.

Before you start

  • Access to the AWS account holding the hosted zone, with permission to create records
  • Your verification token from AYAsec
  • The Analyst role or higher in your AYAsec workspace

If someone else manages your DNS, skip to Don't have Route 53 access? - there is a message you can forward.

Step 1 · Copy your token from AYAsec

Open Assets Discovery in AYAsec and open the Assets tab, or open the asset's detail page. Start verification from the Not verified pill, Verify now in the card menu, or Verify domain in the asset context menu. In the dialog titled Verify asset - , select DNS Record. Copy the two values shown:

  • Record name: _ayasec-verified.yourdomain.com (your apex domain, for example example.com, also when you verify www.example.com or another subdomain: one record verifies the apex and every subdomain)
  • Record value: the value shown in the verification dialog (it looks like ayasec-verification= followed by 32 characters)

Keep the tab open.

Verifying a whole asset group? Open Assets Discovery > Asset Groups and then open the group. Use Verify domain for a group with a source apex or Verify unverified for one without. The dialog is titled Verify domain - and says Verifying covers all N targets in this group; its action is Verify now. The record value is the same ayasec-verification= value as for a single asset, so if you already added it for this domain you do not need another record.

Step 2 · Create the record in Route 53

  • Open the Route 53 console and go to Hosted zones.
  • Select the hosted zone for your domain.
  • Click Create record.
  • Fill in:

Field - What to enter

Record name - _ayasec-verified - Route 53 appends your domain

Record type - TXT

Value - Your token wrapped in double quotes: "ayasec-verification= "

TTL - Leave the default

  • Click Create records.

The quoting rule

This is the one thing that catches people, and it is the opposite of what Cloudflare expects.

Route 53 requires the TXT value to be a quoted string. Enter "your-token", including the double quotes. Without them the record is rejected. The quotes are part of the TXT record format, not part of your token - AYAsec strips them when it reads the record, so you do not need to change anything on our side.

If you manage the zone through Terraform or CloudFormation rather than the console, the same applies: TXT record values are quoted strings there too.

Step 3 · Verify in AYAsec

Go back to AYAsec and click Verify Now. It shows Verifying… while the check runs.

Route 53 is authoritative for your domain, so the record is usually visible within a minute. If the first attempt fails, wait a moment and try again before changing anything.

Check the Route 53 record yourself

dig TXT _ayasec-verified.yourdomain.com +short

On Windows:

nslookup -type=TXT _ayasec-verified.yourdomain.com

Your token should appear in the output. Nothing returned means the record has not saved or has not propagated.

If Route 53 verification fails

What you see - What it usually means - Fix

Record not found - Record not saved, or the name is wrong - Check it reads _ayasec-verified.yourdomain.com, including the underscore

Token doesn't match - Extra characters in the value - Re-copy from AYAsec. Check for a trailing space

Domain unreachable - DNS is not resolving - Confirm Route 53 holds the authoritative nameservers for this domain

Timed out - Temporary lookup problem - Wait a minute and retry

Worth checking if nothing works: that the hosted zone you edited is the one the domain's nameservers actually point to. Having a zone in Route 53 does not mean the domain is served from it.

Don't have Route 53 access?

Most people verifying a domain do not administer its DNS. Forward this:

Hi - I'm setting up AYAsec to monitor our external attack surface, and it needs proof that we control the domain before it will scan anything.

Could you add one record in Route 53?

Hosted zone: *(our domain)*

Record name: _ayasec-verified

Record type: TXT

Value: "ayasec-verification= " - including the double quotes

TTL: default

It's read-only proof of ownership - it doesn't change how the domain behaves and doesn't affect mail or the website. It can be removed after AYAsec verifies it - AYAsec checks it once and does not read it again. You can leave it in place if you prefer, but re-verification after recreating the asset requires the new token AYAsec gives you. Thanks.

Other ways to verify

If you cannot edit DNS, AYAsec accepts two alternatives:

  • File upload - a text file containing your token at https://yourdomain.com/.well-known/ayasec-verified.txt
  • Meta tag - on your homepage

Both prove the same thing. If you can deploy to the website but not to DNS, the meta tag is usually quickest.

Using a different DNS provider?

The record is identical everywhere; only the interface changes. See the guides for Cloudflare, Azure DNS, Google Cloud DNS, DigitalOcean, GoDaddy, Hetzner and Contabo.

Once the domain is verified, Discovery and the first scan take a few minutes.

Run your first scan