Verifying a Domain You Monitor

What verification proves

Verifying a domain proves you control it, so Merlonix can issue attestations — signed, timestamped records that you are authorized to monitor the domain. Attestations are what make your SSL/DNS evidence audit-ready. You only verify a domain once; the attestation then covers ongoing monitoring.

Start from Attestations → New, pick the asset, and choose one of the three methods below. The wizard shows you a unique challenge token to use.

Method 1 — DNS TXT record (recommended)

Add a TXT record at your DNS provider:

• Name / host: _merlonix-verify.yourdomain.com (use _merlonix-verify if your provider auto-appends the domain)
• Type: TXT
• Value: the exact challenge token from the wizard

Save the record, then click Verify in the wizard. DNS changes can take a few minutes to propagate (up to ~5 minutes is normal). Leading/trailing spaces are ignored, and if you already have other TXT records on that name, that is fine — any record matching the token verifies.

Method 2 — HTTP file

If you can publish a file on the site, upload a plain-text file so it is reachable at:

https://yourdomain.com/.well-known/merlonix-<token>.txt

The file body must contain the exact challenge token (a trailing newline is fine). The URL must serve over HTTPS and return HTTP 200. Then click Verify. This method confirms instantly — there is no propagation delay — but the file must stay reachable while verification runs.

Method 3 — Admin email

Merlonix can send a verification link to a standard administrative mailbox on your domain (RFC 2142): admin@, administrator@, hostmaster@, webmaster@, or postmaster@ yourdomain.com. Choose the mailbox in the wizard, then open the email and click the link. The link is valid for 72 hours; verification completes when you click it (there is nothing to click again in the app).

Troubleshooting

• "No TXT records found": the record has not propagated yet, or the name is wrong. Confirm the host is _merlonix-verify.yourdomain.com and wait a few minutes. You can check with dig TXT _merlonix-verify.yourdomain.com.
• "TXT records found but none matched": the value does not exactly match the token. Re-copy the token from the wizard (no extra quotes or spaces).
• HTTP file returns non-200: make sure the file is at the exact /.well-known/merlonix-<token>.txt path, served over HTTPS, and not behind a login or redirect to a non-200 page.
• Email never arrives: check spam, confirm the admin mailbox exists and receives mail, and that the link has not passed its 72-hour window — if it has, restart the wizard for a fresh link.