DNS verification — why we ask for a TXT record

Anyone can look up public DNS records with dig or nslookup. NSO doesn’t need you signed in to read those records. We need you to sign in to your DNS provider so you can prove ownership by publishing a one-time token we generate for your tenant. Publishing that token is the cryptographic handshake — nothing else in the workflow reveals sensitive data.

Public DNS queries tell us what records exist — not who put them there. If NSO let anyone claim a domain just because it resolves publicly, a malicious user could register your-company.com inside their tenant and:

• Generate false compliance reports about your infrastructure.
• Hijack webhook telemetry destined for your ingest endpoint.
• See findings that should only be visible to your team.

NSO generates a random token (for example cf08035f92bdb7e784bd9a72b4adc3ca) bound to your tenant ID. You add it as a TXT record on either the root host (your-company.com) or the _nso-verify subdomain.

• Only someone with authenticated admin access to your Cloudflare / Route53 / Namecheap zone can write that record, so publishing it proves you control the zone.
• Our backend runs a normal public DNS lookup, finds the token, matches it against your tenant, and flips the asset to Verified.

The token is public, opaque, and useless to anyone else. It exposes no credentials, no traffic, and no infrastructure detail.

“If a customer asks us to evaluate their network, do we really have to ask them to touch their DNS? A hacker wouldn’t do that.”

Exactly — and that is the point. A hacker doesn’t care about legal boundaries. They exploit an existing weakness (sub-domain takeover, open zone transfer, exposed admin panel) and quietly hijack the target. NSO is doing the opposite. When we ask you to publish a TXT record we are saying:

“I refuse to run intrusive scans on this asset until your administrative team explicitly proves to my system that they own it.”

If NSO skipped the handshake, a competitor could sign up, type in your-company.com, and immediately see the exact vulnerabilities we would normally only show you. The handshake is what stops NSO from becoming a free reconnaissance tool for your competitors.

“A public domain name is like the front door of an office building. Anyone can walk up and read the sign — that’s public record. But when you hire an independent security firm to audit inside the building, they don’t pick your locks. They ask you to hand them a temporary security badge that proves you have the authority to let them look around. Adding this TXT record to your DNS is your team handing us that digital badge.”

The TXT record contains zero sensitive data. It is a random text code used exactly once to confirm the handshake.

• /assets — live verification panel for your tenant.
• Rules of engagement — the DNS handshake is a hard prerequisite in section 2.
• /settings/verification-audit — every verification attempt and charge is itemized here.