The domain ยท 7 min
The proof
A challenge is the record someone has to publish. Every part of it has a reason.
Anatomy of the record
What gets published
Name
_prufy-challenge
An underscore name can't be a website, so it can't collide with anything
.example.com
The domain being claimed
Value
prufy-domain-verification=
Says what this record is for, among other TXT records
mfrggzdfmztwq2lknnwg23tpob
The code: unique to this attempt
TTL
300
Five minutes, so a mistake can be corrected quickly
The code itself
128 random bits, 26 charactersCalls the real newToken
b
m
y
f
k
6
u
7
y
t
u
q
4
m
2
y
p
w
r
m
p
3
a
r
g
y
About 340 undecillion possibilities. That's a 3 with 38 zeros after it.
It isn't a secret
This surprises people. The code gets published in public DNS, so anyone can read it. It's stored in plain text and shown again whenever you come back.
| A secret (password, reset link) | This code | |
|---|---|---|
| Who can see it | Only the owner | Anyone |
| Store it as | A hash | Plain text |
| Safe because | Nobody else knows it | It's unguessable, and only counts for one attempt |
| Reuse | Sometimes | Never. A unique constraint forbids it |
Predict it first
Mallory reads Alice's code from public DNS and pastes it into her own domain's records. What happens?
What to type
What goes in the host fieldUses the real catalog and recordToAdd
GoDaddy's form
Type
TXT
Name
_prufy-challenge.mail
Value
prufy-domain-verification=mfrggzdfmztwq2lknnwg23tpob
TTL
300
Where it ends up in DNS
_prufy-challenge.mail.example.com
The right place
_prufy-challenge.mail.Expiry and new codes
A code expires after 7 days while pending. "Get a new code" supersedes the old one in one transaction. The old value isn't forgotten: if it shows up in DNS later, you get the specific message stale_token instead of a vague mismatch.