The verdict
The most important function in the system. Evidence goes in, and a verdict comes out, with no network and no side effects.
The rule
A domain is verified only when all three of these hold at once. Each one is there to stop a specific way of being fooled.
A timeout is not a no
This is the distinction most verifiers get wrong. NXDOMAIN and an empty answer are real answers: the server looked and there's nothing. A timeout or SERVFAIL means we learned nothing. Treating those as "the record isn't there" would blame the person for someone else's outage, and later, it could take away a real owner's status.
Naming every failure
When the record isn't exactly right, the classifier works out why. This is what turns "verification failed" into "you have a 1 where the code has an l".
The order matters
These run top to bottom and the first match wins. A quoted old code should say "this is an older code", because that's the more useful message, so stale_token goes first.
| # | Reason | How it's recognised |
|---|---|---|
| 1 | stale_token | It's a value issued earlier for this name |
| 2 | extra_quotes | Has quote marks, and matches once they're gone |
| 3 | extra_whitespace | Has whitespace, and matches once it's gone |
| 4 | wrong_prefix | Doesn't start with the prefix, but ends with the code |
| 5 | truncated | Shorter, and a start or end of the right value |
| 6 | lookalike_character | Matches if confusable characters count as equal |
| 7 | different_token | None of the above |
If nothing's at the right name, the engine goes looking in the places a mistake would have put it. That's why a check also asks about names you never told it to use.
| Reason | The evidence |
|---|---|
nothing_at_name | None of the above |
host_doubled | Found at _prufy-challenge.example.com.example.com |
wrong_name | Found at the apex, or without the underscore |
not_at_authoritative | Public DNS has it, the zone's own servers don't |
cname_at_name | An authoritative server has a CNAME at the name |
nxdomain_zone | No nameservers exist for this domain at all |
Why a CNAME doesn't pass
If _prufy-challenge.example.com is a CNAME pointing to a name that holds the right code, rule (b) still fails, because authoritative servers don't chase CNAMEs for you. The engine could chase it, but then the proof would live in a zone other than the one being claimed.