Verified domains
Prove you control a hostname once, then use it for leak scans, custom ingest URLs, or both.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
One verification, two uses
A verified domain is a hostname you have proved you control. Leak Alarm scans only verified domains, and custom ingest URLs run only on verified domains, so one verification covers both. Choose what each domain is used for after it is verified, and it counts once either way.
Every hostname counts on its own
example.com, app.example.com, and www.example.com are three domains. Each is verified with its own record, and each counts toward your plan:
| Plan | Verified domains |
|---|---|
| Hobby | 1 |
| Starter | 10 |
| Pro | 30 |
| Business | Unlimited |
Verify a domain
- In the dashboard, open Domains and add the hostname.
- Publish the TXT record it shows you, on
_shellorbit-challenge.followed by your hostname. The value is a token bound to this one claim. - Choose Verify. Most DNS providers publish within minutes; some take an hour.
Finding the record shows control of the zone at the moment we looked, which is the same evidence a certificate authority accepts. Scans work on any hostname, the apex included. Ingest URLs need a subdomain such as hooks.yourapp.com; see Custom ingest domain.
Kept current
The record is checked again before every scan. If it is gone, for example because the domain changed hands, scanning stops and you are told why. Remove the record, or the domain in the dashboard, to stop on purpose.