Verifying your domain

Sign in with Atheron sends people back only to domains your team has proved it owns. You verify a domain once per team, on the team's Domains page (Teams, your team, Manage domains).

What needs a verified domain

A domain proved by a DNS record covers itself and every name under it: example.com covers app.example.com. A domain proved by the file or the meta tag covers that exact host only, so to use several subdomains, prove the apex by DNS or prove each host. An app scheme counts by its reverse-domain name: com.example.app:/auth is on app.example.com, so a DNS record on example.com covers it.

Test clients still sign in only your team and the testers who accepted an invite. Going live still needs every owner verified, or the business check passed.

Three ways to prove it

Add the domain to get its token, then use any one of these.

A DNS TXT record (recommended). On the domain itself, add a TXT record with the value:

A file. Serve that same line at https://<domain>/.well-known/atheron-verification.txt, with a 200 answer and no redirect.

A meta tag. In the head of https://<domain>/ (before </head>, not inside a script or a comment), with a 200 answer and no redirect:

Then press Check now. A new domain is also checked every hour for its first week, so a DNS record that takes time to spread is picked up on its own.

Re-checks

We check every verified domain once a day. Keep the record, file or tag in place.

When our own DNS is not answering, we judge nothing that day. If a check finds no proof, or nothing answers for your domain at all, the domain stays verified and the Domains page shows the date it lapses. After 7 days of failed checks the domain is no longer verified: apps that send people to it stop signing anybody in, and the team's owners get an email. Put the proof back and press Check now to restore it at once.

A domain proved by a DNS record that later passes only by the file or the tag keeps covering the names under it for the same 7 days. After that it covers its own host only, so put the DNS record back if your apps use subdomains.

Rules

• Owners and admins add, check and remove domains. Every team member sees them and their tokens.
• A team holds up to 20 domains. Two teams may verify the same domain, each with its own token.
• Our own domains cannot be verified.
• A domain an app still sends people to cannot be removed while no other verified domain covers that redirect. Change the redirect first.
• Fetches use https only, check the certificate, follow no redirect, stop after eight seconds in all and read the first 64 KB.