Verify a domain you own
You can verify a web domain you already own against your DFOS identity, or against a space's identity. Your identity claims the domain, the domain answers back with your identity, and anyone can check both halves themselves without asking DFOS. Both sides have to agree, which is what makes it a proof rather than a claim.
You do this in Settings → Verified domain for yourself, and in Space Studio → Verified domain for a space you administer.
It does not host anything
Verifying a domain does not move your profile or your space to it. Your page stays exactly where it is, at the same address it had before. Nothing about your domain's website, email, or DNS changes beyond the one small record you publish to prove you hold it.
What it does is publicly link the domain to this identity, so apps and people can check that the domain really belongs to you.
What it proves — and what it doesn't
It proves you control that domain, at the moment it was last checked. That's all. It proves control, not endorsement: it is not a verification of who you are, a mark of notability, or a statement that anything you publish is any good.
That's also why DFOS never shows it as a lone checkmark or a badge. The status
always leads with the domain itself — example.com · Verified — because the
domain is the fact and you're meant to judge it yourself.
In Space Studio, Verified domain is not the same thing as the Domain
field under Public site. That one is your space's address on DFOS —
yourspace.dfos.com — which we hand out. This one is a domain you already own
somewhere else on the web, proving that you hold it. An address versus a proof.
Claim the domain
Type the bare domain — example.com, no https://, no path — and claim it.
You can claim it before you publish anything on the domain's side. That's the ordinary path: the claim sits as Not verified yet and DFOS keeps re-checking on its own until the domain answers. A claim that never gets answered is dropped after a week, and nothing was ever attached to your identity in the meantime.
An identity claims at most one domain. Claiming a second one replaces the first and removes its verification.
Publish one of the two records
The domain has to answer with your identity's address. There are two ways to do that and either one is enough — pick whichever your hosting allows. Both values are shown on the screen with a copy button, filled in for your identity.
| Method | What you publish |
|---|---|
| HTTPS document | A small text file at /.well-known/dfos-did, containing your address and nothing else |
| DNS TXT record | A TXT record at _dfos.<your domain> with the value shown on screen |
If you publish both, they have to name the same identity. Two records pointing at two different identities means the domain is contradicting itself, and neither one counts.
Once the record is live, press Check now rather than waiting — DFOS re-checks an unverified claim every hour on its own, but the button is instant.
A redirect is a refusal, not a hop
The HTTPS document has to be served by the domain itself, at that exact
path. If the request redirects anywhere — to www, to another host, even back
to the same page — DFOS does not follow it. The attestation has to come from the
domain it speaks for, and a redirect attests nothing.
That is the common reason a record that "looks live" in a browser never
verifies: a host set to redirect every unknown path, or a bare domain that
bounces to www, answers the browser and refuses the check. Serve the file at
https://<the exact domain you claimed>/.well-known/dfos-did with a plain
200.
A redirect lands on Not responding rather than Points elsewhere — DFOS
did not get an answer, so it does not claim to have been contradicted. So do all
the other ways a fetch can fail: a timeout, a TLS error, a 403, a 503. If a
verification goes quiet right after a hosting change, check the redirect rules
before the record itself.
What each status means
| Status | What happened |
|---|---|
| Not verified yet | You claimed the domain; it hasn't answered with your identity yet |
| Verified | The domain attests your identity, and your identity claims the domain |
| Not responding | We couldn't reach the record on the last check |
| Points elsewhere | The domain answered — with a different identity |
| Verification removed | The claim stayed unverified past its grace period and was taken off the identity |
Under the status you'll see what each method actually answered, so you can tell which half of the setup is missing, plus when the domain was claimed, last verified, and last checked.
"Not responding" is not "Points elsewhere"
These two look similar and mean opposite things, so DFOS keeps them apart on purpose.
Not responding means we couldn't check. Hosting goes down, a certificate lapses for an afternoon, a resolver times out — the web fails like this constantly, and your record is probably still exactly where you put it. Nothing has been removed, and nothing about your identity changed.
Points elsewhere means we checked and the domain contradicted us: something answered, with somebody else's identity. That usually means the domain changed hands, and it does not heal on its own.
They get different grace periods for that reason. A silent domain keeps its verification for about three weeks — a registrar can have a bad week. A domain actively attesting someone else keeps it for 72 hours. Either way the screen tells you the exact date, and a single successful check clears it.
If the grace period runs out, the verification is removed from your identity and the claim goes to Verification removed. Nothing else about your identity or its history changes — only the domain's side of the proof. Claim it again once the record is back up.
DFOS emails you when the status changes
Four transitions send you mail: the domain verified, it stopped responding, it started pointing elsewhere, and its verification was removed. Claiming a domain sends nothing — you just did that, and there is no news in it yet.
These arrive as email, never as a push notification, and that is on purpose. A binding change is slow news with a deadline attached — about three weeks of grace on a silent domain, 72 hours on a contradicted one — and the fix lives in a DNS console rather than in the app. That is a letter you keep, not a banner you swipe away.
A domain on your own identity mails you. A space's domain mails the space's admins, and also lands in the space's notification tray. Like other activity mail, these respect your email setting in Notifications — the letters DFOS sends regardless are receipts for money, not this.
Unbinding
Unbind removes the claim from your identity. Do this when you no longer control the domain, or when you no longer want the two associated. The record you published on the domain's side is yours to take down separately; on its own it proves nothing once the identity stops claiming it.
Related
- Accounts — your identity, your profile, and the privacy controls around them.
- Spaces — what a space is and who can change its settings.
- Origin binding — the developer side: the same proof from the command line, for an app identity whose keys you hold yourself.