Verifying your domain: step-by-step guide

Published on May 29, 2026

Before Exposentry may scan your domain, we ask you to prove once that you own or administer it. This protects both you and others: no one can run a scan against a domain that is not theirs. For most plans you only need to complete one of the three methods below; pick whichever is easiest for you. The NIS2 plans (NIS2 Monitoring and NIS2 + Keten) require two at once. See Do I need to do all three methods? at the bottom.

Step 1: Get your verification token

After payment you receive a unique token: a long string of characters. You can find it in two places:

On the confirmation page right after payment.
In your dashboard next to the domain, as long as its status is still Pending.

Below we refer to this token as YOUR-TOKEN. Replace it everywhere with your own token.

Step 2: Choose one verification method

Method 1: DNS TXT record (recommended)

Suitable if you have access to your domain's DNS settings, at your registrar or hosting provider. Add this record:

Type	`TXT`
Name / Host	`_ex-verify`
Value / Content	`ex-verify=YOUR-TOKEN`
TTL	default or lowest available (e.g. 300)

Note the naming: some providers expect just _ex-verify, others the full name _ex-verify.yourdomain.com. When in doubt, enter _ex-verify. The provider usually completes the rest automatically.

DNS changes are usually active within minutes, sometimes longer if your provider uses a high (negative) TTL.

Check yourself whether the record is live. You don't have to wait blindly. Check propagation yourself from the command line:

dig TXT _ex-verify.yourdomain.com +short

or, on Windows: nslookup -type=TXT _ex-verify.yourdomain.com. As soon as ex-verify=YOUR-TOKEN appears in the output, the record has propagated. Prefer a web tool? Use dnschecker.org or MXToolbox and look up the TXT record for _ex-verify.yourdomain.com.

Method 2: File on the web server

Suitable if you can place files on your website (via FTP, SFTP, cPanel, Plesk or your CMS).

Create a text file containing only the token, without ex-verify= in front, and without extra spaces or lines.
Place it so it is reachable at exactly this URL: https://yourdomain.com/.well-known/ex-verify.txt (a .well-known folder in the web root containing ex-verify.txt).
Check it yourself by opening that URL in your browser. You should see only the token.

Important: the file must be reachable over https and the page must not redirect.

Method 3: HTML meta tag on the homepage

Suitable if you can edit the homepage but cannot place individual files (for example with some CMSes or website builders). Add this line to the <head> of your homepage:

<meta name="exposentry-verification" content="YOUR-TOKEN">

In many CMSes this is possible without code:

WordPress: via an SEO plugin (Yoast or Rank Math → extra <head> code) or the theme's "header scripts" option.
Wix / Squarespace / Webflow: settings → Custom code / Header → paste the line.

Important: we read your homepage at https://yourdomain.com/ without following redirects. If your apex domain redirects visitors to www or a language page (for example /en), we won't see the meta tag. In that case, use the DNS method.

Step 3: Verification and start of the scan

You don't need to do anything after this. Exposentry automatically checks every 10 minutes whether one of the methods has succeeded. As soon as it does:

the status in your dashboard switches to Verified;
the security scan starts automatically;
you receive the report by email afterwards (check your spam folder if needed) and can also view it in the dashboard.

Frequently asked questions

Verification fails. Now what?

DNS: check that the value is exactly ex-verify=YOUR-TOKEN and the name _ex-verify. A space or typo is the most common cause.
DNS propagation: record demonstrably correct but verification still failing? Give it time to propagate. Usually that takes minutes, but with a high TTL it can run to several hours or sometimes longer. Use the self-check under Method 1 (dig/nslookup or dnschecker.org) to see whether the record is already visible.
File: open https://yourdomain.com/.well-known/ex-verify.txt in your browser. If you see a 404 or anything other than the bare token, the file isn't set up correctly.
Meta tag: view the page source (right-click → View page source) and search for exposentry-verification.

Do I need to do all three methods? For Nulmeting and Ketenpartner, no: one successful method is enough. For the NIS2 plans (NIS2 Monitoring and NIS2 + Keten) you need two: both the DNS TXT record and the .well-known/ex-verify.txt file. Those plans run the most extensive scan, so we set stricter requirements for proof of ownership. Never all three at once.

Can I remove the record or file afterwards? You may leave the record or file in place afterwards; it doesn't have to go. That saves hassle if we want to verify again in the future.

How long does it take? DNS changes are usually active within minutes, sometimes longer if your provider uses a high (negative) TTL. A file or meta tag works as soon as it is online.

Get started

No scan running yet? See the plans and pricing or start straight away with a scan. Stuck? Email us at scan@exposentry.io with your domain name and the method you tried, and we'll take a look.

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.