Monitor your first domain
Adding a domain tells NoCert which names are yours. Verification with a DNS record starts recurring discovery.
You need the operator or owner role. Viewers cannot see Domains.
1. Add the domain
Section titled “1. Add the domain”Open Domains and select Add Domain.
Enter the name on its own, with no scheme, port or trailing dot: example.com. Subdomains work too, so shop.example.com is a valid entry.
Two kinds of name are refused: wildcards like *.example.com, which are not a domain you can prove ownership of, and internal-only suffixes such as .local, .internal or .lan. An internal-only namespace has no public DNS to verify against, so cover those hosts with a Sentinel instead.
Add Domain closes on save and leaves you on a Pending row. The dashboard carries a reminder with a Verify action until you deal with it.
A Suggested domains panel sits beside the list, proposing names related to the ones you already own and zones a DNS connector has synced. Adding from there opens the verification dialog for you. So does adding a zone from Connectors.
2. Publish the TXT record
Section titled “2. Publish the TXT record”Select Verify on the pending row.
nocert-verify=8f14e45fceea167a5a36dedd4bea2543That value goes on the domain you added, as a TXT record. Most providers ask for the host as a label relative to the zone, so what you type there is not the full name:
| Domain you added | Host field | Record it creates |
|---|---|---|
example.com |
@ |
example.com |
shop.example.com |
shop |
shop.example.com |
3. Leave the dialog open
Section titled “3. Leave the dialog open”Closing the dialog stops the polling. Nothing re-checks DNS on its own and no email announces success, so the domain sits Pending until someone opens Verify again. The record you published stays valid in the meantime, so reopening it verifies straight away.
The dialog rechecks DNS every 12 seconds and closes when the record resolves. Leave Check verification alone while it does: a manual check on top of the automatic one is rejected, and the dialog reports the rejection as a missing record.
If it has not resolved after a few minutes, confirm the record is visible from outside your network:
dig +short TXT shop.example.comNoCert reads DNS from a public resolver. A record that exists only on your internal view will never be seen.
What verification changes
Section titled “What verification changes”A verified domain moves to Active. NoCert then enumerates its subdomains and scans the public endpoints it finds, re-enumerating no more often than every 48 hours. The row shows the last run and the next one due.
Until then the domain sits Pending. Verification is what lets NoCert go back for more: repeat subdomain enumeration, scanning hostnames a DNS connector found, and adding an endpoint by hand. Anything already scanned keeps being rescanned either way, including whatever the signup pass found on your email domain.
You cannot tune enumeration or force a re-run. If you know about a host NoCert has not found, add it from Endpoints, which accepts public hostnames under a domain you have verified. Names that resolve only inside your network are refused there, and belong to a Sentinel.
Removing a domain
Section titled “Removing a domain”Deleting a domain stops its discovery and cancels its queued scans. Re-adding it later issues a new token, so you verify it again. Domains covers what a deletion keeps and what it removes.
- The dashboard explains what you are looking at once results arrive.
- Public scanning stops at your perimeter. For internal hosts, Install the Sentinel.