Monitor your first domain
Adding a domain tells NoCert which names are yours. Verification with a DNS record starts recurring discovery.
You need the operator or owner role. Viewers cannot see Domains.
1. Add the domain
Section titled “1. Add the domain”Open Domains and select Add Domain.
Enter the name on its own, with no scheme, port or trailing dot: example.com. Subdomains work too, so shop.example.com is a valid entry.
Two kinds of name are refused: wildcards like *.example.com, which are not a domain you can prove ownership of, and internal-only suffixes such as .local, .internal or .lan. An internal-only namespace has no public DNS to verify against, so cover those hosts with a Sentinel instead.
Add Domain opens the verification dialog on save. Closing that dialog leaves the domain Pending; reopen Verify from its row when you are ready to publish the TXT record.
A Suggested domains panel sits beside the list, proposing names related to the ones you already own and zones a DNS connector has synced. Adding from there opens the verification dialog for you. So does adding a zone from Connectors.
2. Publish the TXT record
Section titled “2. Publish the TXT record”Use the dialog opened after adding the domain, or select Verify on its pending row.
nocert-verify=8f14e45fceea167a5a36dedd4bea2543That value goes on the domain you added, as a TXT record. Most providers ask for the host as a label relative to the zone, so what you type there is not the full name:
| Domain you added | Host field | Record it creates |
|---|---|---|
example.com |
@ |
example.com |
shop.example.com |
shop |
shop.example.com |
The dialog shows the full record name. If your DNS provider asks for a host relative to its zone, use the matching value in the table.
3. Leave the dialog open
Section titled “3. Leave the dialog open”Closing the dialog stops the polling. Nothing re-checks DNS on its own and no email announces success, so the domain sits Pending until someone opens Verify again. The record you published stays valid in the meantime, so reopening it verifies straight away.
The dialog rechecks DNS every 12 seconds and closes when the record resolves. Check verification retries immediately when no check is already running.
If it has not resolved after a few minutes, confirm the record is visible from outside your network:
dig +short TXT shop.example.comNoCert reads DNS from a public resolver. A record that exists only on your internal view will never be seen.
What verification changes
Section titled “What verification changes”A verified domain moves to Active. NoCert then enumerates its subdomains and scans the public endpoints it finds, re-enumerating no more often than every 48 hours. The row shows the last run and the next one due.
Until then the domain sits Pending. Verification is what lets NoCert go back for more: repeat subdomain enumeration, scanning hostnames a DNS connector found, and adding an endpoint by hand. Anything already scanned keeps being rescanned either way. Your account email does not add a domain or start a scan.
You cannot tune enumeration or force a re-run. If you know about a host NoCert has not found, add it from Endpoints, which accepts public hostnames under a domain you have verified. Names that resolve only inside your network are refused there, and belong to a Sentinel.
Removing a domain
Section titled “Removing a domain”Deleting a domain stops its discovery and cancels its queued scans. Re-adding it later issues a new token, so you verify it again. Domains covers what a deletion keeps and what it removes.
- The dashboard explains what you are looking at once results arrive.
- Public scanning stops at your perimeter. For internal hosts, Install the Sentinel.