Domain verification (Verified host)

Notifly can scan ports of an arbitrary host. For someone else’s host the scanner is gentle — small portions of ports and low concurrency. If you verify ownership of the host, its scan runs in fast mode. A Verified host is a record “user X owns host Y” with a validity period of 365 days.

Host	Ports per scanner pass	Parallel connections
not verified	up to 50	6
verified	up to 350	16

The scanner goes through its tasks once a minute, so in practice verification makes a scan about 7 times faster and reduces the use of the daily portScansPerDay limit (which counts portions) by about as much. A full 1–65535 scan takes about a day without verification and about 3 hours with it.

Verification is optional

An unverified host can be scanned too — just more slowly. Verification affects only the speed of port scanning; neither monitors nor any other Notifly operation require it. The admin UI has no section for verification: it is done via the REST API described below.

The record is bound to the exact host string: verifying example.com does not cover www.example.com or the server’s IP address. Use exactly the host you verified in your scan.

Two verification methods

Ownership can be verified with one of two methods (method):

method	What to publish	Where Notifly checks
dns	a DNS TXT record _notifly-verify.<host> with value = token	resolving the TXT records of _notifly-verify.<host>
http	a file /.well-known/notifly-verify.txt, the only line = token	GET https://<host>/.well-known/notifly-verify.txt, on failure — http://

The token is a random UUID that Notifly issues at the start step. During the check, each TXT record value (or the file content) is compared with the token after trimming whitespace, so extra spaces and a trailing newline do not matter. For dns it is enough for the token to match any of the name’s TXT records.

HTTP check details

Notifly first requests the file over https:// with regular certificate validation; if the file cannot be obtained that way (connection error, invalid certificate, wrong status code or content), it tries http://. Redirects are not followed: the file must be served directly with status 200. The request timeout is 5 seconds, and at most 1 KB of the response is read. Connections to private and loopback addresses are blocked, so the file must be reachable from the internet.

Private addresses — automatic record

If a host resolves only to private addresses, Notifly does not check it over the network but immediately creates a record with method auto-private — on /verified-host/start, on /verified-host/check, and when a scan of such a host is created.

The following are considered private:

• the name localhost;
• loopback 127.0.0.0/8 and ::1/128;
• RFC 1918 — 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16;
• link-local 169.254.0.0/16 and fe80::/10;
• RFC 4193 ULA fc00::/7.

An automatic record does not enable internal network scanning

The Notifly scanner runs in the cloud and blocks connections to private, loopback and link-local addresses (SSRF protection). So an auto-private record speeds nothing up: a scan of such an address still completes with no open ports.

A host is considered private only if ALL of its addresses are private. If a hostname resolves to at least one public address, no automatic record is created — verification via DNS or HTTP is required.

Verification statuses

POST /verified-host/start returns a different status depending on the host:

status	When	HTTP code
already_verified	there is already a valid (non-expired) record for this host — returned in the host field	200
verified	the host is private, the record was created automatically (method: "auto-private") — in the host field	201
pending	a public host — token and instruction are issued, waiting for your step and check	200

The server stores nothing until a successful check: remember the token on the client and pass it back to /verified-host/check. Calling start again issues a new token.

How to verify a domain

Step 1 — start verification

curl -X POST "$NOTIFLY_URL/verified-host/start" \
     -H "Content-Type: application/json" \
     -H "X-Notifly-Key: <api-token>" \
     -d '{ "host": "example.com", "method": "dns" }'

Response for a public host:

{
  "status": "pending",
  "token": "550e8400-e29b-41d4-a716-446655440000",
  "method": "dns",
  "host": "example.com",
  "instruction": "Create a DNS TXT record: _notifly-verify.example.com with value: 550e8400-e29b-41d4-a716-446655440000"
}

method is required and must be dns or http (otherwise 400).

Step 2 — publish the proof

dns method — create a TXT record in the domain’s zone:

_notifly-verify.example.com.  IN  TXT  "550e8400-e29b-41d4-a716-446655440000"

http method — place a file at /.well-known/notifly-verify.txt so that it is served at:

https://example.com/.well-known/notifly-verify.txt

The file content is exactly the token, on a single line:

550e8400-e29b-41d4-a716-446655440000

Step 3 — run the check

Pass host, method and token to check. For DNS, wait for the record to propagate (TTL may be several minutes) before calling it:

curl -X POST "$NOTIFLY_URL/verified-host/check" \
     -H "Content-Type: application/json" \
     -H "X-Notifly-Key: <api-token>" \
     -d '{
       "host": "example.com",
       "method": "dns",
       "token": "550e8400-e29b-41d4-a716-446655440000"
     }'

On success the record is created and the response is 201 with the object:

{
  "id": 42,
  "host": "example.com",
  "method": "dns",
  "verifiedAt": "2026-06-23T10:00:00Z",
  "expiresAt": "2027-06-23T10:00:00Z"
}

If the token is not found (the TXT record has not propagated, the file is unavailable, the value does not match), the response is 422 with an explanation in the error field, for example token not found in TXT records for _notifly-verify.example.com or HTTP 404 from http://example.com/.well-known/notifly-verify.txt. Just repeat check after fixing the problem — with the same token.

The HTTP check is often faster

The http method does not require waiting for DNS propagation — as soon as the file is available, check passes immediately. Handy for hosts where you have access to the web server but no rights to edit the DNS zone.

Validity period

A record is valid for 365 days from verification. After that it disappears from the list, and the host is scanned in the regular (slow) mode again. There are no expiry reminders — to renew, go through start → check again. The TXT record or the file can be removed after a successful check: Notifly does not check them again.

Viewing and deletion

List of the user’s valid (non-expired) verifications:

curl "$NOTIFLY_URL/verified-host" \
     -H "X-Notifly-Key: <api-token>"

[
  {
    "id": 42,
    "host": "example.com",
    "method": "dns",
    "verifiedAt": "2026-06-23T10:00:00Z",
    "expiresAt": "2027-06-23T10:00:00Z"
  }
]

Delete a verification (for example, if the host is no longer yours):

curl -X DELETE "$NOTIFLY_URL/verified-host/42" \
     -H "X-Notifly-Key: <api-token>"
# → {"ok":true}

You can delete only your own record: someone else’s or a non-existent id returns 404.

REST API

Authorization is the X-Notifly-Key header with an API token. The base URL is $NOTIFLY_URL (https://api.notifly.ru). Errors come as {"error": "..."}.

Method	Path	Description
GET	/verified-host	List of the user’s valid verifications
POST	/verified-host/start	Start verification: { "host", "method" }, where method is dns or http. Returns status (already_verified / verified / pending) and, for a public host, token + instruction
POST	/verified-host/check	Check the published proof: { "host", "method", "token" }. Success → 201 and the record object; failure → 422 with error
DELETE	/verified-host/:id	Delete your verification by id (someone else’s / non-existent → 404)

Fields of the VerifiedHost object: id, host, method (dns / http / auto-private), verifiedAt, expiresAt. The token is not returned.

See also

• Port scanning — the only consumer of verified hosts: verified hosts are scanned in fast mode.
• Port monitor and monitors — continuous control of ports and host availability (they don’t need verification).