Prove you control your domain

What this isCopy Anchor Link

Before CAIRL tells the people who use your site that it is a partner service — and offers Sign in with CAIRL there — you show CAIRL that the domain is yours. You do that once, by publishing a public value on the domain. CAIRL checks it, and the proof lasts 30 days.

The record must stay published. CAIRL re-checks it daily in the last 7 days of each window and renews the proof automatically while it is there. If the record is removed, the proof runs out and your site stops being listed.

The value you publish is not a secret. Anyone can read a DNS record, and that is the point: it proves who controls the domain, not who knows a password.

Before you startCopy Anchor Link

• You need a business facet with a callback URL registered on the domain you want to list. The proof step lists exactly the hosts of those callback URLs.
• You need to be an owner or admin of that facet. Members do not see the proof step.
• You need someone who can change DNS for the domain. That is often a different person, or a different account at your DNS host, from the one that runs your CAIRL business facet. Step 1 shows how to hand the change over.

Step 1 — Copy the recordCopy Anchor Link

In CAIRL, open your business facet, then Integration → Connect, and find Prove you control these domains. For each host it shows:

If someone else runs your DNS, press Copy instructions for your DNS admin or Email these instructions. Both give them the record, a note that it must stay published, and a link back to this page.

Step 2 — Add the record at your DNS hostCopy Anchor Link

Add a new record with the type, name and value from Step 1. Set the TTL to 5 minutes (300 seconds), or the lowest value your host allows.

Two mistakes cause almost every failed check:

1. Entering the full name. Most DNS hosts add your domain to whatever you type in the name field. If you enter _cairl-verify.example.com, the record is published as _cairl-verify.example.com.example.com and never verifies. Enter only _cairl-verify. For a subdomain such as shop.example.com in the example.com zone, enter _cairl-verify.shop.
2. Choosing the wrong record type. Some hosts list SPF or DMARC record types before plain TXT. Use plain TXT.

IONOSCopy Anchor Link

Domains & SSL → your domain → DNS → Add record → TXT. Choose plain TXT, not "SPF (TXT)", "IONOS SPF (TXT)" or "DMARC (TXT)", which appear first in the list. Host name: _cairl-verify. Value: the full cairl-domain-verification=… string. TTL: 5 minutes. Before saving, confirm the preview reads:

_cairl-verify.<your-domain> 300 IN TXT "cairl-domain-verification=…"

CloudflareCopy Anchor Link

Your domain → DNS → Records → Add record. Type: TXT. Name: _cairl-verify (Cloudflare adds the zone for you). Content: the full cairl-domain-verification=… string. TTL: Auto is fine.

No DNS access? Use a file insteadCopy Anchor Link

If you can publish files on the site but cannot change DNS, serve the same value as the only content of:

https://<your-domain>/.well-known/cairl-verification

It must be reachable over HTTPS with no redirect. Either method is enough; you do not need both. Like the DNS record, the file must stay published.

Step 3 — Confirm the record is publicCopy Anchor Link

DNS changes usually appear within a few minutes and can take up to an hour. To check before you press anything in CAIRL:

nslookup -type=TXT _cairl-verify.<your-domain> 1.1.1.1

The answer should include cairl-domain-verification=… exactly as shown on the card.

Step 4 — Check nowCopy Anchor Link

Back on Connect, press Check now next to the host. When it passes, the card shows Verified. Good until <date>, 30 days out. Checks are limited to 20 an hour per person, so wait for Step 3 to pass first.

If the check fails, the card says why. "We could not find the record yet" almost always means the name was entered with the domain doubled, the record type was SPF or DMARC instead of TXT, or DNS has not published yet.

Step 5 — Confirm you are listedCopy Anchor Link

Listing happens as soon as the proof passes, provided the rest of go-live is complete: a live callback URL on that domain, an active live environment and a live key. The Go-live readiness panel on your facet stops showing Not listed — prove your domain. You can also check directly while signed in to CAIRL (where your account has the lookup enabled):

https://app.cairl.co/api/accounts/lookup?domain=<your-domain>

A listed domain returns "status": "partner" inside data.

Keeping the listingCopy Anchor Link

• Leave the record published permanently. CAIRL renews the proof automatically for as long as the record stays.
• If a renewal check fails, CAIRL emails the facet's owners and admins and shows a warning on the card and in the Go-live readiness panel. You have until the proof's end date, up to 7 days, to put the record back.
• If the proof lapses, CAIRL pauses the listing: Sign in with CAIRL is no longer offered there and the CAIRL GateWay stops routing to it. Nothing is deleted, and people's saved accounts stay connected. The owners and admins receive a second email. The same pause applies if the live API key is revoked, the live callback URL is removed, or the live environment is switched off.
• To list the site again, put the record back (or fix what paused it), then press List again on the Connect proof card and confirm. CAIRL checks the record right then and re-checks live sign-in; if everything holds, the site is listed again under the same registry id.
• A paused listing is removed after 90 days. Owners and admins are emailed when removal is 14 days away or less. A removed listing does not come back by itself either: the card still offers List again, and confirming lists the site as a new registry entry with a new id. Saved accounts from before the removal are not reconnected.
• If another business proves the domain while yours cannot, the domain has changed hands: your paused listing is removed at once and theirs is listed. It is not held for 90 days. If the domain later comes back to you, your site is listed again only when you confirm.