product · DNS integrations
DNS is the boring, well-understood proof-of-control mechanism used by every certificate authority and domain-verification service. Quidnug uses the same pattern, with first-party integrations for the three big cloud DNS providers and a manual fallback that works with anyone.
How integrations work
Cloudflare issues an API token scoped to your zone.
Route 53 uses an IAM role with
ChangeResourceRecordSets narrowed to the
specific zone and record name. Google uses workload
identity. In all three cases we can add the TXT record
and nothing else.
On claim, we call the provider API once to create
_quidnug-challenge.yourdomain.com TXT "<token>"
with a 5-minute TTL. That's the only write we ever make
on your zone.
We never trust a single resolver, not even the one your integration writes through. We read the TXT record via Cloudflare 1.1.1.1, Google 8.8.8.8, Quad9 9.9.9.9, and OpenDNS 208.67.222.222, and require 3-of-4 agreement on the exact token.
Keeping the TXT record in place simplifies continuous re-verification. You can also ask us to delete it after initial verification; subsequent rechecks will fail harmlessly until the next renewal window.
Free tier: daily. Pro: hourly. Business: every 15 minutes. Governance: custom. If the record stops resolving, we publish a revocation edge and notify you; you have a grace period to restore before the signed attestation is fully withdrawn.
Revoke our access at any time from your provider's console. We'll notice on the next renewal attempt, degrade your badge to unverified, and preserve a read-only archive of past attestations.
Security properties
An attacker who controls a single resolver (or a captive network) cannot trick validation into success. Four independent public resolvers must agree on the token.
Tokens are bound to the specific claim and expire after 15 minutes of inactivity. Replaying an old token against a new claim fails the scope check.
Tokens are zone-scoped and permission-narrowed so that a compromised integration credential can add one TXT record but cannot alter your MX, A, or NS records.
The signed attestation edge is verifiable without us. Your customers hold the cryptographic artifact; we only hold the infrastructure that produced it.
Request a provider
Tell us which DNS provider you use when you sign up; we bump requests with paying customers to the front of the queue. All new provider integrations ship with the same security properties as the day-one integrations.