Domains

Adding Domains

Overview

Domains represent the live environments where your application is deployed and accessible. Before Pensar can test your domains, they must be added to your project and verified using DNS TXT records. This verification process ensures you own or control the domains being tested.

Domain verification is required for both blackbox testing and whitebox testing against live environments.

Why Domain Verification?

Domain verification protects both you and other domain owners:

Prove Ownership

Verification ensures you control the domain before testing begins, preventing unauthorized security testing.

Prevent Abuse

Protects other organizations from having their domains tested without permission.

Compliance

Demonstrates due diligence and authorization for security testing activities.

Legal Protection

Verification provides evidence of authorization, protecting against legal concerns about penetration testing.

Adding a Domain

Follow these steps to add and verify a domain:

2

Enter Domain Information

Provide the domain details:

  • Domain URL: Just the domain name without protocol (e.g., app.example.com, not https://app.example.com)
  • API Schema (Optional): Upload an OpenAPI/Swagger schema file (JSON or YAML) to help with endpoint discovery
  • Sitemap (Optional): Upload a sitemap file (XML or TXT) to discover pages and routes
3

Configure Authentication & Testing Parameters

Optionally configure:

  • Authentication Credentials: Username/password or bearer tokens with role and context
  • Allowed Actions: Define what actions are permitted during testing (default includes read operations, authentication testing, injection testing)
  • Disallowed Actions: Define prohibited actions (default includes DELETE operations, dropping tables, DoS attacks)
4

Get Verification TXT Record

Pensar generates a unique DNS TXT record for verification: text Record Type: TXT Host: _pensar.app.example.com Value: pensar=abc123xyz789...

5

Add DNS TXT Record

Add the TXT record to your DNS configuration. See DNS provider instructions below.

6

Verify Domain

Once the DNS record is added and propagated, click “Verify Domain” in the Pensar Console.

7

Start Testing

After verification succeeds, the domain is ready for penetration testing!

DNS TXT Record Format

The verification TXT record follows this format:

Host: _pensar.<your-domain> (or subdomain)
Value: pensar=<unique-verification-token>
TTL: 3600 (or your DNS provider's default)

Note: The actual format is pensar=<token>, not pensar-verification=<token>. The exact host name pattern may vary slightly based on your DNS provider.

Examples

For different domain configurations:

Domain: app.example.com

Host: _pensar.app.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600

Or for some DNS providers:

Host: _pensar.app
Value: pensar=a1b2c3d4e5f6...
TTL: 3600

DNS Provider Guides

Instructions for common DNS providers:

  1. Log in to your Cloudflare dashboard
  2. Select your domain
  3. Navigate to DNS > Records
  4. Click Add record
  5. Configure the record:
    • Type: TXT
    • Name: _pensar-verify.app (or full: _pensar-verify.app.example.com)
    • Content: pensar-verification=<your-token>
    • TTL: Auto (or 3600)
  6. Click Save
  7. Wait 1-5 minutes for propagation
  8. Verify in Pensar Console

Cloudflare DNS typically propagates within 1-2 minutes.

  1. Open the Route 53 console
  2. Select Hosted zones
  3. Choose your domain’s hosted zone
  4. Click Create record
  5. Configure the record:
    • Record name: _pensar-verify.app.example.com
    • Record type: TXT
    • Value: "pensar-verification=<your-token>"
    • TTL: 300
  6. Click Create records
  7. Wait 5-10 minutes for propagation
  8. Verify in Pensar Console

Note: TXT values in Route 53 should be enclosed in quotes.

  1. Open the Cloud DNS console
  2. Select your DNS zone
  3. Click Add record set
  4. Configure the record:
    • DNS name: _pensar-verify.app.example.com. (trailing dot)
    • Resource record type: TXT
    • TXT data: pensar-verification=<your-token>
    • TTL: 3600
  5. Click Create
  6. Wait 5-10 minutes for propagation
  7. Verify in Pensar Console

Include the trailing dot in the DNS name for Google Cloud DNS.

  1. Log in to your GoDaddy account
  2. Navigate to My Products > DNS
  3. Find your domain and click DNS
  4. Scroll to Records section
  5. Click Add > TXT
  6. Configure the record:
    • Host: _pensar-verify.app (subdomain only, without main domain)
    • TXT Value: pensar-verification=<your-token>
    • TTL: 3600 seconds
  7. Click Save
  8. Wait 10-30 minutes for propagation
  9. Verify in Pensar Console

Note: GoDaddy can take longer to propagate DNS changes.

  1. Log in to Namecheap
  2. Navigate to Domain List
  3. Click Manage next to your domain
  4. Go to Advanced DNS tab
  5. Click Add New Record
  6. Configure the record:
    • Type: TXT Record
    • Host: _pensar-verify.app (subdomain part only)
    • Value: pensar-verification=<your-token>
    • TTL: Automatic (or 3600)
  7. Click the checkmark to save
  8. Wait 10-30 minutes for propagation
  9. Verify in Pensar Console
  1. Log in to DigitalOcean
  2. Navigate to Networking > Domains
  3. Select your domain
  4. Scroll to Add a record
  5. Configure the record:
    • Type: TXT
    • Hostname: _pensar-verify.app (or full subdomain)
    • Value: pensar-verification=<your-token>
    • TTL: 3600
  6. Click Create Record
  7. Wait 5-10 minutes for propagation
  8. Verify in Pensar Console

For other DNS providers, follow this general process:

  1. Log in to your DNS provider’s control panel
  2. Find the DNS management or DNS records section
  3. Add a new TXT record with:
    • Host/Name: _pensar-verify.<your-subdomain>.<your-domain>
    • Type: TXT
    • Value: pensar-verification=<your-token>
    • TTL: 3600 (or default)
  4. Save the record
  5. Wait for DNS propagation (typically 5-30 minutes)
  6. Verify in Pensar Console

If you’re unsure about your DNS provider’s process, contact their support with the record details you need to add.

Verification Troubleshooting

If domain verification fails, try these steps:

DNS changes can take time to propagate globally:

  • Local propagation: 1-5 minutes
  • Global propagation: Up to 48 hours (typically 10-30 minutes)

Use these tools to check if your TXT record is visible:

  • DNS Checker
  • What’s My DNS
  • Command line: dig _pensar-verify.app.example.com TXT
  • Command line: nslookup -type=TXT _pensar-verify.app.example.com

Wait at least 10 minutes after adding the DNS record before attempting verification.

Ensure your TXT record is formatted correctly:

✅ Correct:

Host: _pensar-verify.app.example.com
Value: pensar-verification=abc123xyz789...

❌ Incorrect:

Host: _pensar-verify  (missing subdomain)
Value: abc123xyz789  (missing prefix)

Common mistakes:

  • Missing _pensar-verify prefix in host
  • Missing pensar-verification= prefix in value
  • Extra quotes around the value (some providers add automatically)
  • Incorrect subdomain in host

Some DNS providers have specific requirements:

  • Trailing dots: Some providers require a trailing dot, others don’t
  • @ symbol: Some use @ to represent the root domain
  • Quotes: Some providers automatically add quotes to TXT values
  • Multiple TXT records: Ensure your TXT record isn’t conflicting with others

Consult your DNS provider’s documentation for TXT record requirements.

The verification token must match exactly:

  • Copy the full token from Pensar Console
  • Don’t add extra spaces or line breaks
  • Include the pensar-verification= prefix
  • Don’t modify the token value

If verification still fails, try regenerating the verification token in Pensar Console.

If you’ve tried everything and verification still fails:

  1. Double-check all settings
  2. Confirm the DNS record is visible using DNS lookup tools
  3. Contact Pensar support with:
    • Your domain name
    • Screenshot of your DNS record configuration
    • Results from DNS lookup tools
    • Your DNS provider name

Managing Domains

Once domains are added, you can manage them in the Pensar Console:

See all domains associated with your project:

  • Verification status (verified, pending, failed)
  • Last tested date
  • Number of findings per domain
  • Environment type (staging, production)
  • Authentication configuration status

Multiple Domains

Projects can have multiple domains for different purposes:

Staging & Production

Test both environments separately:

  • https://staging.example.com
  • https://production.example.com

Verify findings in staging before production testing.

Subdomains

Test different application areas:

  • https://app.example.com - Main application
  • https://api.example.com - API server
  • https://admin.example.com - Admin panel

Each requires separate verification.

Multiple Environments

Test across deployment targets:

  • Development environment
  • QA/Testing environment
  • Staging environment
  • Production environment

Track findings per environment.

Regional Deployments

Test geographic deployments:

  • https://us.example.com
  • https://eu.example.com
  • https://asia.example.com

Ensure security across all regions.

Security Considerations

Production Testing: Be cautious when testing production domains. Consider:

  • Testing during low-traffic periods
  • Using staging environments when possible
  • Configuring rate limits to prevent service disruption
  • Notifying your team before production testing

DNS TXT records are publicly visible:

  • Anyone can query your DNS TXT records
  • The verification token doesn’t grant access to systems
  • Records only prove domain ownership
  • Safe to leave in place after verification

The token is safe to be public - it only verifies domain ownership, not system access.

After verification, you can optionally remove the TXT record:

  • Not required, record can stay indefinitely
  • Needed if you want to re-verify in the future
  • Removing it doesn’t affect existing tests

We recommend leaving it in place for continuous verification.

Next Steps

Authentication

Configure authentication credentials for testing protected endpoints on your domains.

Blackbox Testing

Start blackbox penetration testing on your verified domains.

Whitebox Testing

Run whitebox tests against your live domains with source code analysis.

Getting Started

Return to the getting started guide to continue setup.