Domains

Adding Domains

Overview

Domains represent the live environments where your application is deployed and accessible. Before Pensar can test your domains, they must be added to your workspace and verified using DNS TXT records. This verification process ensures you own or control the domains being tested.

Domain verification is required for Pensar’s hybrid testing methodology against live environments.

Why Domain Verification?

Domain verification protects both you and other domain owners:

Prove Ownership

Verification ensures you control the domain before testing begins, preventing unauthorized security testing.

Prevent Abuse

Protects other organizations from having their domains tested without permission.

Compliance

Demonstrates due diligence and authorization for security testing activities.

Legal Protection

Verification provides evidence of authorization, protecting against legal concerns about penetration testing.

Adding a Domain

Follow this step-by-step process to add and verify a domain in the Pensar Console:

2

Enter Domain URL

Enter the domain or IP address you want to pentest:

  • Valid: app.example.com, example.com, api.example.com
  • No scheme: a bare domain is treated as https://
  • IP addresses: include the scheme explicitly (e.g. http://10.0.0.5:8080)

You can queue several targets at once before continuing.

3

Upload API Schema (Optional)

Enhance endpoint discovery by uploading an OpenAPI or Swagger schema:

  • Supported formats: JSON (.json) or YAML (.yml, .yaml)
  • What it does: Helps Pensar discover documented API endpoints
  • Validation: The schema is validated before upload

Click “Select File” to choose your schema file.

4

Upload Sitemap (Optional)

Help Pensar discover pages and routes by uploading a sitemap:

  • Supported formats: XML (.xml) or TXT (.txt)
  • What it does: Provides a map of accessible pages
  • Standard format: Supports the standard sitemap.xml format

Click “Select File” to choose your sitemap file.

5

Add Domain

Click “Add Domain” to save your domain configuration.

6

Verify Domain Ownership

If DNS verification is required and the domain is not already verified, a verification step appears with your unique DNS TXT record. Add the record to your DNS provider, then click “Verify”. See DNS provider instructions below.

7

Add Authentication (Optional)

After a domain is created and verified, you can add authentication credentials so Pensar can test protected endpoints. This is a separate step from adding the domain — see the Authentication guide for details.

8

Start Testing

Once verification succeeds, Pensar automatically queues reconnaissance to discover your attack surface, and the domain is ready for penetration testing.

Authentication credentials are configured in a dedicated step after the domain is created — they are not part of the Add Domain form. The Add Domain form collects the domain URL plus an optional OpenAPI/Swagger schema and sitemap.

DNS TXT Record Format

The verification TXT record follows this format:

Record Type: TXT
Host: _pensar.<your-domain> (or just _pensar)
Value: pensar=<unique-verification-token>
TTL: 3600 (or your DNS provider's default)

Use the Copy button next to the verification record to copy the exact value. This ensures you don’t introduce any typos.

Examples

For different domain configurations:

Domain: app.example.com

Host: _pensar.app.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600

Or for some DNS providers:

Host: _pensar.app
Value: pensar=a1b2c3d4e5f6...
TTL: 3600

DNS Provider Guides

Instructions for common DNS providers:

  1. Log in to your Cloudflare dashboard
  2. Select your domain
  3. Navigate to DNS > Records
  4. Click Add record
  5. Configure the record:
    • Type: TXT
    • Name: _pensar.app (or full: _pensar.app.example.com)
    • Content: pensar=<your-token>
    • TTL: Auto (or 3600)
  6. Click Save
  7. Wait 1-5 minutes for propagation
  8. Verify in Pensar Console

Cloudflare DNS typically propagates within 1-2 minutes.

  1. Open the Route 53 console
  2. Select Hosted zones
  3. Choose your domain’s hosted zone
  4. Click Create record
  5. Configure the record:
    • Record name: _pensar.app.example.com
    • Record type: TXT
    • Value: "pensar=<your-token>"
    • TTL: 300
  6. Click Create records
  7. Wait 5-10 minutes for propagation
  8. Verify in Pensar Console

Note: TXT values in Route 53 should be enclosed in quotes.

  1. Open the Cloud DNS console
  2. Select your DNS zone
  3. Click Add record set
  4. Configure the record:
    • DNS name: _pensar.app.example.com. (trailing dot)
    • Resource record type: TXT
    • TXT data: pensar=<your-token>
    • TTL: 3600
  5. Click Create
  6. Wait 5-10 minutes for propagation
  7. Verify in Pensar Console

Include the trailing dot in the DNS name for Google Cloud DNS.

  1. Log in to your GoDaddy account
  2. Navigate to My Products > DNS
  3. Find your domain and click DNS
  4. Scroll to Records section
  5. Click Add > TXT
  6. Configure the record:
    • Host: _pensar.app (subdomain only, without main domain)
    • TXT Value: pensar=<your-token>
    • TTL: 3600 seconds
  7. Click Save
  8. Wait 10-30 minutes for propagation
  9. Verify in Pensar Console

Note: GoDaddy can take longer to propagate DNS changes.

  1. Log in to Namecheap
  2. Navigate to Domain List
  3. Click Manage next to your domain
  4. Go to Advanced DNS tab
  5. Click Add New Record
  6. Configure the record:
    • Type: TXT Record
    • Host: _pensar.app (subdomain part only)
    • Value: pensar=<your-token>
    • TTL: Automatic (or 3600)
  7. Click the checkmark to save
  8. Wait 10-30 minutes for propagation
  9. Verify in Pensar Console
  1. Log in to DigitalOcean
  2. Navigate to Networking > Domains
  3. Select your domain
  4. Scroll to Add a record
  5. Configure the record:
    • Type: TXT
    • Hostname: _pensar.app (or full subdomain)
    • Value: pensar=<your-token>
    • TTL: 3600
  6. Click Create Record
  7. Wait 5-10 minutes for propagation
  8. Verify in Pensar Console

For other DNS providers, follow this general process:

  1. Log in to your DNS provider’s control panel
  2. Find the DNS management or DNS records section
  3. Add a new TXT record with:
    • Host/Name: _pensar.<your-subdomain>.<your-domain>
    • Type: TXT
    • Value: pensar=<your-token>
    • TTL: 3600 (or default)
  4. Save the record
  5. Wait for DNS propagation (typically 5-30 minutes)
  6. Verify in Pensar Console

If you’re unsure about your DNS provider’s process, contact their support with the record details you need to add.

Verification Troubleshooting

If domain verification fails, try these steps:

DNS changes can take time to propagate globally:

  • Local propagation: 1-5 minutes
  • Global propagation: Up to 48 hours (typically 10-30 minutes)

Use these tools to check if your TXT record is visible:

  • DNS Checker
  • What’s My DNS
  • Command line: dig _pensar.app.example.com TXT
  • Command line: nslookup -type=TXT _pensar.app.example.com

Wait at least 10 minutes after adding the DNS record before attempting verification.

Ensure your TXT record is formatted correctly:

✅ Correct:

Host: _pensar.app.example.com
Value: pensar=abc123xyz789...

❌ Incorrect:

Host: app.example.com  (missing _pensar prefix)
Value: abc123xyz789  (missing pensar= prefix)

Common mistakes:

  • Missing _pensar prefix in host
  • Missing pensar= prefix in value
  • Extra quotes around the value (some providers add automatically)
  • Incorrect subdomain in host

Some DNS providers have specific requirements:

  • Trailing dots: Some providers require a trailing dot, others don’t
  • @ symbol: Some use @ to represent the root domain
  • Quotes: Some providers automatically add quotes to TXT values
  • Multiple TXT records: Ensure your TXT record isn’t conflicting with others

Consult your DNS provider’s documentation for TXT record requirements.

The verification record must match exactly:

  • Copy the full value from Pensar Console
  • Don’t add extra spaces or line breaks
  • Include the pensar= prefix
  • Don’t modify the token value

If verification still fails, try regenerating the verification token in Pensar Console.

If you’ve tried everything and verification still fails:

  1. Double-check all settings
  2. Confirm the DNS record is visible using DNS lookup tools
  3. Contact Pensar support with:
    • Your domain name
    • Screenshot of your DNS record configuration
    • Results from DNS lookup tools
    • Your DNS provider name

Managing Domains

After adding domains, you can manage them under Attack Surface > Domains:

Domain List View

The domains table shows:

  • Domain: The domain URL
  • Verified: ✓ if verified, ✗ if not verified
  • Pentesting Enabled: Whether testing is currently enabled
  • Last Analyzed: When attack surface reconnaissance last ran
  • Recon indicator: An animated radar icon appears while reconnaissance is running

Domain Actions

Click the menu (⋮) next to any domain to:

Update the domain configuration:

  • Change the domain URL
  • Add or remove the API schema
  • Add or remove the sitemap

Multiple Domains

A workspace can have multiple domains for different purposes:

Staging & Production

Test both environments separately:

  • https://staging.example.com
  • https://production.example.com

Verify findings in staging before production testing.

Subdomains

Test different application areas:

  • https://app.example.com - Main application
  • https://api.example.com - API server
  • https://admin.example.com - Admin panel

Each requires separate verification.

Multiple Environments

Test across deployment targets:

  • Development environment
  • QA/Testing environment
  • Staging environment
  • Production environment
Regional Deployments

Test geographic deployments:

  • https://us.example.com
  • https://eu.example.com
  • https://asia.example.com

Ensure security across all regions.

Security Considerations

Production Testing: Be cautious when testing production domains. Consider:

  • Testing during low-traffic periods
  • Using staging environments when possible
  • Configuring rate limits to prevent service disruption
  • Notifying your team before production testing

DNS TXT records are publicly visible:

  • Anyone can query your DNS TXT records
  • The verification token doesn’t grant access to systems
  • Records only prove domain ownership
  • Safe to leave in place after verification

The token is safe to be public - it only verifies domain ownership, not system access.

After verification, you can optionally remove the TXT record:

  • Not required, the record can stay indefinitely
  • Needed if you want to re-verify in the future
  • Removing it doesn’t affect existing tests

We recommend leaving it in place for continuous verification.

Next Steps

Authentication

Configure authentication credentials for testing protected endpoints on your domains.

Hybrid Testing

Learn how Pensar combines source analysis with live domain exploitation for maximum coverage.

Getting Started

Return to the getting started guide to continue setup.