> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/_mcp/server.

# Adding Domains

> Add and verify domains for penetration testing

## Overview

Domains represent the live environments where your application is deployed and accessible. Before Pensar can test your domains, they must be added to your workspace and verified using DNS TXT records. This verification process ensures you own or control the domains being tested.

> **Info**
>
> Domain verification is required for Pensar's [hybrid testing methodology](/console/features/hybrid-testing) against live environments.

## Why Domain Verification?

Domain verification protects both you and other domain owners:

#### Prove Ownership

Verification ensures you control the domain before testing begins,
preventing unauthorized security testing.

#### Prevent Abuse

Protects other organizations from having their domains tested without
permission.

#### Compliance

Demonstrates due diligence and authorization for security testing
activities.

#### Legal Protection

Verification provides evidence of authorization, protecting against legal
concerns about penetration testing.

## Adding a Domain

Follow this step-by-step process to add and verify a domain in the Pensar Console:

#### Navigate to Domains

In your workspace, navigate to **Attack Surface** > **Domains** and click the "Add Domain" button.

#### Enter Domain URL

Enter the domain or IP address you want to pentest:

* **Valid**: `app.example.com`, `example.com`, `api.example.com`
* **No scheme**: a bare domain is treated as `https://`
* **IP addresses**: include the scheme explicitly (e.g. `http://10.0.0.5:8080`)

You can queue several targets at once before continuing.

#### Upload API Schema (Optional)

Enhance endpoint discovery by uploading an OpenAPI or Swagger schema:

* **Supported formats**: JSON (`.json`) or YAML (`.yml`, `.yaml`)
* **What it does**: Helps Pensar discover documented API endpoints
* **Validation**: The schema is validated before upload

Click "Select File" to choose your schema file.

#### Upload Sitemap (Optional)

Help Pensar discover pages and routes by uploading a sitemap:

* **Supported formats**: XML (`.xml`) or TXT (`.txt`)
* **What it does**: Provides a map of accessible pages
* **Standard format**: Supports the standard sitemap.xml format

Click "Select File" to choose your sitemap file.

#### Add Domain

Click "Add Domain" to save your domain configuration.

#### Verify Domain Ownership

If DNS verification is required and the domain is not already verified, a
verification step appears with your unique DNS TXT record. Add the record to
your DNS provider, then click "Verify". See [DNS provider instructions](#dns-provider-guides) below.

#### Add Authentication (Optional)

After a domain is created and verified, you can add authentication
credentials so Pensar can test protected endpoints. This is a **separate
step** from adding the domain — see the
[Authentication](/console/features/authentication) guide for details.

#### Start Testing

Once verification succeeds, Pensar automatically queues reconnaissance to
discover your attack surface, and the domain is ready for penetration
testing.

> **Info**
>
> Authentication credentials are configured in a dedicated step after the domain
> is created — they are not part of the Add Domain form. The Add Domain form
> collects the domain URL plus an optional OpenAPI/Swagger schema and sitemap.

## DNS TXT Record Format

The verification TXT record follows this format:

```text
Record Type: TXT
Host: _pensar.<your-domain> (or just _pensar)
Value: pensar=<unique-verification-token>
TTL: 3600 (or your DNS provider's default)
```

> **Success**
>
> Use the **Copy** button next to the verification record to copy the exact
> value. This ensures you don't introduce any typos.

### Examples

For different domain configurations:

#### Subdomain

**Domain**: `app.example.com`

```text
Host: _pensar.app.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

Or for some DNS providers:

```text
Host: _pensar.app
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

#### Root Domain

**Domain**: `example.com`

```text
Host: _pensar.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

Or, with providers that append the domain automatically:

```text
Host: _pensar
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

#### With Port

**Domain**: `https://api.example.com:8443`

```text
Host: _pensar.api.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

Note: The port is ignored for verification. Add the TXT record for the domain name only.

#### Path

**Domain**: `https://example.com/api/v2`

```text
Host: _pensar.example.com
Value: pensar=a1b2c3d4e5f6...
TTL: 3600
```

Note: Paths are ignored for verification. Add the TXT record for the domain name only.

## DNS Provider Guides

Instructions for common DNS providers:

#### Cloudflare

1. Log in to your Cloudflare dashboard
2. Select your domain
3. Navigate to **DNS** > **Records**
4. Click **Add record**
5. Configure the record:
   * **Type**: TXT
   * **Name**: `_pensar.app` (or full: `_pensar.app.example.com`)
   * **Content**: `pensar=<your-token>`
   * **TTL**: Auto (or 3600)
6. Click **Save**
7. Wait 1-5 minutes for propagation
8. Verify in Pensar Console

> **Info**
>
> Cloudflare DNS typically propagates within 1-2 minutes.

#### AWS Route 53

1. Open the Route 53 console
2. Select **Hosted zones**
3. Choose your domain's hosted zone
4. Click **Create record**
5. Configure the record:
   * **Record name**: `_pensar.app.example.com`
   * **Record type**: TXT
   * **Value**: `"pensar=<your-token>"`
   * **TTL**: 300
6. Click **Create records**
7. Wait 5-10 minutes for propagation
8. Verify in Pensar Console

Note: TXT values in Route 53 should be enclosed in quotes.

#### Google Cloud DNS

1. Open the Cloud DNS console
2. Select your DNS zone
3. Click **Add record set**
4. Configure the record:
   * **DNS name**: `_pensar.app.example.com.` (trailing dot)
   * **Resource record type**: TXT
   * **TXT data**: `pensar=<your-token>`
   * **TTL**: 3600
5. Click **Create**
6. Wait 5-10 minutes for propagation
7. Verify in Pensar Console

> **Info**
>
> Include the trailing dot in the DNS name for Google Cloud DNS.

#### GoDaddy

1. Log in to your GoDaddy account
2. Navigate to **My Products** > **DNS**
3. Find your domain and click **DNS**
4. Scroll to **Records** section
5. Click **Add** > **TXT**
6. Configure the record:
   * **Host**: `_pensar.app` (subdomain only, without main domain)
   * **TXT Value**: `pensar=<your-token>`
   * **TTL**: 3600 seconds
7. Click **Save**
8. Wait 10-30 minutes for propagation
9. Verify in Pensar Console

Note: GoDaddy can take longer to propagate DNS changes.

#### Namecheap

1. Log in to Namecheap
2. Navigate to **Domain List**
3. Click **Manage** next to your domain
4. Go to **Advanced DNS** tab
5. Click **Add New Record**
6. Configure the record:
   * **Type**: TXT Record
   * **Host**: `_pensar.app` (subdomain part only)
   * **Value**: `pensar=<your-token>`
   * **TTL**: Automatic (or 3600)
7. Click the checkmark to save
8. Wait 10-30 minutes for propagation
9. Verify in Pensar Console

#### DigitalOcean

1. Log in to DigitalOcean
2. Navigate to **Networking** > **Domains**
3. Select your domain
4. Scroll to **Add a record**
5. Configure the record:
   * **Type**: TXT
   * **Hostname**: `_pensar.app` (or full subdomain)
   * **Value**: `pensar=<your-token>`
   * **TTL**: 3600
6. Click **Create Record**
7. Wait 5-10 minutes for propagation
8. Verify in Pensar Console

#### Other DNS Providers

For other DNS providers, follow this general process:

1. Log in to your DNS provider's control panel
2. Find the DNS management or DNS records section
3. Add a new TXT record with:
   * **Host/Name**: `_pensar.<your-subdomain>.<your-domain>`
   * **Type**: TXT
   * **Value**: `pensar=<your-token>`
   * **TTL**: 3600 (or default)
4. Save the record
5. Wait for DNS propagation (typically 5-30 minutes)
6. Verify in Pensar Console

> **Info**
>
> If you're unsure about your DNS provider's process, contact their support with the record details you need to add.

## Verification Troubleshooting

If domain verification fails, try these steps:

#### Check DNS Propagation

DNS changes can take time to propagate globally:

* **Local propagation**: 1-5 minutes
* **Global propagation**: Up to 48 hours (typically 10-30 minutes)

Use these tools to check if your TXT record is visible:

* [DNS Checker](https://dnschecker.org/)
* [What's My DNS](https://www.whatsmydns.net/)
* Command line: `dig _pensar.app.example.com TXT`
* Command line: `nslookup -type=TXT _pensar.app.example.com`

> **Info**
>
> Wait at least 10 minutes after adding the DNS record before attempting verification.

#### Verify Record Format

Ensure your TXT record is formatted correctly:

✅ **Correct:**

```text
Host: _pensar.app.example.com
Value: pensar=abc123xyz789...
```

❌ **Incorrect:**

```text
Host: app.example.com  (missing _pensar prefix)
Value: abc123xyz789  (missing pensar= prefix)
```

Common mistakes:

* Missing `_pensar` prefix in host
* Missing `pensar=` prefix in value
* Extra quotes around the value (some providers add automatically)
* Incorrect subdomain in host

#### Check DNS Provider Settings

Some DNS providers have specific requirements:

* **Trailing dots**: Some providers require a trailing dot, others don't
* **@ symbol**: Some use @ to represent the root domain
* **Quotes**: Some providers automatically add quotes to TXT values
* **Multiple TXT records**: Ensure your TXT record isn't conflicting with others

Consult your DNS provider's documentation for TXT record requirements.

#### Copy Token Carefully

The verification record must match exactly:

* Copy the full value from Pensar Console
* Don't add extra spaces or line breaks
* Include the `pensar=` prefix
* Don't modify the token value

If verification still fails, try regenerating the verification token in Pensar Console.

#### Contact Support

If you've tried everything and verification still fails:

1. Double-check all settings
2. Confirm the DNS record is visible using DNS lookup tools
3. [Contact Pensar support](mailto:team@pensar.dev) with:
   * Your domain name
   * Screenshot of your DNS record configuration
   * Results from DNS lookup tools
   * Your DNS provider name

## Managing Domains

After adding domains, you can manage them under **Attack Surface** > **Domains**:

### Domain List View

The domains table shows:

* **Domain**: The domain URL
* **Verified**: ✓ if verified, ✗ if not verified
* **Pentesting Enabled**: Whether testing is currently enabled
* **Last Analyzed**: When attack surface reconnaissance last ran
* **Recon indicator**: An animated radar icon appears while reconnaissance is running

### Domain Actions

Click the menu (⋮) next to any domain to:

#### Edit

Update the domain configuration:

* Change the domain URL
* Add or remove the API schema
* Add or remove the sitemap

#### Enable/Disable

Control whether pentesting is active for this domain:

* **Disable**: Stops new tests but preserves existing results
* **Enable**: Resumes testing capabilities

#### Verify

Re-verify domain ownership (appears only for unverified domains):

* Opens the verification dialog again
* Shows the same TXT record
* Allows you to retry verification

#### Run Recon

Manually trigger attack surface reconnaissance:

* Discovers or updates endpoints
* Generates new pentest objectives
* Useful after deploying changes

#### Delete

Remove the domain from your workspace:

* Historical test data is preserved
* The DNS TXT record can be removed
* The domain can be re-added later with new verification

## Multiple Domains

A workspace can have multiple domains for different purposes:

#### Staging & Production

Test both environments separately:

* `https://staging.example.com`
* `https://production.example.com`

Verify findings in staging before production testing.

#### Subdomains

Test different application areas:

* `https://app.example.com` - Main application
* `https://api.example.com` - API server
* `https://admin.example.com` - Admin panel

Each requires separate verification.

#### Multiple Environments

Test across deployment targets:

* Development environment
* QA/Testing environment
* Staging environment
* Production environment

#### Regional Deployments

Test geographic deployments:

* `https://us.example.com`
* `https://eu.example.com`
* `https://asia.example.com`

Ensure security across all regions.

## Security Considerations

> **Warning**
>
> **Production Testing**: Be cautious when testing production domains. Consider:
>
> * Testing during low-traffic periods
> * Using staging environments when possible
> * Configuring rate limits to prevent service disruption
> * Notifying your team before production testing

#### TXT Record Visibility

DNS TXT records are publicly visible:

* Anyone can query your DNS TXT records
* The verification token doesn't grant access to systems
* Records only prove domain ownership
* Safe to leave in place after verification

The token is safe to be public - it only verifies domain ownership, not system access.

#### Removing Verification Records

After verification, you can optionally remove the TXT record:

* Not required, the record can stay indefinitely
* Needed if you want to re-verify in the future
* Removing it doesn't affect existing tests

We recommend leaving it in place for continuous verification.

## Next Steps

#### [Authentication](/console/features/authentication)

Configure authentication credentials for testing protected endpoints on your
domains.

#### [Hybrid Testing](/console/features/hybrid-testing)

Learn how Pensar combines source analysis with live domain exploitation for
maximum coverage.

#### [Getting Started](/console/getting-started)

Return to the getting started guide to continue setup.