Are "site verification tokens" secret?

Question

A lot of search engines (Google, Bing, etc.) allow you to add your domain to their monitoring panel. You can associate your domain to your account as long as you can prove that you manage that domain or the underlying website.

The verification process changes from service to service, but the most basic and widely-adopted automated strategy is the generation of a "site verification token" that must match the one you need to expose in a DNS TXT record (where the exact record name usually contains the token or part of it); or, the creation of a file containing a token that must be served by your web server (where the exact filename contains the token or part of it).

Often, this token can be seen published. Usually, by mistake. You may be able to find thousands of them on public repositories like GitHub etc.

Example of a Google site verification token, in a DNS zone:

300  IN TXT  "google-site-verification=JZcDdsNvovvz6R65KGfHgEAN4M3qaurfd-Hxudthoui"

The question is:

Are there risks about the disclosure of a site verification token?

As far as I can imagine, no. Anyway maybe I'm ignoring some factors. Thank you for thoughts.

---

• https://www.bing.com/webmasters/help/add-and-verify-site-12184f8b
• https://support.google.com/webmasters/answer/9008080

Answer 1

You can assume everything published in DNS to be public.

But no, they are not secret. They're just a piece of random data generated by Google. But when you publish them on a domain you claim to own, Google can verify that your account with them also controls the DNS of the domain where you added the records. Thus you prove to Google that you control it.

The verification codes probably don't carry any information; they're simply a random piece of data used to verify technical control.