I'd like to validate the ability to own a DNS domain and am already considering validation that is currently in use by others such as


  1. Since control of DNS is what I'm targeting, is email validation of the SOA record in a given DNS zone sufficient validation for a domain?

  2. How much confidence should I give to someone who validated their email address from the responsible mail addr in a given DNS SOA record?

1 Answer 1


If you send an email to an address that you find in the SOA, you are not, technically, validating control of the domain; you are validating control of that specific email address. Which is not the same thing.

To really validate control of the domain, send a challenge to the purported domain owner: make him create a new entry in the DNS, e.g. a TXT field, or a custom CNAME. If the requested entry appears, then yes, your interlocutor appears to be in control of the domain. As for any challenge/response protocol, the challenge ought to be unpredictable (i.e. the custom CNAME should include a big random name element).

Email addresses in the SOA are not necessarily up-to-date. Most SOA have this address because it is part of the format, but it is rarely verified so I guess that many domain have an incorrect address there, or an address ending in a mailbox which nobody looks at. In any case, I don't think that many people consider that putting this address in the SOA constitutes a delegation of power over the domain to the individual who would happen to be able to read emails sent to that address (especially since emails are not exactly the most protected communication system ever).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .