Why proof is required
Scanning a live site for vulnerabilities is, by construction, indistinguishable from probing it for weaknesses. The only thing that separates a security scan you asked for from an attack is consent, and consent has to be checked against something more solid than a form field. Sentinelleai requires a live proof that you control the hostname before any web or DNS scan can run against it — the same discipline every "verify your domain" flow uses (Google Search Console, ACME's dns-01 and http-01 challenges), for the same reason.
Two methods, either one is enough
A hostname can be proven one of two ways. Either is sufficient on its own, because the two cover different situations: someone who controls DNS may not have shell access to the web origin, and someone who can drop a file on the origin may not control DNS for that domain.
; DNS zone file excerpt
_sentinelleai-challenge.example.com. IN TXT "sentinelleai-verify-EXAMPLE1a2b3c4d5e6f7g8h9i0j"# served at:
# https://example.com/.well-known/sentinelleai-verification.txt
sentinelleai-verify-EXAMPLE1a2b3c4d5e6f7g8h9i0jRegistering and verifying a target
- 1
Register the hostname
On the Targets page, enter a URL or a bare hostname and add it. A unique verification token is generated for it. - 2
Publish the token
Add the token as a DNS TXT record at_sentinelleai-challenge.<your-hostname>, or publish it athttps://<your-hostname>/.well-known/sentinelleai-verification.txt. You only need one of the two. - 3
Verify now
Click "Verify now". Sentinelleai performs both checks live and marks the target verified as soon as either one succeeds, or failed with the specific reason from each check if neither did. - 4
Scan it
Once verified, the hostname can be submitted to a web or DNS scan.
A target sits in one of three states: pending (registered, not yet proven), verified, or failed (the last check attempt did not find the token). Loopback and private addresses — localhost, RFC1918 ranges, and Tailscale's CGNAT range — need no proof at all, because they are nobody's asset but the operator's own; no proof of possession could ever meaningfully be offered for them.
Why proof is checked live, not once
Every ownership check runs as a real, timed network call — a live DNS lookup or a live HTTPS (with an HTTP fallback) fetch — at the moment you click "Verify now", rather than being recorded once as a permanent flag the first time it succeeds. A hostname's control can change — a domain gets sold, DNS gets repointed, a hosting account changes hands — and a verification that never re-checked would keep trusting a claim long after it stopped being true.
Deleting a verified target is treated as a meaningful, protection-reducing action: it requires a written reason before it takes effect, the same as accepting risk on a finding or suppressing one.