Skip to content

🆕 InfoStealer Service

Our infostealer service provides our customers with access to infostealer data relating to domains to which they have administrative control.

Why do we verify domain ownership?

The Infostealer Checking Service allows you to query compromised credential data for your organisation's domains. To prevent unauthorised access to another organisation's data, we require you to prove ownership of each domain you query by placing a DNS TXT record that contains a verification key issued to your account.

This is the same approach used by services like Google Workspace, Microsoft 365 and certificate authorities - it is a well-established method of proving domain control.

How it works

  1. You create a DNS TXT record at _lab539-verify.<yourdomain.com>
  2. The record value contains one of your verification keys
  3. When you query the API, we check the authoritative nameservers for your domain to confirm the record exists
  4. If a valid key is found, the query proceeds

Authoritative nameserver queries

We query your domain's authoritative nameservers directly rather than relying on public recursive resolvers. This means your verification will work as soon as the record is live on your nameservers - you don't need to wait for DNS propagation.

Setup

1. Find your verification keys

Log in to the Lab539 Portal and navigate to your account profile. You will find five verification keys, each a unique identifier in UUID format, for example:

539e8400-e29b-41d4-a716-446655440000

You can use any of your five keys. Each key can be used for a different domain, allowing you to verify multiple domains without reusing the same key across them. If you need to verify more than five domains, get in touch with us or raise a support ticket and we can add additional keys to your account.

One key per domain

Using a different key for each domain avoids publicly linking your domains together via a shared DNS record. If you control example.com and example.org, use a different key for each.

2. Create the DNS TXT record

Add a TXT record to your domain's DNS with the following details:

Field Value
Host / Name _lab539-verify
Type TXT
Value lab539-verify=<your-key>
TTL Any (3600 is fine)

For example, if your domain is example539.com and your key is 550e8400-e29b-41d4-a716-446655440000, the full record would be:

_lab539-verify.example539.com.  IN  TXT  "lab539-verify=550e8400-e29b-41d4-a716-446655440000"

Common mistakes

  • The host/name field should be _lab539-verify, not _lab539-verify.example.com - most DNS providers append your domain automatically.
  • The value must include the lab539-verify= prefix. Don't paste the UUID on its own.
  • Make sure there are no extra spaces or quotes around the value (some DNS control panels add quotes for you, others don't).

3. Setting the record with common providers

  1. Go to your domain's DNS settings
  2. Click Add Record
  3. Set type to TXT
  4. Set name to _lab539-verify
  5. Set content to lab539-verify=<your-key>
  6. Click Save
  1. Go to My Products > your domain > DNS
  2. Click Add New Record
  3. Set type to TXT
  4. Set name to _lab539-verify
  5. Set value to lab539-verify=<your-key>
  6. Click Save
  1. Open your hosted zone
  2. Click Create Record
  3. Set record name to _lab539-verify
  4. Set record type to TXT
  5. Set value to "lab539-verify=<your-key>" (include the quotes)
  6. Click Create records
  1. Open your DNS zone
  2. Click + Record set
  3. Set name to _lab539-verify
  4. Set type to TXT
  5. Set value to lab539-verify=<your-key>
  6. Click OK
  1. Go to the Microsoft 365 admin center
  2. Navigate to Settings > Domains > your domain > DNS records
  3. Click Add record
  4. Set type to TXT
  5. Set TXT name to _lab539-verify
  6. Set TXT value to lab539-verify=<your-key>
  7. Click Save

Verifying your setup

Once you have created the record, you can confirm it is visible on your authoritative nameservers using dig or nslookup.

Using dig, nslookup or online tools

First, find your authoritative nameservers, then query one of them directly for the TXT record.

Find your nameservers:

dig NS yourdomain.com +short

This will return something like:

ns1.example-hosting.com.
ns2.example-hosting.com.

Then query one of them directly:

dig @ns1.example-hosting.com _lab539-verify.yourdomain.com TXT +short

You should see:

"lab539-verify=550e8400-e29b-41d4-a716-446655440000"

Find your nameservers:

nslookup -type=NS yourdomain.com

Then query one of them directly:

nslookup -type=TXT _lab539-verify.yourdomain.com ns1.example-hosting.com

You should see your lab539-verify= value in the response.

If you don't have access to command-line tools, you can use Google's DNS lookup tool. Search for _lab539-verify.yourdomain.com and select TXT as the record type.

Note that Google's tool uses its own recursive resolvers, so if you have only just created the record it may not appear immediately. Querying with dig or nslookup against your authoritative nameservers is more reliable for confirming a new record.

Troubleshooting

API returns 'unable to resolve nameservers for this domain'

We were unable to find the authoritative nameservers for the domain you queried. Check that you are querying a valid, registered domain and that it has NS records configured.

API returns 'unable to query authoritative nameservers'

We found your nameservers but couldn't reach them to check the TXT record. This is usually a temporary network issue. Retry after a few moments. If the problem persists, check that your nameservers are responding correctly by running dig @<your-ns> _lab539-verify.<yourdomain> TXT.

API returns 'domain ownership not verified' but I've set the record

Check the following:

  • The record is at _lab539-verify.<yourdomain>, not the bare domain
  • The value starts with lab539-verify= followed by your key with no spaces
  • The key matches one of the five keys shown in your portal profile
  • The record is live on your authoritative nameservers (verify with dig as described above)
Do I need to set a record for every subdomain?

No. The verification is performed at the domain level. A record at _lab539-verify.example.com covers queries for example.com and all its subdomains.

Can I use the same key for multiple domains?

You can, but we recommend using a different key per domain. TXT records are public - anyone can look them up. Using the same key across domains creates a public link between them. Your account has five keys by default so you can verify up to five domains independently. If you need more, get in touch or raise a support ticket.

I've changed my DNS provider and the record is gone

Recreate the _lab539-verify TXT record with your DNS provider. You can reuse the same key you had before. We query your authoritative nameservers directly, so the record will be picked up as soon as it is live on the new provider.