What it looks for
A record of this form, which Daawid gives the entry's owner in its console. It names the entry (e=) and carries a token that Daawid issued for that entry and website (t=):
t=…; e=ent_…; v=1
The owner adds it in one of three places, which the verifier checks in this order:
- a DNS TXT record at
_daawid.{host}, which Daawid recommends, because it works without a website; - the file
https://{host}/.well-known/daawid, which holds the record on one line; - a meta tag in the head of
https://{host}/:<meta name="daawid" content="…">.
The first place where the record is found counts. A record for another entry, or with another token, proves nothing.
How it reads DNS
Through DNS over HTTPS at Cloudflare, Google and Quad9, which check DNSSEC. An answer counts when DNSSEC confirms it, or when two of them give the same one. A domain whose DNSSEC is broken can't be verified until it is fixed. Your name servers see the lookups of these resolvers, not Daawid's.
How it reads a website
Only when DNS has no record. It uses HTTPS on port 443 with a valid certificate, and sends this user agent:
DaawidVerifier/1.0 (+https://daawid.com/docs/verifier)
It waits at most 10 seconds, follows at most 5 redirects (for the page, within the same domain; for the file, on the same host, or from the domain to its www), and reads at most 1 MB of the page and 1 KB of the file. It reads only the head of the page as the server sends it: it runs no scripts, sends no cookies and submits nothing. A page or file on one of Daawid's own addresses never counts.
Where it comes from
Daawid runs on Cloudflare's network, so the verifier has no IP addresses of its own. To let it through bot protection, allow its user agent, or use the DNS record, which needs nothing on the website at all.
How often it checks
- After a website is added, and whenever its owner presses Check now: 1, 5, 15 and 60 minutes later, then every hour for 72 hours.
- Once the website is verified: every day for a week, then every week.
- When three checks in a row, over at least 24 hours, find no record, the owners get 14 days to put it back, with an email on days 0, 3 and 10. The entry stays verified meanwhile. After that, it no longer names the website.
Stopping it
The record stays in place for as long as the website is verified: it is the proof, and Daawid checks it again. To stop, remove the website from the entry in Daawid's console, or delete the entry: the checks stop with it. Removing only the record leads to the 14 days above.