v1.0 · stable specification

Instant, registrar-signed proof of domain ownership.

DomainAttest is an open protocol that lets any registrar issue a signed, short-lived attestation that an account controls a domain, and lets any marketplace, or any other service, verify it in seconds. No TXT records, no propagation delays, no stale verifications.

Read the specification Read the whitepaper → PDF

 Seller                Marketplace              Registrar
   │                       │                        │
   │  list domain          │                        │
   ├──────────────────────>│                        │
   │                       │  redirect (OAuth)      │
   │<──────────────────────┤                        │
   │                                                │
   │  log in with existing account + 2FA, approve   │
   ├───────────────────────────────────────────────>│
   │                       │                        │
   │                       │   signed ownership     │
   │                       │      attestation       │
   │                       │<───────────────────────┤
   │                       │                        │
   │                  verify signature,             │
   │                  listing goes live             │

ES256-signed · expires in minutes · valid for one relying party only

How it works

DomainAttest is a profile of the OAuth 2.0 authorization code flow with PKCE. It introduces no new cryptography, no new identity system, and no bearer secrets that can be phished.

A seller chooses “Verify with your registrar” on a marketplace.
The marketplace redirects to the registrar with a request naming the domain and the marketplace.
The seller signs in to the registrar the way they always do, including any 2FA on the account.
The registrar confirms the account controls the domain and returns a signed attestation: this account controls this domain, now, for this marketplace.
The marketplace validates the signature against the registrar’s published keys and publishes the listing. Under five seconds, end to end.

Who benefits

Verification friction costs every side of the market. Removing it pays every side, too.

Registrars

The protocol repositions the registrar as the authority every marketplace depends on to answer the ownership question.

Retention: Instant verification makes the registrar the best home for a selling portfolio: sellers bring domains for the one-click listing and keep them there, along with the renewals. Future versions leave room for a sale to settle between accounts at the same registrar.
Retention beyond sellers: Marketplaces are the first relying party, not the last. As SaaS platforms, email providers, and website builders adopt the protocol, verifying a domain becomes a one-click step for every customer, and entrepreneurs stick with the registrar that makes it that easy everywhere.
Fewer support tickets: Verification-related tickets, from propagation delays to stale-listing disputes, go away.
Low implementation cost: One authorization endpoint and one signing key, on top of the login and ownership records the registrar already has.

Marketplaces

Supply is the scarce resource, and verification friction leaks it at the moment of highest seller intent.

Verified supply: Removing the DNS step recovers listings that currently die in the funnel, and every recovered listing arrives provably real.
Fraud and front-running elimination: A registrar signature is categorically stronger proof than DNS control: a hijacked zone can pass TXT verification, but it cannot produce a registrar signature.
Freshness: Re-attest at the moments that matter: price change, offer received, escrow open. Listings whose sellers no longer control the domain retire automatically.
Less infrastructure: No polling systems, no propagation edge cases, no verification support queue, no manual dispute process.

Sellers

Verification finally costs what it should: one click inside the account you already control.

One click, no DNS: No TXT records, no propagation wait, no risk to live email or sites on the domain.
Landers stay up: Verification never touches DNS, so it works no matter where your name servers point. List on a new marketplace without re-delegating and without your landers going dark.
Acquired domains list immediately: A current attestation supersedes any previous owner’s stale verification. No support tickets to displace someone else’s claim.

Buyers get listings backed by registrar-level proof of who controls the domain now, not who controlled it when the listing was created.

Built for the agent economy

A growing share of domain discovery and acquisition runs through AI agents, and an agent cannot open a DNS panel, paste a TXT record, and wait for propagation. DomainAttest is machine-native end to end: registrar discovery via a /.well-known endpoint, a standard OAuth flow, and a signed token any client can validate in milliseconds.

Programmatic, instantly verifiable proof of ownership is a prerequisite for agent-mediated domain commerce. DomainAttest defines that layer deliberately, before fragmented workarounds define it by default, while consent stays with the human owner, on the registrar’s own login. Agent-initiated flows with delegated holder consent are on the v2 candidate list.

Design principles

Open: Public specification, CC BY 4.0, free to implement, no permission required. A verification standard only works if it is neutral.
Minimal: One flow, one artifact, one signature scheme. A registrar with a modern auth stack can implement it in weeks.
Built on existing standards: OAuth 2.0, PKCE, JWT signatures, standard key publication. Nothing new to trust.
Privacy-preserving: An attestation proves control, not identity. No registrant data is exposed and Whois privacy is unaffected.
Time-bound by design: Ownership is a fact about now. Attestations expire in minutes; re-verifying costs one click, so verification stays current instead of going stale.
Incrementally adoptable: One registrar and one marketplace deliver instant verification on day one; each additional participant expands coverage from there.

DNS verification vs DomainAttest

	DNS verification	DomainAttest
Time	Minutes to days	Seconds
Seller effort	Manual record edits	One click
Proves	DNS control, once	Registrar-of-record ownership, now
Freshness	Stale forever	Renewable on demand
Failure mode	Mistyped records, propagation	Standard OAuth errors
Fraud surface	Passes with hijacked DNS	Requires registrar signature
Lander name servers	Re-delegate twice; lander goes dark	Never touches DNS; landers stay up
Infrastructure	Custom polling per marketplace	Signature validation
Standard	Every marketplace rebuilds it	One open protocol

Security model

There is no bearer secret anywhere in the protocol. The domain industry already fights an epidemic of transfer auth-code phishing, and DomainAttest deliberately adds nothing a holder could be socially engineered out of: consent happens on the registrar’s own login, under the account’s existing protections, and the resulting attestation works only for the one relying party it names.

Attestations expire within 15 minutes, relying parties reject replayed token identifiers, and a compromised signing key affects only that registrar’s domains, bounded by key rotation and token lifetime. The full analysis is in Section 7 of the specification.

Implement it

Registrars

Expose one authorization endpoint and one token endpoint over your existing login, and publish a JWKS. Typical effort with a modern auth stack: two to four engineering weeks.

Implementation checklist →

Marketplaces

Validate registrar-signed attestations per the specification, or integrate the DomainAttest Hub once and gain coverage of every connected registrar, current and future.

Protocol flow →

Live implementations

Atom operates the reference implementation (registrar and marketplace) and the DomainAttest Hub. Add yours by pull request.

IMPLEMENTATIONS.md →

Frequently asked questions

Why not just keep using DNS?

DNS verification proves control of a zone file at one moment in the past. It is slow, error-prone, passes under hijacked DNS, and goes stale silently. And for actively listed domains it often cannot run at all without collateral damage: most serious listings point their name servers at a marketplace’s landers, so a TXT record added at the registrar is invisible; verifying with a second marketplace means re-delegating, waiting, verifying, re-delegating back, and waiting again, with the lander dark the whole time. The registrar’s own records are the source of truth; DNS was only ever a proxy for them.

Is this a new identity system?

No. It is a profile of OAuth 2.0 with signed tokens, the same pattern behind “sign in with Google,” applied to a question registrars can already answer.

What if a seller’s registrar does not support it?

DNS verification still works as a fallback. DomainAttest adds a fast path; it does not remove the old one. Coverage grows registrar by registrar.

Is this only for domain marketplaces?

No. Nothing in the attestation format or flow is specific to marketplaces; the specification deliberately calls the consumer a relying party. Any service that verifies domain control today through a TXT-record challenge, from SaaS onboarding to email and ad-platform setup, can consume attestations the same way. Marketplaces are where the pain is sharpest, so that is where the protocol starts.