Hacker News new | ask | show | jobs
by tallanvor 969 days ago
Domain verification should typically be a one-time or at least rare event. You shouldn't have to keep the txt records after the verification is completed.
3 comments

No, domain validation should be frequent, so that revoking authorization can take effect quickly, which is particularly important if the domain changes ownership.
It should be one-time, yes. Maybe it shouldn't be rare though. But your point still stands as the TXT records should be ephemeral. So I don't think this deserves the downvotes.

At least ACME's DNS challenge protocol is designed this way.

> The client SHOULD de-provision the resource record(s) provisioned for this challenge once the challenge is complete, i.e., once the "status" field of the challenge has the value "valid" or "invalid".

https://datatracker.ietf.org/doc/html/rfc8555#page-67

That’s insane. Domains are not owned by the same entity forever.