# Domains and ownership checks

> How to verify a subscription domain with a TXT record or a file, what the statuses mean, and why the exact name is what gets verified.

A subscription domain has to be verified: that way nobody can pose as you by putting your ID into their own
subscription. FlowLock stores the name of the verified domain and its SHA-256 hash; the apps tell the server only the
hash of the domain the subscription came from.

## Add a domain

1. Cabinet → “Domains” → enter the name (`sub.example.com`) or a whole subscription link: the cabinet takes the
   domain from it.
2. Verify it in **one** of the ways below. The cabinet shows ready-made values to copy.
3. Press “Check”, or just wait: the cabinet checks a new domain by itself every hour for the first 72 hours.

## TXT record

At your registrar or in your DNS panel (Cloudflare and others):

```
_flowlock.sub.example.com.  TXT  "flowlock-provider=k7m2x9q4bd"
```

The record name is `_flowlock.` in front of your domain. The subdomain may have any number of other TXT records: the
cabinet looks among them for the one equal to `flowlock-provider=<ID>`.

## File on the website

The file `https://sub.example.com/.well-known/flowlock-provider` with the text:

```
flowlock-provider=k7m2x9q4bd
```

The file must be served directly from this domain: port 443, a valid certificate, status 200, no redirects, at most
4 KB. A domain that points to a private address (`10.x`, `192.168.x` and so on) can't be verified this way.

## Statuses

| Status                   | What it means                                                                                        |
| ------------------------ | ---------------------------------------------------------------------------------------------------- |
| pending (`pending`)      | the domain is added, no check has passed yet                                                         |
| verified (`verified`)    | everything works                                                                                     |
| check failed (`failing`) | the last check failed; subscriptions still work for now                                              |
| lost (`lost`)            | three failures in a row, over at least 48 hours; subscriptions from the domain work as ordinary ones |

If a check fails, the cabinet gives the reason: there is neither a record nor a file; the record exists but with a
different ID; DNS didn't answer; the file is served with a status other than 200; the file couldn't be downloaded;
the domain points to a private address.

## Important

- The **exact name** is verified: `sub.example.com` and `example.com` are different domains, and `www.` is separate
  too. The port doesn't matter: `sub.example.com:2096` = `sub.example.com`.
- Internationalised domains can be entered as they are (`подписка.рф`): the cabinet converts them to punycode.
- An IP address can't be verified: subscriptions served by IP work as ordinary ones.
- **Don't remove** the record or the file: the cabinet re-checks the domain once a day. A lost domain comes back by
  itself as soon as a check passes again.
- Several providers can verify the same domain, each with their own TXT record (for example, a shared panel).
- Up to 50 domains per cabinet, and up to 20 manual checks per hour.

Addresses for [moving a subscription](https://flowlock.cc/en/docs/app-management.md) (`new-url`, `new-domain`, `fallback-url`), for the
“Change the address” command and for [limited links](https://flowlock.cc/en/docs/install-links.md) must also be on your verified domains.