Each market has the same basic question: Does this person really control the assets they are trying to sell?
In the domain industry, that question is difficult to answer, even if one party always knows the exact answer. The registrant already knows who owns the domain. There has never been a standard way for them to say so.
Today, all independent marketers ask vendors to verify ownership via DNS: add a TXT record or rename a server, wait for the broadcast, hopefully nothing goes wrong. It was a 1990s solution to a question that should take a second to answer.
Today we are publishing DomainAttest, an open protocol that allows registrants to answer that question directly in a matter of seconds. This. Features, White paperAnd Example Is at DomainAttest.org And on GitHub. The implementation of our references is live and registrants or marketers can apply it without the need for permission from anyone, including us.
What DNS authentication really costs
DNS authentication solves a real problem, but it is not designed to answer the questions that the market is asking. Because it’s slow and manual, the industry has tackled into a failure mode that is worse than self-friction.
Some markets skip verification completely. Anyone can register any domain. That allows front-end processing: Bad characters list domains they do not own, wait for the buyer, then try to take it out from under the real owner or take the deposit and disappear. The buyer cannot tell the exact listing from the estimate.
Most others verify once and consider it permanent. When the domain changes hands, the old registration remains under the previous owner’s account, still marked as verified, sometimes at an invalid value. The correct new owner is the one who has to open a support letter to change the verification, which actually stops on the day the domain is transferred.
And for active sellers, it consists. The most severely listed domains point their name servers to a marketing representative. That means your registrar’s DNS panel is no longer authorized and the TXT record added there is invisible. To verify with the secondary marketer, the seller has to rename the server back to the registrar, wait for the additional promotion, the verification record rename the server back and wait for the promotion again. Wait two and the landing is dark all the time along with any buyers who clicked during that time. Most domain registration sellers across most markets pay this tax most often.
All of these failures have the same reason: authentication is expensive, so it is skipped or never repeated.
How it works
Seller Marketplace Registrar
│ │ │
│ list domain │ │
├──────────────────────>│ │
│ │ redirect (OAuth) │
│<──────────────────────┤ │
│ │
│ log in with existing account + 2FA, approve │
├───────────────────────────────────────────────>│
│ │ │
│ │ signed ownership │
│ │ attestation │
│ │<───────────────────────┤
│ │ │
│ verify signature, │
│ listing goes live │Vendors click “Verify with your registrar” to record the way they always do and agree. The registrar returns the proof of ownership: a signed token stating that the verified account governing this domain issued for this market expires in minutes. Market Signature Check. Ready. Less than five seconds. And since it does not touch DNS, it works no matter where your name server points. Your walker is silent.
It is a standard OAuth flow with a signed token, which is the same pattern behind “Sign in with Google”. No new identification systems, no new cryptography, and deliberately no static keys that vendors can be tampered with. The domain industry has already fought against the proliferation of social engineering verification codes. We will not make secrets of other holders.
Verification should continue.
Permanent verification is not verification. Change of ownership; Verification should be as well.
Because re-verification takes one click, the verification will stop being a portal. Marketplaces can re-confirm when whois information changes, when offers arrive, when escrow opens and automatically retires listings where vendors no longer control the domain. The stuck verification and the help letter they created are gone.
DNS Verification vs. DomainAttest
| DNS authentication | DomainAttest | |
|---|---|---|
| Time | Minutes to day | Seconds |
| Vendor Efforts | Manual record editing | One click |
| Proof | One-time DNS management | Owners on record now |
| Fresh | Forever | Renewable as needed |
| Fake surface | Cross with hijacked DNS | Registration signature required |
| Lander name server | Re-delegate twice; Dark Lander | Never touch DNS; Lander on board |
| Market infrastructure | Personal voting system | Signature Validity |
| Standard | Each market rebuilds it | An open protocol. |
What’s in it for registrants
More than just ticket recovery support. DomainAttest changes what a registrar is: from where the domain sits to every market authority, depending on the question of ownership.
Start with saving. Today’s portfolio sellers have no specific reason to keep the domain at any registrar. They chase after continuous pricing and move freely, and every sale in the market pulls another domain away. Under DomainAttest, the registration account becomes where the authentication takes place: every listing, every confirmation, every marketing, every single click. But only for the domain occupied there. That gives the most valuable clients in the industry who hold hundreds or thousands of names and subsequent registrations, which is the obvious reason for unification at the registrar who participates and stays.
In addition, v2 candidate list includes post-sale distribution in registrars where the buyer can choose to receive the domain into an account at the same registrar rather than transfer it out. An option for buyers and a means for final sale by the registrar keeping the domain under control.
Execution is the end point of an authorization and a signature key at the top of the entry and record of ownership that the registrar already has. The state-of-the-art authentication package arrives there in a matter of weeks.
What’s in it for the market
Supply is a scarce resource, and verification friction will leak at the exact moment of the highest vendor intent: the vendor decides to sell, selects a market, and reaches the DNS step. That removal removed the list of dead bodies in the biosphere, and all the recovered listings came to fruition.
The evidence is also stronger than the category. The hijacked site or compromised name server can go through TXT authentication. It is not possible to create a registration signature. Markets that skip today’s verification can accept it at zero friction and close the front hole completely.
And the infrastructure is gone: no voting system, no case, no advertising edge, no queue support, no manual verification for contest list. Refreshment comes free of charge since the reseller price is clicked.
What for sellers
The final verification costs what it should: Click once on an account you already manage. No TXT records, no ad waiting, no risk of live email or websites running on the domain.
Your walker is silent. Because authentication never touches DNS, it works no matter where your name server points. Listing on the supplemental market no longer means re-transfer, waiting and darkening.
And get a domain name list immediately. The current certification replaces any previous owner’s freeze verification, so purchasing a domain listed elsewhere no longer means a support letter to change someone else’s claim.
Buyers get a mirror image: All registrations backed by the registrar’s proof of dominance now do not belong to anyone at the time the registration was created.
Two ways to apply
Live. Apply the open feature yourself. No need to contact us: registrants and affiliate marketers are directly involved with Atom like never before. This is how we expect serious practitioners to use and the feature does not lose anything by skipping us.
Via DomainAttest Hub. We also run a setup center that gathers all the registered participants behind a single API for those who want one integration instead of multiple. It is free, it implements the same open features, and the certification is still signed by the registrar so everything that the return center is can verify independently. The Center cannot falsify, modify or maintain the validity of the certification. There is no authorization by design, this feature allows anyone else to run a hub on the same terms, and Atom is not part of the trust path in either mode.
Well, that includes our opponents as well. We did not build it to sit in the middle of it, and we would rather have it spread with atoms nowhere in the flow than not spread at all. We benefit from how every practitioner acts as a marketer and registrar, getting faster registrations and fewer fraud cases is not a place to be charged. The authentication standard can only work if it is neutral and the spec is spec no matter who processes the request.
Made for what comes next
Increasing share of domain discovery and acquisition now works through AI agents, and agents are poorly served by workflows that require manual DNS changes and ad hoc delays. The domain purchase negotiation agent can not suspend the transaction halfway to wait 48 hours for the TXT record. Instant verification of ownership is a prerequisite for agency-mediated domain commerce, and DomainAttest provides it as a first-come, first-served basis: Verification is machine-verified by construction. The industry can deliberately define this layer now or inherit a fragmented solution that arises later.
Questions people ask
Why not continue using DNS? DNS authentication shows the management of a zone file in the past. It’s slow, prone to errors through DNS being hijacked and disappearing silently. The personal record of the registrar is a source of truth; DNS used to be a proxy for them.
Is this a new identity system? No, it is an OAuth 2.0 newsletter with a signed token that applies to questions that registrants can already answer.
What if your seller registration does not support it? DNS authentication is still running as an alternative. DomainAttest adds a highway. It does not remove old things.
Bigger than the market
We make it for the domain market because that is our world. But nothing in the protocol knows what the market is. The certificate simply states: This verification account manages this domain, signed by the registrar. All SaaS access streams, all services that ask you to paste a TXT record and wait for the same authentication through the same 48-hour ceremony. Features Call customers as dependent parties, not market with purpose. We start where the pain is greatest. Where it goes after that depends on who implements it.
One layer is not the whole stack.
DomainAttest does not replace market diversity. It specifies a specific layer of goods: specifies who owns the domain. The market is still competitive in terms of discovery, pricing, negotiation, warranty and experience. They just stop rebuilding the same authentication system seriously again and again.
The feature is live at DomainAttest.org And github.com/domainattest/spec. Immediate verification is on Atom today for domains registered with us. If you run a registrar, market, or service that verifies domain ownership, a performance checklist is included in the feature and we appreciate your feedback.
The registrant already knows who owns the domain. Now there is a protocol that enables them to say so.
.
Posts DomainAttest Introduction: An Open Protocol for Instant Domain Ownership Verification First appeared Atoms.
