Onboard a domain

Adding a domain turns on Certificate Transparency monitoring for it: every publicly trusted certificate issued for that domain, by any CA, enters your inventory - including ones you did not order.

Before that happens you have to prove the domain is yours.

Why the gate exists

Without an ownership check, NextPKI would be a free reconnaissance service. Anyone could enter a competitor’s domain and receive a report on their certificate estate, their internal hostnames and their renewal cadence.

The check also anchors the per-tenant domain quota.

The steps

Domains are managed in the Console under Settings → Domains - there is no domain API in v1.

1. Add the domain. Individually, or as a CSV list for bulk import.
2. Publish the TXT record. NextPKI shows a verification token; publish it as a TXT record on the domain.
3. Verify. NextPKI resolves the record. On success the state moves from pending to verified and monitoring begins.

States are pending, verified, failed and revoked. Only verified domains are watched.

Publishing the record

If your DNS is at a provider with an API, script it. The record is a plain TXT at the domain apex:

example.com.  IN  TXT  "nextpki-verify-<token>"

Two practical points. DNS propagation is not instant - if verification fails immediately, wait for the TTL of any existing negative answer and retry rather than assuming the record is wrong. And check for a CAA record while you are in the zone: if CAA restricts issuance to specific CAs, renewals through a connector for a different CA will fail at validation, and that failure looks like a NextPKI problem when it is not.

dig +short TXT example.com
dig +short CAA example.com

Which domains to add

Add more than you think you need. The forgotten domains are where the forgotten certificates live:

• Apex and every subdomain you use, including internal-facing ones with public DNS.
• Domains from acquisitions, and old brands still resolving.
• Regional variants - the .de alongside the .com.
• Domains you believe are parked. A parked domain with a live certificate is a finding.

A domain you do not verify is a domain whose certificates you will not see. CT matching works against verified domains and their subdomains only.

After verification

The CT monitor matches new log entries against your verified domains and imports hits. Optional common-name probing tries conventional prefixes - www., mail. - to find hosts serving certificates you would otherwise only see in a log.

Expect unauthorized_issuance alerts to be the interesting output. A certificate for your domain that NextPKI did not order means either someone else in the organisation bought it, a vendor holds one on your behalf, or something is wrong. All three are worth knowing.