---
title: "Verify a DNS token for a domain"
method: POST
path: "/domainverification/verifydnstoken"
---

# Verify a DNS token for a domain

`POST /domainverification/verifydnstoken`

Available on Pro subscriptions. Checks the hibp-verify TXT record on the requested domain and, if it matches the previously generated token, marks the domain as verified for domain search.

## Headers

- `user-agent` string, required

## Request body

- DomainVerificationRequest
  - `DomainName` string, required — Domain name to generate or verify a domain-verification token for.

## Response `200`

The domain was successfully verified.

## Other responses

- `400` — Bad request — the request body was invalid, the domain was invalid, or the domain cannot be verified.
- `401` — Unauthorized — the hibp-api-key header was missing, malformed, or invalid.
- `403` — Forbidden — no user agent has been specified in the request, or the current subscription does not include permission to add domains via the API.
- `404` — Not found — no matching hibp-verify TXT record was found on the domain.

---

[API](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3.md) · [All operations](https://skmtc.net/haveibeenpwned/apis/have-i-been-pwned-api-v3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/haveibeenpwned/have-i-been-pwned-api-v3/revisions/b6c35caec844/schema)