Domains — Docs

Verifying a domain

Add a hostname at Dashboard → Domains. Pick one of two verification methods:

DNS TXT — add a record at _fixweb.<hostname> with the token we generate. We re-resolve it from our server, not yours, so SPF and DMARC settings don't interfere. Typical propagation: 1-5 minutes; we re-check every 30 seconds for 10 minutes.
HTTP file — host a small text file at /.well-known/fixweb-verification.txt with the token. We fetch over HTTPS via the SSRF-guarded request path.

Verifications are re-checked daily by the domain-reverify cron. If a previously-verified domain stops resolving the token (e.g. you removed the DNS record), the verification is revoked and active scans against it drop back to verify_required until you re-⁠add it.

Scheduled re-scans and monitoring

Not available on current plans. On watch, coming soon, will check one website every 14 days and email you the results.

Trigger from API or MCP

Domain management is currently UI-only — no API surface for verification or schedule changes. To start a scan against an already-verified domain via API, use POST /api/v1/scans:

bash

curl -X POST https://fixweb.app/api/v1/scans \
  -H "Authorization: Bearer fxw_..." \
  -H "content-type: application/json" \
  -⁠d '{"target":"https://example.com"}'