Jump to: What is Domain Control Validation?
Domain Control Validation (DCV) is a way to demonstrate that you have authority to register a service or DNS host name using the DNS domain in question. A common way to achieve this is to create a DNS TXT record containing a randomly generated token as the value.
InCommon uses this method to validate your authority to use a DNS domain or host when you register an entity in the InCommon metadata. If you submit an entity with either an entity ID or scope containing a previously unvalidated domain, the InCommon Registration Authority (RA) will ask you to perform the following to validation steps:
Demonstrate control with a DNS TXT record
Triggering condition
- The requesting Site Administrator (SA) submits metadata for approval via the InCommon Federation Manager (FM).
- The InCommon Registration Authority (RA) reviews metadata per the InCommon metadata validation procedure.
- If WHOIS data for any domain under review does not match the submitting organization -OR- the WHOIS data is not available, complete the following steps.
Validation steps
Step 1: RA emails the DCV TXT record creation instructions to the requesting SA. The instruction will include a 20-character validation code. Each assigned mixed-case, alphanumeric code is unique to the domain to be to be validated.
Step 2: SA uses the appropriate DNS management tool to: create a TXT record with the following information
Host: “_incommon.{domain}”
Type: TXT
Value: “incommon-dcv={unique_validation_code}”
Step 3: SA emails InCommon at help@incommon.org when this has been accomplished.
Step 4: RA verifies, archives evidence, and approves the metadata.
What is the {domain} mentioned in the steps above?
When validating an entityID, {domain} is the entire hostname in the URL. For example, if your entityID is "https://idp.example.edu/services/idp", the {domain} to be validated is "idp.example.edu".
When validating a SAML shibmd:Scope, {domain} is the domain you enter in the Scope field.
Additional reading