iRedAdmin-Pro: Domain ownership verification


Check out the lightweight on-premises email archiving software developed by iRedMail team: Spider Email Archiver.


Since iRedAdmin-Pro-SQL-2.5.0 and iRedAdmin-Pro-LDAP-2.7.0, it's able to grant normal domain admin permission to create new mail domains. All new domains added by normal domain admin require domain ownership verification by deafult, to ensure:

Mail services are disabled for pending domains, and will be activated automatically after admin verified the ownership.

How to enable or disable domain ownership verification

There're few parameters used to control domain ownership verifivation, you can find default settings in file libs/ under iRedAdmin-Pro directory. If you want to change any of them, please copy the parameter to iRedAdmin-Pro config file, set proper value, then restart Apache or uwsgi (if you're running Nginx) service to reload the changes.

# Require domain ownership verification if it's added by normal domain admin:
# True, False.

# How long should we remove verified or (inactive) unverified domain ownerships.
# iRedAdmin-Pro stores verified ownership in SQL database, if (same) admin
# removed the domain and re-adds it, no verification required.
# Admin won't frequently remove and re-add same domain name, so it's ok to
# remove saved ownership after X days.

# The string prefixed to verify code. Must be shorter than than 60 characters.
DOMAIN_OWNERSHIP_VERIFY_CODE_PREFIX = 'iredmail-domain-verification-'

# Timeout (in seconds) while performing each verification.

How to verify domain ownership

There're several ways to verify domain ownership:

Sample DNS query with nslookup:

$ nslookup -type=txt
...     text = "iredmail-domain-verification-5tzh5gHjU688yyWK7cSV"

Sample DNS query with dig:

$ dig -t txt
...       4173    IN  TXT "iredmail-domain-verification-5tzh5gHjU688yyWK7cSV"