Laravel Domain Verifier

DNS-over-HTTPS TXT/CNAME resolver for Laravel with token-based domain-ownership verification. Generate a token, tell the user which TXT record to publish, and check for it later — every lookup goes over plain HTTPS to a configurable list of DoH resolvers, so it works reliably inside Docker and is trivial to fake in tests.

Installation

composer require labrodev/laravel-domain-verifier

Publish the config file:

php artisan vendor:publish --tag=domain-verifier-config

Set the environment variables (all optional — the defaults are sensible):

DOMAIN_VERIFIER_DOH_RESOLVERS=https://dns.google/resolve,https://cloudflare-dns.com/dns-query
DOMAIN_VERIFIER_TXT_PREFIX=domain-verify=
DOMAIN_VERIFIER_TOKEN_LENGTH=48
DOMAIN_VERIFIER_HTTP_TIMEOUT=5

Verifying domain ownership

Generate a token when the user registers their domain, and store it alongside the domain. VerificationTokenGenerator is a single-purpose service — invoke it directly rather than calling a named method:

use Labrodev\DomainVerifier\Services\VerificationTokenGenerator;

$token = (new VerificationTokenGenerator)();

Show the user the exact record to publish. expectedRecord() is the single source of truth for the record value — it prepends the configured txt_prefix:

use Labrodev\DomainVerifier\Services\DnsResolver;
use Labrodev\DomainVerifier\Services\OwnerVerifier;

$ownerVerifier = new OwnerVerifier(new DnsResolver);

// "Add a TXT record on @ with this value:"
$ownerVerifier->expectedRecord($token); // "domain-verify={token}"

Later — from a button, a scheduled job, whatever fits — check whether the record is live. Invoking the verifier returns a bare boolean:

if ($ownerVerifier('example.com', $token)) {
    // mark the domain as verified
}

Use verify() when you want to show the user why verification failed:

$result = $ownerVerifier->verify('example.com', $token);

$result->verified;        // bool
$result->expected;        // the TXT value that was looked for
$result->observedRecords; // every TXT record actually found on the domain

The match is strict and whole-string: a token embedded inside a longer record does not verify, and every mismatch is logged as a warning with the expected and observed values.

Verifying a CNAME points at your host

CnameVerifier checks that a hostname CNAMEs to a target you pass explicitly — for instance before routing a custom domain or issuing a certificate. Trailing dots are normalised on both sides:

use Labrodev\DomainVerifier\Services\CnameVerifier;
use Labrodev\DomainVerifier\Services\DnsResolver;

$cnameVerifier = new CnameVerifier(new DnsResolver);

if ($cnameVerifier('status.example.com', 'pages.my-platform.dev')) {
    // the CNAME is in place
}

Raw DNS lookups

DnsResolver is also useful on its own — for instance to check that a CNAME points at your platform before issuing a certificate:

use Labrodev\DomainVerifier\Services\DnsResolver;

$dnsResolver = new DnsResolver;

$dnsResolver->txtRecords('example.com');          // list<string>, quotes and chunking normalized
$dnsResolver->cnameRecords('status.example.com'); // list<string>, trailing dots stripped

Why DNS-over-HTTPS

PHP's dns_get_record() is unreliable inside Docker: the embedded resolver at 127.0.0.11 frequently returns false for TXT lookups. DoH is plain outbound HTTPS, so it works from inside containers and can be faked with Http::fake() in tests. The configured resolvers are tried in order; the system resolver is only consulted when every one of them is unreachable.

Testing

composer test      # pest
composer phpstan   # larastan, level 7
composer pint      # laravel preset
composer check     # all of the above

License

MIT. See LICENSE.md.