Without verifiable domain authorisation, SHELL-AFFECT does not start CASP. DNS-TXT verification ensures only owned or written-approved domains are viewed outside-in — for trust, scope, and clear responsibility before any passive security analysis begins in a DACH context.
Client wants to “scan today”. We send the TXT token, IT sets `_shell-affect-verify` in 20 minutes, we verify, only then CASP starts. A parallel wish to “also do the partner domain” is declined — no approval, no scope. Kickoff stays clean, no grey zone. Figures and names are anonymised; the flow matches typical engagements. Decision criteria stay explicit. No ranking or lead guarantees apply.
DNS-TXT is deliberately simple and strict. Anyone wanting to start without the gate does not get CASP from us — that protects you and us.
This page’s job: Owns the DNS-TXT authorisation gate before CASP only. No report promise and no pentest RoE substitute.
Simplified onboarding (details in the engagement):
You receive a one-time proof value.
Set TXT on the primary domain (watch TTL).
We check resolution and value.
CASP outside-in only after successful verification.
Full scope: proof per domain.
After kickoff/policy — defined in onboarding.
Security work without approval is legally and ethically risky. Leaders also need a simple, checkable proof that the domain belongs to the client. DNS-TXT is the pragmatic gate before passive analysis.
Anyone commissioning CASP or related outside-in work who wants authorisation documented cleanly.
Authorisation is not paperwork friction — it is the difference between serious security and a grey zone. CASP starts only after DNS-TXT. No “later”, no workaround. Gate before work starts.
Verification before outside-in — not in parallel and not optional.
DNS-TXT proves domain control better than an email from some mailbox.
No work on third-party or unclear assets — ethically and contractually clean.
Setting TXT is simple; we do not block kickoff with needless bureaucracy.
Typical boundaries at the kickoff gate:
DNS-TXT verification mandatory before CASP
Documented kickoff step linked to scope
Work stops if verification fails
CASP start without successful verification
Testing third-party domains without rightful approval
“Informal” scans as a favour
If you want serious authorisation and then defensible CASP: scope meeting. If you want to start without a gate, we decline — by design.
Method boundaries first — no mixed CASP/pentest theatre.
Provable authorisation before analysis.
Standard gate, documented, repeatable.
TXT takes minutes — does not block for weeks.
One DNS record and an approval check.
Only authorised assets in scope.
Client and provider share the same gate.
CASP starts only when TXT is valid.
Required before CASP start.
Passive outside-in profiling.
Proof in project context.
Full scope with multiple TXT proofs.
One-time proof value for your domain.
In the primary domain DNS.
We check before work starts.
Outside-in begins only after.
TXT proves technical control of the domain — not only mailbox access.
At least through verification and kickoff; details in onboarding.
Pentests need written approval and RoE; CASP uses DNS-TXT as the outside-in gate.
Contact — we send the flow with scope.
For CASP we use DNS-TXT as the technical gate. Additional written approvals may still be required per scope.
Then that party must be able to set TXT — or the scope does not start. That is intentional.
CASP and penetration testing are often mixed — that wastes budget. We separate them: CASP is passive outside-in profiling with authorisation; a pentest is active, approved scope with RoE and PoCs. So you know what is worth doing first.
Open topic →The most expensive pentest is the one with unclear scope. Before active testing, outside-in clarity pays: which domains and services are visible? What is no-go? What should the test prove? CASP and clean RoE prep reduce blind flight and renegotiation.
Open topic →An outside-in assessment at SHELL-AFFECT is CASP: a passive view of the externally visible attack surface, only after domain authorisation, with analyst accountability and a signed report. Orientation for leaders and IT before budget flows into active testing or unclear tool waves.
Open topic →Share domain and goal — we guide DNS-TXT and scope.