nuclei-templates/dns/txt-service-detect.yaml

id: txt-service-detect

info:
  name: DNS TXT Service - Detect
  author: rxerium
  severity: info
  description: |
    Finding the services companies use via their TXT records.
  reference:
    - https://www.abenezer.ca/blog/services-companies-use-txt-records
  metadata:
    verified: true
    max-request: 1
  tags: dns,txt,txt-service,discovery

dns:
  - name: "{{FQDN}}"
    type: TXT

    matchers-condition: or
    matchers:
      - type: word
        name: "keybase"
        words:
          - "keybase-site-verification"

      - type: word
        name: "salesloft-drift"
        words:
          - "drift-domain-verification"

      - type: word
        name: "proton-mail"
        words:
          - "protonmail-verification"

      - type: word
        name: "webex"
        words:
          - "webexdomainverification"

      - type: word
        name: "apple"
        words:
          - "apple-domain-verification"

      - type: word
        name: "facebook"
        words:
          - "facebook-domain-verification"

      - type: word
        name: "autodesk"
        words:
          - "autodesk-domain-verification"

      - type: word
        name: "stripe"
        words:
          - "stripe-verification"

      - type: word
        name: "atlassian"
        words:
          - "atlassian-domain-verification"

      - type: word
        name: "adobe-sign"
        words:
          - "adobe-sign-verification"

      - type: word
        name: "zoho"
        words:
          - "zoho-verification"

      - type: word
        name: "have-i-been-pwned"
        words:
          - "have-i-been-pwned-verification"

      - type: word
        name: "knowbe4"
        words:
          - "knowbe4-site-verification"

      - type: word
        name: "jamf"
        words:
          - "jamf-site-verification"

      - type: word
        name: "parallels"
        words:
          - "parallels-domain-verification"

      - type: word
        name: "dropbox"
        words:
          - "dropbox-domain-verification"

      - type: word
        name: "vmware-cloud"
        words:
          - "vmware-cloud-verification"

      - type: word
        name: "canva"
        words:
          - "canva-site-verification"

      - type: word
        name: "mongodb"
        words:
          - "mongodb-site-verification"

      - type: word
        name: "slack"
        words:
          - "slack-domain-verification"

      - type: word
        name: "teamViewer"
        words:
          - "teamviewer-sso-verification"

      - type: word
        name: "bugcrowd"
        words:
          - "bugcrowd-verification"

      - type: word
        name: "cisco"
        words:
          - "cisco-site-verification"

      - type: word
        name: "palo-alto-networks"
        words:
          - "paloaltonetworks-site-verification"

      - type: word
        name: "twilio"
        words:
          - "twilio-domain-verification"

      - type: word
        name: "dell-technologies"
        words:
          - "dell-technologies-domain-verification"

      - type: word
        name: "1password"
        words:
          - "1password-site-verification"

      - type: word
        name: "duo"
        words:
          - "duo_sso_verification"

      - type: word
        name: "sophos"
        words:
          - "sophos-domain-verification"

      - type: word
        name: "pinterest"
        words:
          - "pinterest-site-verification"

      - type: word
        name: "citrix"
        words:
          - "citrix-verification-code"

      - type: word
        name: "zapier"
        words:
          - "zapier-domain-verification-challenge"

      - type: word
        name: "uber"
        words:
          - "uber-domain-verification"

      - type: word
        name: "zoom"
        words:
          - "zoom-domain-verification"

      - type: word
        name: "lastpass"
        words:
          - "lastpass-verification-code"

      - type: word
        name: "google-workspace"
        words:
          - "google-site-verification"

      - type: word
        name: "flexera"
        words:
          - "flexera-domain-verification"

      - type: word
        name: "yandex"
        words:
          - "yandex-verification"

      - type: word
        name: "calendly"
        words:
          - "calendly-site-verification"

      - type: word
        name: "docusign"
        words:
          - "docusign"

      - type: word
        name: "whimsical"
        words:
          - "whimsical"

      - type: word
        name: "nintex"
        words:
          - "nintex."

      - type: word
        name: "openai"
        words:
          - "openai-domain-verification"

      - type: word
        name: "mailerlite"
        words:
          - "mailerlite-domain-verification"

      - type: word
        name: "docker"
        words:
          - "docker-verification"

      - type: word
        name: "shopify"
        words:
          - "shopify-verification-code"

      - type: word
        name: "smartsheet"
        words:
          - "smartsheet-site-validation"

      - type: word
        name: "site24x7"
        words:
          - "site24x7-signals-domain-verification"

      - type: word
        name: "dynatrace"
        words:
          - "dynatrace-site-verification"

      - type: word
        name: "cisco-cloud-intelligence"
        words:
          - "cisco-ci-domain-verification"

      - type: word
        name: "infor-cloudsuite"
        words:
          - "infor-cloudsuite-domain-verification"

      - type: word
        name: "postman"
        words:
          - "postman-domain-verification"

      - type: word
        name: "miro"
        words:
          - "miro-verification"

      - type: word
        name: "microsoft-federation"
        words:
          - "msfpkey"

      - type: word
        name: "dynamics-365-marketing"
        words:
          - "d365mktkey"

      - type: word
        name: "zoom-alternative"
        words:
          - "zoom_verify"

      - type: word
        name: "brevo"
        words:
          - "brevo-code"

      - type: word
        name: "perplexity-ai"
        words:
          - "perplexity-ai-domain-verification"

      - type: word
        name: "pexip"
        words:
          - "pexip-ms-tenant-domain-verification"

      - type: word
        name: "anthropic"
        words:
          - "anthropic-domain-verification"

      - type: word
        name: "airtable"
        words:
          - "airtable-verification"

      - type: word
        name: "wrike"
        words:
          - "wrike-verification"

      - type: word
        name: "salesforce-pardot"
        words:
          - "pardot"

      - type: word
        name: "notion"
        words:
          - "notion-domain-verification"

      - type: word
        name: "jetbrains"
        words:
          - "jetbrains-domain-verification"

      - type: word
        name: "onetrust"
        words:
          - "onetrust-domain-verification"

      - type: word
        name: "nulab"
        words:
          - "nulab-verification-code"

      - type: word
        name: "sap-successfactors"
        words:
          - "successfactors-site-verification"

      - type: word
        name: "synthesia"
        words:
          - "synthesia"

      - type: word
        name: "monday"
        words:
          - "monday-com-verification"

      - type: word
        name: "globalsign"
        words:
          - "globalsign-domain-verification"

      - type: word
        name: "heyhack"
        words:
          - "heyhack-verification"

      - type: word
        name: "foxit"
        words:
          - "foxit-domain-verification"

      - type: word
        name: "facebook-workplace"
        words:
          - "workplace-domain-verification"

      - type: word
        name: "pendo"
        words:
          - "pendo-domain-verification"

      - type: word
        name: "stytch"
        words:
          - "stytch_verification_dns"

      - type: word
        name: "mixpanel"
        words:
          - "mixpanel-domain-verify"

      - type: word
        name: "astro"
        words:
          - "astro-domain-verification"

      - type: word
        name: "box"
        words:
          - "box-domain-verification"

      - type: word
        name: "wiz"
        words:
          - "wiz-domain-verification"

      - type: word
        name: "figma"
        words:
          - "figma-domain-verification"

      - type: word
        name: "solarwinds"
        words:
          - "solarwinds-service0desk-verification"

      - type: word
        name: "hubspot"
        words:
          - "hubspot-domain-verification"

      - type: word
        name: "microsoft-domain"
        words:
          - "ms-domain-verification"

      - type: word
        name: "swisssign"
        words:
          - "swisssign-check"

      - type: word
        name: "infoblox"
        words:
          - "infoblox-domain-mastery"

      - type: word
        name: "ahrefs"
        words:
          - "ahrefs-site-verification"

      - type: word
        name: "logmein"
        words:
          - "logmein-verification-code"

      - type: word
        name: "mailru"
        words:
          - "mailru-verification"

      - type: word
        name: "mandrill"
        words:
          - "mandrill_verify"

      - type: word
        name: "nitro"
        words:
          - "nitro-verification-code"

      - type: word
        name: "parkable"
        words:
          - "parkable-domain-verification"

      - type: word
        name: "seculio"
        words:
          - "seculio-domain-verification-code"

      - type: word
        name: "trustpilot"
        words:
          - "trustpilot-one-time-verification"

      - type: word
        name: "esputnik"
        words:
          - "esputnik-verification"

      - type: word
        name: "atlassian-sending"
        words:
          - "atlassian-sending-domain-verification"
# digest: 4b0a00483046022100e3476fc5074cd4e72fe68c52ad8931f78bb0f1754b8cde42d851c6938d0121f50221009d85ca08cd4c46e0f11b7b9f5530c0c6afbed5f04093d1766ee6cdf50d42de41:922c64590222798bb761d5b6d8e72950