How We Verify Organisation Domains

When an organisation lists a website on its profile, anyone can type anything into that box. Domain verification is the step that turns a typed-in address into something we have actually tested. We ask the organisation to do something with that website that only somebody who controls it could do, and then we check that it was done.

That is the whole of the check. It answers one narrow question: does this organisation control this web address? It is repeated every 90 days, because control of a web address can change hands.

An organisation picks whichever of these three it can do. None is treated as better than the others, and the badge reads the same whichever one was used.

• A DNS record: we give the organisation a unique code to publish in the settings of the domain itself, then look it up. Publishing there requires access to the account that owns the domain name, so a match proves control of the domain rather than of one page on it. DNS changes can take up to 48 hours to become visible to us.
• A file on the website: we give the organisation a unique code to save in a file at a fixed address on the site, then fetch that address over a secure connection and read it back. A match proves whoever did it can publish to the live site.
• An email to a role address: we send a code to a standard administrative address at the domain, such as the one a domain registrar would use, and the organisation returns it to us on their settings page. Receiving mail at that address requires control of the domain's mail.

Whichever route is taken, the code is generated by us, is unique to that organisation and that attempt, and expires. A code from an old attempt cannot be reused.

• Domain verified: the organisation proved it controls the website shown, by one of the three methods above, on the date given. We check again every 90 days.
• Checked by our team: the automated check was not completed, and a member of our team confirmed the domain from documents the organisation supplied instead. We label this differently on purpose, so you can see which kind of check happened.
• Verification in progress: we are waiting to see the organisation's record. A DNS change can take up to 48 hours to appear, so this state is normal for a day or two.
• Not verified: the website is there because the organisation typed it in, and we have not confirmed that they control it. The address is shown as plain text rather than as a link you can follow.

This matters more than what it does tell you. A verified domain is a fact about a web address. It is not a view about the organisation behind it, and we would be implying a standard we do not apply if we let it read that way.

• It does not mean the organisation is regulated, registered with any body, or authorised to do anything in particular.
• It does not mean the organisation is solvent, insured, or covered by any compensation arrangement.
• It does not mean we have reviewed their services, their prices, their advice, or the quality of their work.
• It does not mean we recommend them. We check a web address. That is all this badge records.

• We will never ask you for a verification code by email reply, phone, or chat. A code is entered on your own settings page on our site, by you, and nowhere else. Anybody asking you to read one out or send it on does not work for us.
• Always check the web address before you send money or documents. Read it left to right and look at the part immediately before the first single slash. That is the real destination, whatever the rest of the address says.
• A verification email from us tells you what to do next on our site. It never asks you to move money, and it never asks for your password.
• If a message claiming to be from us does not match any of this, do not act on it. Contact us using the details below and we will tell you whether it came from us.

Plenty of organisations do not hold their own domain settings. The site may be run by a web agency, a supplier, a national body, or a volunteer who set it up years ago. This is ordinary, and it does not put you in a lesser category of organisation.

• Use the file method instead: anybody who can publish a page to the site can usually save the file as well, so this often works when DNS is out of reach.
• Use the role address: if mail to the standard administrative address at your domain reaches somebody in your organisation, that is enough.
• Ask whoever runs the site: the DNS record is a single line of text and takes an agency a few minutes. We show the exact value to paste, so you can forward it as it stands.
• Ask us: if none of these are possible, contact us. Our team can confirm the domain from documents you supply. Your profile then shows "Checked by our team" rather than "Domain verified", because the two were checked in different ways and we say which.