> ## Documentation Index
> Fetch the complete documentation index at: https://docs.puntego.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Domains

> Add and verify the hostnames Puntego is allowed to boot on, with a DNS TXT record.

Puntego only boots on hostnames you have added and verified for your workspace. Verifying a
domain proves you control it, so your app ID can only run the guide on sites you own.

## Verify a domain

<Steps>
  <Step title="Open Domains">
    Go to **Dashboard → Settings → Domains**.
  </Step>

  <Step title="Add the hostname">
    Enter the exact hostname you plan to ship on, such as `app.example.com`. Add each host
    you serve separately.
  </Step>

  <Step title="Publish the DNS TXT record">
    The dashboard shows a DNS TXT record for the domain. Add it at your DNS provider using
    the host and value below.

    | Type  | Host                     | Value         |
    | ----- | ------------------------ | ------------- |
    | `TXT` | `_gp-verify.example.com` | `gp-verify-…` |

    The host is `_gp-verify.` followed by your domain, and the value always starts with
    `gp-verify-`. Copy the exact value shown in the dashboard — it is unique to your domain.
  </Step>

  <Step title="Run verification">
    Return to **Dashboard → Settings → Domains** and run verification. Puntego looks up the
    TXT record over DNS and marks the domain verified once it matches. DNS changes can take
    time to propagate, so re-run verification if it does not pass on the first try.
  </Step>
</Steps>

<Note>
  Add and verify every production hostname before you launch — including preview or staging
  hosts where the boot script runs. The runtime checks the origin when it loads, so an
  unverified host will not mount the guide.
</Note>

## Why this matters

* Puntego refuses to boot on origins you have not verified, so the guide never appears on a
  site you do not control.
* Verified domains keep your app ID from being reused on another site under someone else's
  control.
* One clear allowlist gives you a single place to see — and trust — exactly where the guide
  can run.

## Local development

Local development origins are allowed outside production, so your test harness and local
builds boot without a verified domain. Production traffic must come from a hostname you have
added and verified here.

## Next steps

<CardGroup cols={2}>
  <Card title="Install Puntego" icon="code" href="/install">
    Add the boot script, then copy the canonical snippet for a verified domain.
  </Card>

  <Card title="Content Security Policy" icon="shield" href="/csp">
    Allow the worker and runtime under a strict CSP with a nonce.
  </Card>

  <Card title="Security" icon="lock" href="/security">
    See how origin checks fit the wider security model.
  </Card>

  <Card title="Boot errors" icon="triangle-alert" href="/errors">
    Read the boot responses, including origin\_not\_allowed for an unverified host.
  </Card>
</CardGroup>