The version with nobody in the middle
Use a domain
you already own
A payment name does not have to live on our domain. If you own one, the name can be
you@yourdomain.com and we are not in it anywhere. This page builds the exact
record, tells you where to paste it, and checks it properly once it is live.
This is strictly better than a name on ours, and we would rather say so than sell you something. We run silentpayments.net, so we could repoint any name on it at our own address and every wallet would validate the theft. On your domain that power is yours.
Nothing on this page publishes anything. We have no access to your DNS, we store no address you type here, and the only record that ever exists is the one you paste into your own zone. The three tools below are a builder, a checker and a proof, and only the third writes a single row anywhere.
§ 01 · Build the record
What to paste into your DNS
Fill this in and you get one TXT record. Every field is checked by the same code that guards a real claim on our own domain, so anything this accepts is something we would publish ourselves.
In a DNS panel with a Name box
Cloudflare, Namecheap, most registrars. They add the domain for you, so paste only:
Pasting the whole name here is the single most common mistake, and it produces
alice.user._bitcoin-payment.example.com.example.com, which resolves to
nothing and looks exactly like this service being broken.
In a zone file
BIND, Knot, anything you edit by hand:
One character-string per 255 bytes if your server does not split it for you. A reader joins them in order with nothing between them.
The same record as a code
Drawn in your browser from what you typed. It never leaves this page, and it is only worth anything once the record is actually published.
§ 02 · Check it
Will a wallet actually pay it?
Paste any payment name, on any domain, ours or anyone else's. We ask two independent resolvers, validate the contents, and report every check separately instead of showing you one green tick.
The check that matters most is DNSSEC. A BIP-353 wallet is required to refuse an answer it could not validate, and validation is done by your zone, not by us. That is the whole reason a name on your own domain beats a name on ours: nothing about it depends on our honesty.
- Record
- Published value
- Resolvers
The same answer without our JavaScript, and without our opinion of it:
curl -s 'https://silentpayments.net/api/verify?name=alice@example.com'
# and the underlying lookup, validated to the root, with nothing of ours involved
delv TXT alice.user._bitcoin-payment.example.com
§ 03 · Prove the domain is yours
Optional, and it buys exactly one thing
Read this before you bother
Proving you control the domain does not make your payment name more trustworthy. DNSSEC on your own zone already does that, completely, whether we have ever heard of you or not. The only thing this proof buys is a line in our directory, so people browsing it can find you.
We are saying that plainly because the opposite is the normal move in this industry: put a badge on a page, imply the badge is what makes it safe, and become load-bearing. A payment name on your domain is not ours to vouch for and we are not going to pretend it is.
Publish this second record
- Name
- Type
- TXT
- TTL
- 300
- Value
In a panel with a Name box, paste as the name.
The value is sp-verify= and an HMAC of your domain under a key only this
service holds. It is derived, not issued: there is no pending-challenge table here and
nothing expires, because holding the token grants nothing. What it proves is that
whoever answers DNS for that domain right now put it there, and that is
re-checked live every time it is used.
Removing a listing needs the same proof as adding one. Otherwise anyone could quietly delete somebody else's entry.
Proved
What we store, in full
- The name, and the domain it is on.
- Whether you asked to be listed.
- Whether the record carried Lightning or Cashu, so the directory can say so.
- The date the proof succeeded.
Not the address. Not an email. Not an account, because there is no account. A proof goes stale after 90 days and the entry drops out of the directory on its own, because a listing is a claim about the present and domains change hands. Re-proving is one click.
None of this goes into the change log, on purpose. That log records changes we made to records we publish, and it is only worth reading because it answers exactly one question. We publish nothing for a name on your domain and can change nothing about it, so there is no act of ours to record, and padding the log with entries we did not cause would weaken the only signal it carries.
The whole thing from a terminal
curl -s -X POST https://silentpayments.net/api/record \
-H 'content-type: application/json' \
-d '{"username":"alice","domain":"example.com","address":"sp1q…"}'
# paste the record into your own DNS, then
curl -s 'https://silentpayments.net/api/verify?name=alice@example.com'
# optional, and only for the directory listing
curl -s 'https://silentpayments.net/api/domain/challenge?domain=example.com'
curl -s -X POST https://silentpayments.net/api/domain/verify \
-H 'content-type: application/json' \
-d '{"name":"alice@example.com","listed":true}'
# who else is listed on their own domain
curl -s https://silentpayments.net/api/domains
/api/record and /api/verify write nothing anywhere and need no
credential of any kind. They are the two you would want to run yourself, and the
StartOS package is the
version where you do not have to ask us at all.