--- title: "silentpayments.net · Your own domain" description: "Put a payment name on a domain you already own. We build the exact TXT record, check it once it is live, and can prove you control the domain. We publish nothing and hold nothing." url: "https://silentpayments.net/own-domain" language: "en" --- > Put a payment name on a domain you already own. We build the exact TXT record, check it once it is live, and can prove you control the domain. We publish nothing and hold nothing. _This page has three detail levels in HTML: Easy, Advanced and Cypherpunk._ _This twin carries the Advanced and Cypherpunk text, which is the complete version._ The version with nobody in the middle # Use a domain you already own A payment name does not have to live on our domain. If you own one, the name can be `you@yourdomain.com` and we are not in it anywhere. This page builds the exact record, tells you where to paste it, and checks it properly once it is live. **This is strictly better than a name on ours**, and we would rather say so than sell you something. We run silentpayments.net, so we could repoint any name on it at our own address and every wallet would validate the theft. On your domain that power is yours. Nothing on this page publishes anything. We have no access to your DNS, we store no address you type here, and the only record that ever exists is the one you paste into your own zone. The three tools below are a builder, a checker and a proof, and only the third writes a single row anywhere. § 01 · Build the record ## What to paste into your DNS Fill this in and you get one TXT record. Every field is checked by the same code that guards a real claim on our own domain, so anything this accepts is something we would publish ourselves. The name you wantThe local part. Our five character floor and our reserved list do not apply here: on your domain, `admin` and `bob` are your call. Only the spelling rules DNS and BIP-353 actually impose are enforced. Your domainUse the ASCII form. An accented domain has an `xn--` spelling and that is what DNS carries. Silent payment addressCopy it from your wallet. It starts `sp1` and runs to about 116 characters. Lightning offer _optional_A BOLT 12 offer. One name then pays on chain or over Lightning and the payer's wallet picks. Cashu request _optional_A `creqb1` from your Cashu wallet, or just a mint URL and we encode it. Build the record ### Your record - **Name**: - **Type**: TXT - **TTL**: 300 - **Value**: Copy the valueCopy as a zone file line Check it once it is live #### In a DNS panel with a Name box Cloudflare, Namecheap, most registrars. They add the domain for you, so paste only: Pasting the whole name here is the single most common mistake, and it produces `alice.user._bitcoin-payment.example.com.example.com`, which resolves to nothing and looks exactly like this service being broken. #### In a zone file BIND, Knot, anything you edit by hand: One character-string per 255 bytes if your server does not split it for you. A reader joins them in order with nothing between them. #### The same record as a code Save the image Drawn in your browser from what you typed. It never leaves this page, and it is only worth anything once the record is actually published. § 02 · Check it ## Will a wallet actually pay it? Paste any payment name, on any domain, ours or anyone else's. We ask two independent resolvers, validate the contents, and report every check separately instead of showing you one green tick. The check that matters most is DNSSEC. A BIP-353 wallet is required to refuse an answer it could not validate, and validation is done by **your zone**, not by us. That is the whole reason a name on your own domain beats a name on ours: nothing about it depends on our honesty. Payment name Check this name - **Record**: - **Published value**: - **Resolvers**: The same answer without our JavaScript, and without our opinion of it: ``` curl -s 'https://silentpayments.net/api/verify?name=alice@example.com' # and the underlying lookup, validated to the root, with nothing of ours involved delv TXT alice.user._bitcoin-payment.example.com ``` § 03 · Prove the domain is yours ## Optional, and it buys exactly one thing #### Read this before you bother Proving you control the domain does **not** make your payment name more trustworthy. DNSSEC on your own zone already does that, completely, whether we have ever heard of you or not. The only thing this proof buys is a line in [our directory](https://silentpayments.net/directory), so people browsing it can find you. We are saying that plainly because the opposite is the normal move in this industry: put a badge on a page, imply the badge is what makes it safe, and become load-bearing. A payment name on your domain is not ours to vouch for and we are not going to pretend it is. Your payment name Show me the record to publish #### Publish this second record - **Name**: - **Type**: TXT - **TTL**: 300 - **Value**: Copy the value In a panel with a Name box, paste `` as the name. The value is `sp-verify=` and an HMAC of your domain under a key only this service holds. It is derived, not issued: there is no pending-challenge table here and nothing expires, because holding the token grants nothing. What it proves is that whoever answers DNS for that domain _right now_ put it there, and that is re-checked live every time it is used. I have published it, check nowRemove my listing Removing a listing needs the same proof as adding one. Otherwise anyone could quietly delete somebody else's entry. ### Proved ### What we store, in full - The name, and the domain it is on. - Whether you asked to be listed. - Whether the record carried Lightning or Cashu, so the directory can say so. - The date the proof succeeded. Not the address. Not an email. Not an account, because there is no account. A proof goes stale after 90 days and the entry drops out of the directory on its own, because a listing is a claim about the present and domains change hands. Re-proving is one click. None of this goes into the [change log](https://silentpayments.net/log), on purpose. That log records changes _we_ made to records _we_ publish, and it is only worth reading because it answers exactly one question. We publish nothing for a name on your domain and can change nothing about it, so there is no act of ours to record, and padding the log with entries we did not cause would weaken the only signal it carries. ## The whole thing from a terminal ``` curl -s -X POST https://silentpayments.net/api/record \ -H 'content-type: application/json' \ -d '{"username":"alice","domain":"example.com","address":"sp1q…"}' # paste the record into your own DNS, then curl -s 'https://silentpayments.net/api/verify?name=alice@example.com' # optional, and only for the directory listing curl -s 'https://silentpayments.net/api/domain/challenge?domain=example.com' curl -s -X POST https://silentpayments.net/api/domain/verify \ -H 'content-type: application/json' \ -d '{"name":"alice@example.com","listed":true}' # who else is listed on their own domain curl -s https://silentpayments.net/api/domains ``` `/api/record` and `/api/verify` write nothing anywhere and need no credential of any kind. They are the two you would want to run yourself, and the [StartOS package](https://github.com/bitsagarob/payment-name-startos) is the version where you do not have to ask us at all.