Add krynox.net.domain-verification template

[fahmikemal]

Description

New template for Krynox (krynox.net) — a privacy-first, proof-of-work CAPTCHA service. The template lets a Krynox customer prove control of the domain they want to protect by adding the _krynox-challenge TXT record that Krynox checks, in one click via Domain Connect instead of copy-pasting DNS.

Single synchronous record: a _krynox-challenge TXT holding krynox-verify=%token%, where %token% is the one-time verification value Krynox generates per domain.

Type of change

• New template
• Bug fix (non-breaking change which fixes an issue in the template)
• New feature (non-breaking change which adds functionality to the template)
• Breaking change (fix or feature that would cause existing template behavior to be not backward compatible)

How Has This Been Tested?

• Template functionality checked using Online Editor
• Template file name follows the pattern <providerId>.<serviceId>.json
• resource URL provided with logoUrl is actually served by a webserver

Checklist of common problems

• syncPubKeyDomain is set — set to krynox.net; the public key is published at _dcpubkeyv1.krynox.net.
• warnPhishing is not set alongside syncPubKeyDomain — warnPhishing is not present.
• syncRedirectDomain is set whenever the template uses redirect_uri in the synchronous flow — N/A; the template has no redirect_uri, and applies are digitally signed so an unsigned open-redirect is not possible.
• no TXT record contains SPF content ("v=spf1 ...") — the only TXT is krynox-verify=%token%.
• txtConflictMatchingMode is set on every TXT record that must be unique — set to Prefix with txtConflictMatchingPrefix krynox-verify= so a re-apply replaces the verification record.
• no variable is used as a bare full record value — the TXT value is krynox-verify=%token%, not a bare %token%.
• no bare variable is used as the full host label — the host is the fixed label _krynox-challenge.
• no variable is used in the host field to create a subdomain — the host contains no variable.
• %host% does not appear explicitly in any host attribute — correct.
• essential is set to OnApply on records the end user may need to modify or remove — N/A; the verification TXT must remain in place (Krynox re-checks it), so it stays essential: Always.

Online Editor test results

Editor test link(s):

• Apex (host empty): Test krynox.net/domain-verification example.com/@
• Subdomain (host app): Test krynox.net/domain-verification example.com/app