How-to
Verify your address
Updated
On this page
Load, stress, scalability and endurance tests, SQL injection scans and payment idempotency tests send heavy or probing traffic. Address proof for these tests is turned off for now: when you start one yourself, it runs on any address you enter, with nothing to prove and no box to tick. Schedules still can't run them. Zof will turn address proof back on, and then sends that traffic only to an address you've proven belongs to your company.
When address proof is on, proving an address takes about 2 minutes, once per address, and you do it inside the New run wizard. The rest of this page describes how it works then.
While address proof is off
- New run shows no Proof needed tag on these tests, no Prove the address step in Options and no I'm authorized to test tick. Select all ticks them like any other test.
- They start as soon as you choose Create run, so make sure the address you enter is one you may send heavy or probing traffic to.
- The same holds when you start one from its agent's own page or from a Copilot card.
- A test that still shows Waiting for proof from before has just Run now, with nothing to prove.
- Schedules still can't run them: Schedule is off while one is selected.
Why Zof asks when it's on
Heavy traffic can slow a site down, and injection probes can look like an attack. Proving the address keeps Zof from sending that traffic to someone else's site. Light checks, such as a Smoke test, never need it.
Verified by your deployments
When your connected repository's own GitHub deployments reported the address in the last 90 days, it's already proven. The Run page shows Verified from your GitHub deployments, and you don't need to do anything.
If the panel says Not found in your repo's deployments or Couldn't check your repo's deployments right now, prove the address with a verification file or, if you can't add one, a DNS record.
Add a verification file
- In New run, tick a test marked Proof needed, such as Load test. In the Options step, Prove the address shows your address as Not yet. Open Prove the address, then run it.
- Select Copy or Download file. The file holds one line that starts with
zof-verify=. - Put the file on your site at
/.well-known/zof-verification.txt, for examplehttps://dev.example.com/.well-known/zof-verification.txt, served as plain text. - Select Check now.
Leave the file in place. Zof reads it again each time a heavy test runs, so nothing about it is stored. The line works only for your company and that exact address.
Use a DNS record instead
If you can't add a file, open Can't add a file? in the panel. Add a TXT record with the name and value it shows, such as _zof-verification.dev.example.com, then select Check DNS. DNS changes can take a few minutes to appear.
Check that it worked
The address shows Proven ✓, and its tests show Runs now in the review. A test you started before the address was proven shows Waiting for proof on the run's page: once the address is proven, tick the box and choose Run now. If Zof can't confirm the proof then, the page says the address isn't proven yet and checks it again.
If a check fails
| The panel says | What to do |
|---|---|
| We got a 404 at the file's address | Put the file at that exact address, then check again. |
| The file is there but the code doesn't match | Copy the line again, replace the file, then check again. |
| Your site didn't answer in 5 seconds | Check that the site is up and public, then try again. |
| The address redirects to another address | Serve the file at that exact address, with no redirect to another site. |
| Too many checks for this address | Wait the time it names, then try again. |
Before a heavy run
While address proof is on, tick I'm authorized to test the address to say you may test it, then run it. Zof records who confirmed and when. When you choose Run again on a single heavy test, its last step also names what will be sent and where, for example "Send up to 50 users for 5 minutes to https://dev.example.com/products."
Load and endurance tests can slow an address down for real users. Stress and scalability require a staging or performance environment; production is not offered as a manual run target. The review shows the traffic plan, acceptance limits and maximum duration before you start.
These tests run on demand only, with address proof on or off. A schedule fires later, with no one to confirm it, so Schedule is off while a load or security test is selected.
Payment idempotency tests
A payment idempotency test also needs a payment test mode on the verified address. That is either a payment lab that declares itself a simulation, or your company's payment test-mode adapter, which must confirm test mode with test data on every run. The agent checks this itself: it uses only its own zof-test- keys and refuses live keys. Without a test mode, its checks read Couldn't check, never a pass. The card says "Needs a payment test mode"; hover it for the full reason. A company admin sees Set up payment test mode on the card instead, which opens the page to set up the company's payment test-mode adapter.