What is a verified bot?

By Nik Andreev, Founder & SEO specialist · Last reviewed · Editorial policy

A verified bot is an automated client whose claimed identity has been confirmed, not just read from its user agent, using something only the real operator controls: forward-confirmed reverse DNS, the operator's published IP ranges, or a cryptographic Web Bot Auth signature. Verified means the name is genuine. It does not mean the bot is harmless or welcome.

At a glance

What it proves
The request really comes from the operator it names
What it does not prove
That the bot is useful, polite or welcome on your site
Verification methods
Web Bot Auth signature, forward-confirmed reverse DNS, published IP ranges
Weakest signal
The user agent alone. It is a claim, never a check.
Opposite
Spoofed (claims a name and fails its check) or unverified (no check available)

How it works

  • Signature first: if the request carries a Web Bot Auth signature, verify it against the operator’s published key. A valid signature names the operator, whatever the IP or user agent.
  • Then the network: for operators that document it, run forward-confirmed reverse DNS, or check the source IP against their published IP ranges.
  • Then decide: a bot that passes is verified. One that claims a known name and fails is spoofing it. One with no check available stays unverified.

Verified is not the same as allowed

A verified GPTBot is genuinely OpenAI’s training crawler, and you may still choose to block it. Verification answers “is this really who it says?” Your robots.txt and firewall rules answer “do I want it here?” Keep the two decisions separate.

The three ways to verify

Signed agent Proves its identity with a cryptographic signature on each request, from any IP. FCrDNS Reverse DNS plus a forward lookup that must return the same IP. Used by Google and Bing. Published IP ranges The operator's own list of addresses, used by OpenAI and also offered by Google.

Quick answers

Should I allow every verified bot?

Not automatically. Verification tells you who is visiting. Whether to allow it is your policy, for example via robots.txt or a firewall rule.

Is a bot that fails verification always malicious?

No. Many small bots publish no DNS, IP list or key, so they cannot be verified at all. Unverified is different from spoofed.

Which check is strongest?

A valid Web Bot Auth signature, because it is tied to a private key rather than to network addresses that change. Few bots sign yet, so keep DNS and IP checks as fallbacks.

Sources