Objective

AI Agent & Bot Detection identifies non-human traffic, AI agents, bots, and device farms, at sensitive points in your user flow such as signup, login, password reset, and checkout. This article walks you through the guided setup: reviewing the rules Twilio manages for you, and optionally putting the detection on your own domain.

Product

Fraud Risk Engine

Environment

Twilio Console

User Account Permission/Role(s) Required

Your user needs permission to manage Fraud Risk Engine domains on this account. Without it, the custom domain steps are unavailable and only the rule review applies.

Procedure

1. In the Twilio Console, select Identity & security in the left sidebar.
2. Select Fraud Risk Engine, then Overview.
3. Select Get started. You can also reach the same setup from Use Cases › AI Agent & Bot Detection by selecting Get started there, or from the Set up AI Agent & Bot Detection card on the Overview page.
4. On the Review & add rules step, review the AI Agent & Bot Detection rules Twilio proposes for your account. Each row shows the rule name and description, its intelligence source, and the decision it returns. Search the list if you need to find a specific rule.
5. Select Next to move to Add custom domain (Optional) and choose one:
6. Use the provided default domain, Twilio has already set up a domain for your account, so you can move forward right away. There is nothing further to configure.
7. Provide your own custom domain, enter your domain, for example login.your-domain.com. This reduces interference from ad-blocker plugins and privacy browsers.
8. If you entered your own domain, on Choose DNS configuration method select how you'll prove ownership:
9. Connect to your provider sign in to your DNS provider and let it configure the record for you. This option only appears when your provider supports it, and names the provider when it is known.
10. Manual, add the DNS records yourself through your provider.
11. I'm not sure, Twilio gives you instructions you can send to your administrator or IT team.
12. On Verify domain, follow the method you picked. For Manual, add the A record, the CNAME record, and the CAA record shown, using the copy control beside each value. For I'm not sure, select Send these instructions or Copy message to hand the records to whoever manages your DNS.
13. Select Add rules & continue. Twilio adds the rules and reports how many were added. If you also entered a custom domain, it is registered at this point and begins verification.

Additional Information

• The domain steps are skipped automatically when they don't apply. If your account already has a custom domain, the step is disabled with Custom domain already configured.; if the default domain is still being set up, it shows Your default domain is still being set up, the rules can still be added either way.
• Avoid terms like "telemetry" in your subdomain, ad-blockers commonly block them.
• Registering the domain is only half the job. Update your client configuration to load the detection script from your custom domain, or traffic keeps going to the old host.
• Custom domain verification can take up to 48 hours after your DNS records are in place.
• After setup, you can adjust the rules Twilio added, or write your own, from Rule Management.
• Each evaluation returns one recommended decision, allow, challenge, or block, plus every rule that triggered, so you can always explain why something was blocked. What happens next stays under your control.

This content was generated by AI and reviewed, edited, and verified by a human.