# ENS Subdomain Authentication: How to configure your wallet

By [Soleone](https://paragraph.com/@soleone) · 2022-07-30

---

![How to avoid connecting cold wallets directly to apps for proving ownership.](https://storage.googleapis.com/papyrus_images/0e737f59686cb4bb6c35e3c6590fcb317c5f277345d1acda969dae9bfbd5abcb.jpg)

How to avoid connecting cold wallets directly to apps for proving ownership.

The brand new ENS Subdomain Authentication standard ([EIP-5131](https://eips.ethereum.org/EIPS/eip-5131)) by [Wilkins](https://twitter.com/wwhchung) can drastically increase the security and convenience for users trying to prove ownership of their assets:

> Rather than ‘re-invent the wheel’, this proposal aims to use the widely adopted Ethereum Name Service in order to bootstrap a safer and more convenient way to sign and authenticate, and provide ‘read only’ access to a main wallet via one or more secondary wallets.
> 
> From there, the benefits are twofold. This EIP gives users increased security via outsourcing potentially malicious signing operations to wallets that are more accessible (hot wallets), while being able to maintain the intended security assumptions of wallets that are not frequently used for signing operations.

We’re still waiting for service providers like tokengating or NFT minting apps to implement this standard, but you can prepare your wallet today to be ready immediately once support for this “proxy wallet” method is widely rolled out.

After you configured the steps below you can use e.g. [this simple Javascript app](https://qlvbtd.csb.app/) and connect with MetaMask on the hot wallet to verify that the link to your main wallet is set up correctly.

Prerequisites
-------------

*   Own an ENS domain
    
*   Both main and auth wallet have enough gas available to pay for a total of three transactions.
    
*   Total gas fees at 20 gwei: 0.005 ETH
    

1\. Create the auth subdomain
-----------------------------

Logged into wallet account (e.g. MetaMask) with the address controlling your ENS domain (“main address”)

![Create a new subdomain called “auth” on your main wallet’s ENS](https://storage.googleapis.com/papyrus_images/5fc54d95d4fe595e7c1c71b988de9a1e2cfe421c631ae12ae24fa2bcbff22a84.png)

Create a new subdomain called “auth” on your main wallet’s ENS

1.  Visit [https://app.ens.domains](https://app.ens.domains/)
    
2.  Click on My Account on the top right
    
3.  Click on your .eth ENS domain at the bottom
    
4.  Click on Subdomains on the top right
    
5.  Click the + Add Subdomain button
    
6.  Simply enter `auth` as the label for the subdomain
    
7.  Click the Save button
    
8.  Sign the on-chain transaction and pay the gas fee
    

Cost: 0.0014 ETH (at 20 gwei)

2\. Set the ETH resolver on your auth subdomain to your hot wallet (“auth address”)
-----------------------------------------------------------------------------------

![ENS: Link the hot wallet address on the new auth subdomain](https://storage.googleapis.com/papyrus_images/a2e99149049ade2738548b233b03c6a03e21f647fccf2b0d58cc722b06eda113.png)

ENS: Link the hot wallet address on the new auth subdomain

Logged into wallet account (e.g. MetaMask) with the address controlling your ENS domain (“main address”)

1.  Click on your new auth subdomain (see step 1.1 to 1.4)
    
2.  In the Records section click the Add/Edit Record button
    
3.  In the ETH field enter your hot wallet address
    
4.  Click the Save Button
    
5.  Sign the on-chain transaction and pay the gas fee
    

Cost: 0.0012 ETH (at 20 gwei)

3\. Set the ETH resolver on your hot wallet to the main address auth subdomain
------------------------------------------------------------------------------

![ENS: Select your main address auth subdomain in the dropdown](https://storage.googleapis.com/papyrus_images/8ae6510a314490a57bd3fc2c8bf1b2358ce05dd8804ebfb52b41b3ecd4e15d62.png)

ENS: Select your main address auth subdomain in the dropdown

Logged into wallet account (e.g. MetaMask) with the hot wallet address (“auth address”)

1.  Visit [https://app.ens.domains](https://app.ens.domains/)
    
2.  Click on My Account on the top right
    
3.  Click on Primary ENS Name (reverse record)
    
4.  In the dropdown should be only one value to select, click on your main address auth subdomain
    
5.  Click the Save Button
    
6.  Sign the on-chain transaction and pay the gas fee
    

Cost: 0.0024 ETH (at 20 gwei)

---

*Originally published on [Soleone](https://paragraph.com/@soleone/ens-subdomain-authentication-how-to-configure-your-wallet)*