Mara only emits traffic to verified scope rows. There is no override.
DNS TXT method
Add a TXT record at _mara.<your-domain> with the challenge token.
Well-known method
Serve the token as the body of /.well-known/mara-auth.txt over HTTPS.
Egress proxy
Every outbound HTTP from the sandbox flows through the scope-proxy. Out-of-scope requests are dropped with a 451 and a scan_event row of kind blocked.