Skip to main content

Validate domains using DNS validation methods

DigiCert supports three DNS-based domain control validation (DCV) methods:

  • Persistent DNS TXT record

  • DNS TXT record

  • DNS CNAME record

Use the DNS-based DCV method that best fits how you manage DNS records.

The Persistent DNS TXT record method is designed for repeat validation. The DNS TXT record and DNS CNAME record methods use DigiCert-generated random values that expire after 30 days. With these methods, you must create a new DNS record each time you validate or revalidate the domain.

Before you begin

Before using DNS validation, confirm the following:

  • You have access to the domain's DNS zone

  • You can create or modify DNS TXT or CNAME records for the domain

  • You have at least one organization in your CertCentral account and the domain is assigned to it

  • For OV, EV, Private TLS/SSL, and Secure Email certificates, the organization is submitted for organization validation before you add the domain

Persistent DNS TXT record

Use the Persistent DNS TXT record DCV method to validate a domain by adding a DigiCert-provided persistent URI to the domain’s DNS as a persistent TXT record.

With this method, DigiCert validates the domain by checking for a DNS TXT record that contains the DigiCert-provided persistent URI value.

You don’t need to create a new DNS record with a different URI every time you validate a domain. Keeping the DNS TXT record and persistent URI in place makes future validations easier and reduces manual DNS updates.

DNS TXT record

Use the DNS TXT record DCV method to validate a domain by adding a DigiCert-generated random value to the domain’s DNS as a TXT record.

With this method, DigiCert validates the domain by checking for a DNS TXT record that contains the DigiCert-generated random value.

The random value expires 30 days after it’s generated. Create a new DNS TXT record each time you validate or revalidate a domain.

DNS CNAME record

Use the DNS CNAME record DCV method to validate a domain by adding a DigiCert-provided URL to the domain’s DNS as a CNAME record. The URL includes a DigiCert-generated random value.

With this method, DigiCert validates the domain by checking for a DNS CNAME record that contains the DigiCert-generated random value.

The random value expires 30 days after it’s generated. Create a new DNS CNAME record each time you validate or revalidate a domain.

In this section: