Supported domain control validation (DCV) methods for domain prevalidation
Domain prevalidation: DCV methods
Industry standards prevent Certificate Authorities (CAs), such as DigiCert, from issuing your TLS/SSL certificate until you demonstrate control over the fully qualified domain names (FQDNs) and IP address on the certificate order. We refer to this process as the Domain Control Validation (DCV) process.
DigiCert currently supports these DCV Methods:
Email
Email to DNS TXT contact
Constructed Email
WHOIS-based Email
DNS CNAME
DNS TXT
HTTP Practical Demonstration
HTTP Practical Demonstration with unique filename
To validate your domains, you can prevalidate your domains or complete the DCV as part of the certificate request process. Per industry standards, a domain's validation is valid for 397 days (approximately 13 months).
Domain prevalidation
CertCentral features a domain prevalidation process that allows you to validate your domains before you begin ordering certificates for them. Completing the domain validation ahead of time allows for quicker certificate issuance.
For immediate certificate issuance, Domain prevalidation is required. See OV/EV certificate immediate issuance.
Important
DV certificates don't support domain prevalidation. Therefore, each time you order a DV certificate, you must demonstrate control over the domains on the order. After placing your order, you need to complete domain validation before DigiCert can issue your DV certificate. See .
Demonstrating control over domains on DV/OV/EV TSL/SSL certificate orders
When ordering a certificate, you select a DCV method to demonstrate control over the domains on the order. On the certificate's Order details page, use the DCV method selected during the order process to complete the domain validation. You can always switch validation methods if needed. See Demonstrate control over domains on a pending certificate order.
Email DCV method
With this validation method, DigiCert sends three sets of DCV emails: DNS TXT-based, constructed, and WHOIS-based.
To demonstrate control over the domain, an email recipient follows the instructions in a confirmation email sent for the domain. The confirmation process consists of visiting the link provided and following the instructions on the confirmation page.
Note: DigiCert sends this email from no-reply@digitalcertvalidation.com. If using allowlist, make sure to include digitalcertvalidation.com.
See Add a domain and validate it using the Email DCV method.
Important
End of life for the WHOIS-based email
The industry is moving away from using WHOIS to identify domain contacts. DigiCert recommends that those using the WHOIS-based Email DCV method update their domain validation processes to use one of the other supported DCV methods as soon as possible.
If you still want to use the Email DCV method, use the Email to DNS TXT contact or the Constructed email method.
To learn more about the end of life for WHOIS-based email, see our knowledge base article, End of Life for WHOIS based email DCV method.
Email to DNS TXT contact
To use Email to DNS TXT contact, make sure to choose the Verification email DCV method when validating your domain.
For the email to DNS TXT contact DCV method, DigiCert sends an authorization email to the email addresses found in the DNS TXT record on the _validation-contactemail
subdomain of the domain being validated.
DNS TXT record email contacts
Place the DNS TXT record on the _
validation-contactemail
subdomain of the domain you want to validate. The RDATA value of this text record must be a valid email address.
Name | TTL | Message |
---|---|---|
| Default | validatedomain@digicerttest.com |
DigiCert recommends adding a distribution list rather than a personal email address. A distribution list allows you to create a "non-expiring" email address that you can add or remove people from when necessary.
Constructed email
For the Constructed Email method, DigiCert sends the authorization email to five constructed email addresses for the domain: admin, administrator, webmaster, hostmaster, and postmaster @[domain_name].
If we can't find an MX record for [domain_name], you must use one of the other supported DCV methods to demonstrate your control over the domain. See MX records (mail exchanger records) below.
Background
When registering a domain, you must provide contact information, such as administrative and technical contacts. Instead of using a personal email address, you can use one of the constructed email addresses for your domain, such as webmaster@yourdomain. Using a constructed email address allows you to create a "non-expiring" email address that you can add or remove people from when necessary.
MX records (mail exchanger records)
Before DigiCert can successfully send an authentication DCV email to the domain owner (or domain controller), we must verify that an MX record (a resource record in the Domain Name System [DNS]) exists in the DNS records of the recipient's domain name. The presence of valid MX records enables us to send the authentication email.
For example, you want to receive your DCV email at one of the constructed email addresses for example.com, admin@example.com. To successfully receive a DCV Email at admin@example.com, we must first find an MX record for the address that identifies the server (for example, mailhost.example.com) set up to receive the emails destined for admin@example.com.
WHOIS-based email
For the WHOIS-based method, DigiCert sends an authorization email to the registered owners of the public domain as shown in the domain's WHOIS record.
Are you expecting to receive an email at an address published in your domain’s WHOIS record?
Verify that your registrar/WHOIS provider has not masked or removed that information. If the information is masked, find out if they provide a way (such as anonymized email address, web form) for you to allow Certificate Authorities (CAs) to access your domain’s WHOIS data.
DNS TXT DCV method
Add a DigiCert generated random value (provided for the domain in your CertCentral account) to the domain’s DNS as a TXT record. When DigiCert does a search for a DNS TXT record associated with the domain, we can find a record that includes the DigiCert generated random value.
See Add a domain, authorize the domain for certificates, and use DNS TXT as the validation method.
DNS CNAME DCV method
Add a DigiCert-generated random value (provided for the domain in your CertCentral account) to the domain’s DNS as a CNAME record.Then, add dcv.digicert.com as the CNAME target. When DigiCert does a search for a DNS CNAME record associated with the domain, we can find a record that includes the DigiCert generated random value.
HTTP Practical Demonstration and HTTP Practical Demonstration with unique filename DCV methods
You can only use the HTTP Practical Demonstration DCV methods to demonstrate control over fully qualified domain names (FQDNs) exactly as named. To learn more, visit Domain Validation Policy Changes.
Use one of the other supported DCV methods, such as email, DNS TXT, and CNAME, to:
Validate wildcard domains, such as *.example.com.
Include subdomains in the validation when validating a higher-level domain. For example, if you want to cover www.example.com, mail.example.com, and one.example.com when validating the higher-level domain example.com.
Validate entire domains and subdomains.
HTTP Practical Demonstration
Host a file containing a DigiCert generated random value (provided for the domain in your CertCentral account) at a predetermined location on your website: http://{domain-name}/.well-known/pki-validation/fileauth.txt
.
After you've created the file and placed it on your site, DigiCert visits the specified URL to confirm the presence of our random value. See Add a domain and validate it using HTTP practical demonstration.
HTTP Practical Demonstration with unique filename
Host a file with a random filename that contains a DigiCert-generated random value (provided for the domain in your CertCentral account) at a predetermined location on your website: http://{domain-name}/.well-known/pki-validation/{unique-filename}.txt
.
After you've created the file and placed it on your site, DigiCert visits the specified URL to confirm the presence of our random value. See Add a domain and validate it using HTTP practical demonstration with unique filename as the validation method.
Warning
DV TLS certificates do not support the HTTP Practical Demonstration with unique filename DCV method.