Skip to main content

Add and validate a domain using Persistent DNS TXT record

Add a domain to CertCentral and use the Persistent DNS TXT record domain control validation (DCV) method to demonstrate control over the domain.

Notice

Note: Currently, Verified Mark (VMC) and Common Mark (CMC) certificates don’t support the Persistent DNS TXT DCV method. Use a different DCV method to validate domains for these certificates.

With this method, you create a persistent DNS TXT record for the domain, add the required persistent URI, and leave both the record and URI in place for future validations. After you add the persistent DNS TXT record and it’s publicly available, DigiCert checks the domain’s DNS TXT records for the required hostname and persistent URI.

Because the URI is persistent, you don’t need to create a new persistent DNS TXT record with a different URI each time you validate the domain. Keeping the persistent URI in place can make future validations faster, reduce manual DNS updates, and simplify certificate request workflows.

DigiCert can reuse the same persistent DNS TXT record for future domain validations when you continue using the Persistent DNS TXT record DCV method for that domain.

9-day domain validation reuse period

For this DCV method, the domain validation reuse period is nine days. Keep the persistent DNS TXT record in place so DigiCert can check the record again when you revalidate the domain. If DigiCert finds the required hostname and persistent URI, DigiCert can complete the domain validation without requiring you to create another DNS TXT record.

Warning

Important: Don’t delete the persistent DNS TXT record after the domain is validated. Keep the record and its persistent URI in place so you can reuse it for future persistent DNS TXT domain validations.

Before you begin

Before adding and validating the domain, make sure you have:

  • At least one organization added to your CertCentral account. When you add a domain, you must assign the domain to an organization. See Add an organization to CertCentral.

  • Access and permission to create or modify DNS TXT records for the domain.

Enable the Persistent DNS TXT record DCV method

DigiCert added the Persistent DNS TXT record DCV method to all CertCentral accounts but did not enable it by default. To use this new DCV method to validate your domains, you may need to enable it. If you don't enable it, the Persistent DNS TXT record DCV method won't appear as an option when adding and validating domains.

  1. In the CertCentral menu, go to Settings > Preferences.

  2. On the Preferences page, expand Advanced Settings.

  3. In the Domain Control Validation (DCV) section, select Persistent DNS TXT Record (Recommended).

  4. At the bottom of the page, select Save Settings.

Notice

Note: The Persistent DNS TXT record DCV method now appears as an option when validating your domains.

Step 1: Add the domain and select the DCV method

  1. In CertCentral, go to the Domains page and select New Domain.

    • Enterprise, Partner, and legacy accounts: In the left menu, go to Certificates > Domains.

    • Subscription accounts: In the left menu, go to Validation > Domains.

  2. On the New Domain page, under Domain details, complete the following fields:

    1. In the Domain name box, enter the domain name.

    2. In the Organization menu, select the organization you want to assign the domain to.

  3. Under Domain control validation (DCV) method, select Persistent DNS TXT Record.

  4. Select Submit for validation.

Step 2: Copy your persistent URI

  1. On the domain details page, in the Domain control validation (DCV) method section, go to User actions.

  2. Under User actions, CertCentral displays the Account URI by default.

    You can use the Account URI or the Unique URI.

    • Account URI lets you use the same persistent URI to validate any domain in your CertCentral account. Domain validation works for OV, EV, and DV TLS certificate orders.

    • Unique URI is specific to this domain. Use it when you don't want multiple domains to share the same public TXT value. Domain validation works for OV and EV TLS certificate orders; it can’t be used for DV TLS certificate orders.

    To change the persistent URI type:

    1. Next to Persistent URI type, select Edit.

    2. Select Account URI or Unique URI.

    3. Select Save.

  3. Under Your persistent URI, select Copy.

    You’ll add it to the persistent DNS TXT record in the next step.

Step 3: Create a persistent DNS TXT record for the domain

  1. Go to your DNS provider's site and create a persistent DNS TXT record for the domain.

    For provider-specific instructions, refer to your DNS provider’s documentation for creating or updating DNS TXT records.

  2. In the record Type field, or its equivalent, select TXT.

  3. In the Name field, sometimes labeled Host or Hostname, enter _validation-persist.

    Some DNS providers automatically append your domain name. Others may require the complete hostname, for example:

    _validation-persist.example.com

  4. In the Value field, sometimes labeled Content or TXT value, enter the persistent URI value you copied from CertCentral.

    Example:

    digicert.com; accounturi=https://digicert.com/account/{{your_persistent_uri_value}}

  5. Select a Time-to-Live (TTL) value or use your DNS provider's default TTL value.

  6. Save the persistent TXT record.

Step 4: Complete domain validation in CertCentral

You can run the validation check manually or wait for DigiCert's automatic DCV check, also called DCV polling, to validate the domain automatically.

  1. In CertCentral, return to the Domains page and in the Domain name column, select the domain link.

    • Enterprise, Partner, and legacy accounts: In the left menu, go to Certificates > Domains.

    • Subscription accounts: In the left menu, go to Validation > Domains.

  2. On the domain details page, in the Domain control validation (DCV) method section under User actions, select Check TXT.

What's next

Don’t delete the persistent DNS TXT record after the domain is validated. Keep the record and its persistent URI value in place so DigiCert can reuse it for future Persistent DNS TXT record DCV validations.

The validation reuse period for domains validated with the Persistent DNS TXT record DCV method is nine days.

After the nine-day reuse period ends, you must manually resubmit the domain for validation in CertCentral. DigiCert does not automatically revalidate the domain once the reuse period expires. Because the persistent DNS TXT record is already in place, you don't need to create a new record, you only need to resubmit the domain for validation.

Troubleshoot Persistent DNS TXT domain validation issues

If validation doesn't complete, confirm that the DNS TXT record is publicly resolvable and contains the exact persistent TXT value displayed in CertCentral.

Table 1. Common configuration issues

Issue

What to check

TXT record created on the wrong hostname

Confirm the hostname value matches the domain being validated.

Hostname value was omitted or misspelled

Confirm the hostname uses the following format: _validation-persist or _validation-persist.{{add_the_domain_name}}.

Some DNS providers automatically append your domain name. Others may require the complete hostname.

Persistent URI was copied incorrectly or modified

Copy the exact persistent URI from CertCentral without changing it.

Extra characters added to the record value

The TXT value field must contain just the persistent URI displayed in CertCentral.

DNS propagation incomplete

Allow time for DNS propagation before checking the record.


In this section: