Validate domains on a pending OV or EV TLS certificate using Persistent DNS TXT record

Use the Persistent DNS TXT record domain control validation (DCV) method to demonstrate control over a domain on a pending OV or EV TLS certificate order..

With this method, you create a persistent DNS TXT record for the domain, add the required persistent URI, and leave both the record and URI in place for future validations. After the persistent DNS TXT record is added and publicly available, DigiCert checks the domain’s DNS TXT records for the required hostname and persistent URI.

Because the URI is persistent, you don’t need to create a new persistent DNS TXT record with a different URI each time you validate the domain. Keeping the persistent URI in place can make future validations faster, reduce manual DNS updates, and simplify certificate request workflows.

DigiCert can reuse the same persistent DNS TXT record for future domain validations when you continue using the Persistent DNS TXT record DCV method for that domain..

Warning

Important: Don’t delete the persistent DNS TXT record after the domain is validated. Keep the record and its persistent URI in place so DigiCert can reuse it for future persistent DNS TXT domain validations.

Before you begin

Before validating the domains, make sure you have access and permission to create or modify DNS TXT records for each domain on the certificate.

Step 1: Select the Persistent DNS TXT Record DCV method

In CertCentral, go to the certificate's Order # details page.
- For Enterprise, Partner, and Legacy retail accounts: In the left main menu, go to Certificates > Orders. On the Orders page, in the Order # column, select the certificate's order number link.
- For CertCentral Subscription accounts: In the left main menu, go to My Digital Trust Products > Certificates. On the Certificates page, in the Order # column, select the certificate's order number link.
On the certificate’s Order # details page, in the Certificate status section, check whether the certificate is waiting for domain validation to be completed.
Under What do you need to do, select the link for the domain you want to validate.
In the Prove control over domain window, in the Domain control validation (DCV) method menu, select Persistent DNS TXT Record and then select Save.

Step 2: Copy your persistent URI

In the Prove control over domain window, go to 3. Add the DigiCert-provided persistent TXT value.
By default, CertCentral displays the Account URI.
The Account URI lets you use the same persistent URI to validate any domain in your CertCentral account. Select this option for ease of management when you want to use the same TXT value across all your domains.
You can use the Account URI or change the persistent URI type and use the Unique URI.
The Unique URI is specific to this domain. Use it when you don’t want multiple domains to share the same public TXT value. This helps prevent publicly linking your domains through DNS records.
To change the persistent URI type:
1. Select Edit.
2. Select Account URI or Unique URI.
3. Select Save.
Under Your persistent URI, select Copy.
You’ll add it to the persistent DNS TXT record in the next step.

Step 3: Create a persistent DNS TXT record for the domain

Go to your DNS provider's site and create a persistent DNS TXT record for the domain.
For provider-specific instructions, refer to your DNS provider’s documentation for creating or updating DNS TXT records.
In the record Type field, or its equivalent, select TXT.
In the Name field, sometimes labeled Host or Hostname, enter _validation-persist.
Some DNS providers automatically append your domain name. Others may require the complete hostname, for example:
_validation-persist.example.com
In the Value field, sometimes labeled Content or TXT value, enter the persistent URI value you copied from CertCentral.
Example:
```
digicert.com; accounturi=https://digicert.com/account/{{your_persistent_uri_value}}
```
Select a Time-to-Live (TTL) value or use your DNS provider's default TTL value.
Save the persistent TXT record.

Step 4: Complete domain validation in CertCentral

You can run the validation check manually or wait for DigiCert's automatic DCV check, also called DCV polling, to validate the domain automatically.

In CertCentral, return to the certificate’s Order # details page.
- For Enterprise, Partner, and Legacy retail accounts: In the left main menu, go to Certificates > Orders. On the Orders page, in the Order # column, select the certificate's order number link.
- For CertCentral Subscription accounts: In the left main menu, go to My Digital Trust Products > Certificates. On the Certificates page, in the Order # column, select the certificate's order number link.
In the Certificate status section, under What do you need to do, select the domain link.
In the Prove control over domain window, go to 5. Complete domain validation and select Check record.

What's next

Don't delete the persistent DNS TXT records after DigiCert validates the domain. Keep the records in place so DigiCert can use it for future domain validations.

The validation reuse period for domains validated with the Persistent DNS TXT record DCV method is nine days.

After the reuse period ends, DigiCert can check the domain’s persistent DNS TXT record again if you’re using the Persistent DNS TXT record DCV method. If DigiCert finds the required hostname and persistent URI, it completes the domain validation without requiring you to create a new DNS TXT record.

Troubleshoot Persistent DNS TXT domain validation issues

If validation doesn't complete, confirm that the DNS TXT record is publicly resolvable and contains the exact persistent TXT value displayed in CertCentral.

Table 1. Common configuration issues

Issue	What to check
TXT record created on the wrong hostname	Confirm the hostname value matches the domain being validated.
Hostname value was omitted or misspelled	Confirm the hostname uses the following format: `_validation-persist` or `_validation-persist.{{add_the_domain_name}}`. Some DNS providers automatically append your domain name. Others may require the complete hostname.
Persistent URI was copied incorrectly or modified	Copy the exact persistent URI from CertCentral without changing it.
Extra characters added to the record value	The TXT value field must contain just the persistent URI displayed in CertCentral.
DNS propagation incomplete	Allow time for DNS propagation before checking the record.

In this section: