Use DigiCert-supported domain control validation (DCV) methods
Select a DCV method that aligns with your environment, infrastructure, and automation requirements. DigiCert supports the following DCV methods:
DCV type | DCV methods |
|---|---|
Email-based | Email to DNS TXT record contact, Email to DNS CAA record contact, and Constructed email |
DNS-based | Persistent DNS TXT record (recommended), DNS TXT record, and DNS CNAME record |
Website-based | HTTP Practical Demonstration and HTTP Practical Demonstration with unique filename |
ACME challenges | HTTP-01 and DNS-01 |
The following table describes each domain control validation (DCV) method, its requirements, and the procedure used to complete validation.
Method | How it works | Best for | Steps |
|---|---|---|---|
Email to DNS TXT record contact | DigiCert sends an authorization email to the address in the domain's DNS TXT record | Environments where DNS access is available and a monitored contact email is defined | Add and validate a domain using email to DNS TXT record contact |
Email to DNS CAA record contact | DigiCert sends an authorization email to the address in the domain's CAA record | Environments where a CAA record contact email is already configured | Add and validate a domain using email to DNS CAA record contact |
Constructed email | DigiCert sends authorization emails to standard administrative addresses such as admin@ and webmaster@ | Environments where standard administrative email aliases are monitored | |
Persistent DNS TXT record | Add the DigiCert-provided persistent URI to the domain's DNS as a persistent TXT record and leave it in place for future validations | Environments where DNS access is available and the domain can be validated through a TXT record. Recommended because… You set up the DNS TXT record once and keep it in place for future domain validations. | |
DNS TXT record | Add a DigiCert-generated random value to the domain's DNS as a TXT record | Environments where DNS access is available and the domain can be validated through a TXT record. | |
DNS CNAME record | Create a CNAME record pointing to a DigiCert validation host | Environments where DNS access is available and the domain uses CNAME routing | |
HTTP Practical Demonstration | Place a DigiCert-generated file on the web server at a specific URL | Environments with web server access and open port 80. Supports IPv4 and IPv6 address validation. | Add and validate a domain using HTTP Practical Demonstration |
HTTP Practical Demonstration with unique filename | Place a DigiCert-generated file using a unique DigiCert-provided filename | Environments that centralize validation across servers using 302 redirects. Supports IPv4 and IPv6 address validation. Not supported for DV certificates. | Add and validate a domain using HTTP Practical Demonstration with unique filename |
ACME HTTP-01 | An ACME client automatically places a validation file on the web server | Automated certificate workflows with web server access and open port 80. This doesn't support IP address validation. | |
ACME DNS-01 | An ACME client automatically creates a DNS TXT recordy | Automated certificate workflows with DNS API access. Required for wildcard domain validation. This doesn't support IP address validation. |
What's next
Validate domains before or during certificate orders to understand when to use pre-validation versus order-time validation