Domain Control Validation (DCV) methods

Supported DCV methods for validating the domains on DV TLS/SSL certificate orders

Before DigiCert can issue a DV TLS certificate, you must prove control over the domains and any SANs (Subject Alternative Names) on the certificate. We refer to this process as the Domain Control Validation (DCV) process.

A DV TLS certificate's domain validation is only valid for that certificate's issuance. DV domain validation is not reusable for reissues or renewals. Therefore, each time you order a DV certificate, you must demonstrate control over the domains on the order before DigiCert can issue your DV TLS certificate.

For DV certificates in CertCentral, DigiCert currently supports the following DCV Methods:

Email
- Email to DNS TXT contact
- Constructed email
- WHOIS-based email
DNS TXT
DNS CNAME
HTTP Practical Demonstration

Email DCV method

With this validation method, DigiCert sends three sets of DCV emails: DNS TXT-based, constructed, and WHOIS-based.

To demonstrate control over the domain, an email recipient follows the instructions in a confirmation email sent for the domain. The confirmation process consists of visiting the link provided and following the instructions on the confirmation page.

Note: DigiCert sends this email from no-reply@digitalcertvalidation.com. If using allowlist, make sure to include digitalcertvalidation.com.

Important

End of life for the WHOIS-based email

The industry is moving away from using WHOIS to identify domain contacts. DigiCert recommends that those using the WHOIS-based Email DCV method update their domain validation processes to use one of the other supported DCV methods as soon as possible.

If you still want to use the Email DCV method, use the DNS TXT record email contact or the Constructed email method.
To learn more about the end of life for WHOIS-based email, see our knowledge base article, End of Life for WHOIS based email DCV method.

Email to DNS TXT contact

For the email to DNS TXT contact DCV method, DigiCert sends an authorization email to the email addresses found in the DNS TXT record on the _validation-contactemail subdomain of the domain you are validating. When validating a domain, make sure to select the Verification email DCV method.

To configure your CertCentral Email DCV method to send the confirmation email to DNS TXT contacts, do the following:

Place the DNS TXT record on the _validation-contactemail subdomain of the domain you want to validate. The RDATA value of this text record must be a valid email address.
Name
TTL
Message
_validation-contactemail
Default
validatedomain@digicerttest.com
DigiCert recommends adding a distribution list rather than a personal email address. A distribution list allows you to create a "non-expiring" email address to which you can add or remove people when necessary.
Update your CertCentral account settings to send the verification DCV emails to Org/Tech/Admin contacts from DNS TXT.
1. In CertCentral, in the left menu, go to Settings > Preferences.
2. On the Preferences page, select Advanced Settings.
3. In the Domain Control Validation (DCV) section under Send verification DCV emails to, select Org/Tech/Admin contacts from DNS TXT.
4. Go to the bottom of the page and select Save Settings.
See our instructions for Using Email verification to validate a domain on a DV TLS certificate

Name	TTL	Message
`_validation-contactemail`	Default	validatedomain@digicerttest.com

Constructed email

For the Constructed Email method, DigiCert sends the authorization email to five constructed email addresses for the domain: admin, administrator, webmaster, hostmaster, and postmaster @[domain_name].

If we can't find an MX record for [domain_name], you must use one of the other supported DCV methods to demonstrate control over the domain. See MX records (mail exchanger records) below.

Background

When registering a domain, you must provide contact information, such as administrative and technical contacts. Instead of using a personal email address, you can use one of the constructed email addresses for your domain, such as webmaster@yourdomain. Using a constructed email addresses allows you to create a "non-expiring" email address that you can add or remove people from when necessary.

MX (Mail Exchanger) records

Before DigiCert can successfully send an authentication DCV email to the domain owner (or domain controller), we must verify that an MX record (a resource record in the Domain Name System [DNS]) exists in the DNS records of the recipient's domain name. The presence of valid MX records enables us to send the authentication email.

For example, you want to receive your DCV email at one of the constructed email addresses for example.com, admin@example.com. To successfully receive a DCV Email at admin@example.com, we must first find an MX record for the address that identifies the server (for example, mailhost.example.com) set up to receive the emails destined for admin@example.com.

WHOIS-based email

For the WHOIS-based method, DigiCert sends an authorization email to the registered owners of the public domain as shown in the domain's WHOIS record.

Are you expecting to receive an email at an address published in your domain’s WHOIS record?

Verify that your registrar/WHOIS provider has not masked or removed that information. If the information is masked, find out if they provide a way (such as anonymized email address, web form) for you to allow Certificate Authorities (CAs) to access your domain’s WHOIS data.

DNS TXT DCV method

With this validation method, you add a DigiCert generated random value (provided for the domain in your CertCentral account) to the domain’s DNS as a TXT record. When DigiCert does a search for DNS TXT records associated with the domain, we can find a record where the record's value includes the DigiCert random value.

DNS CNAME DCV method

With this validation method, you add a DigiCert generated random value (provided for the domain in your CertCentral account) to the domain's DNS as a CNAME record. Then, add dcv.digicert.com as the CNAME target. When DigiCert searches a DNS CNAME record associated with the domain, we can find a record that includes the DigiCert random value.

HTTP Practical Demonstration DCV method

You can only use the HTTP Practical Demonstration DCV methods to demonstrate control over fully qualified domain names (FQDNs) exactly as named in the certificate request. To learn more, visit Domain Validation Policy Changes.

Validating IPv4 and IPv6 address

Per industry regulations, you can only use the HTTP Practical Demonstration DCV method to demonstrate control over IPv4 and IPv6 addresses.

Use one of the other supported DCV methods to:

Validate wildcard domains, such as *.example.com.
Include subdomains in the validation when validating a higher-level domain. For example, if you want to cover www.example.com, mail.example.com, and one.example.com when validating the higher-level domain example.com.
Validate entire domains and subdomains.

Using HTTP Practical Demonstration

With this validation method, you host a file containing a DigiCert generated random value (provided for the domain in your CertCentral account) at a predetermined location on your website: [domain]/.well-known/pki-validation/fileauth.txt. Once the file is created and placed on your site, DigiCert visits the specified URL to confirm the presence of our random value.

In this section: