Skip to main content

Domain Control Validation (DCV) methods

Supported DCV methods for validating the domains on DV TLS/SSL certificate orders

Before DigiCert can issue a certificate, you must prove control over the domains and any SANs (Subject Alternative Names) on the order. We refer to this process as the Domain Control Validation (DCV) process.

DV certificates don't support domain prevalidation. Therefore, each time you order a DV certificate, you must demonstrate control over the domains on the order. After placing your order, you need to complete domain validation before DigiCert can issue your DV certificate.

Notice

Certificates won't be issued until domain validation is complete.

For DV certificates in CertCentral, DigiCert currently supports the following DCV Methods:

  • WHOIS-based Email

  • Constructed Email

  • Email to DNS TXT contact

  • DNS TXT

  • File

Email validation

With this validation method, DigiCert sends three sets of DCV emails: WHOIS-based, constructed, and DNS TXT-based.

To demonstrate control over the domain, an email recipient follows the instructions in a confirmation email sent for the domain. The confirmation process consists of visiting the link in the email and following the instructions on the page.

WHOIS-based email validation

For the WHOIS-based method, DigiCert sends an authorization email to the registered owners of the public domain as shown in the domain's WHOIS record.

Note

Are you expecting to receive an email at an address published in your domain’s WHOIS record? Verify that your registrar/WHOIS provider has not masked or removed that information. If they have, find out if they provide a way (e.g., anonymized email address, web form) for you to allow CAs to access your domain’s WHOIS data.

Constructed email validation

For the Constructed Email method, DigiCert sends the authorization email to five constructed email addresses for the domain: admin, administrator, webmaster, hostmaster, and postmaster @[domain_name].

Note

When you register a domain, you must provide your identifying and other contact information (e.g., administrative and technical contacts). Instead of using a personal email address, you can use one of the constructed email addresses for your domain (e.g., webmaster@yourdomain.com). Using one of the constructed email addresses allows you to create a "non-expiring" email address that you can add or remove people from when necessary.

If we can't find an MX record for [domain_name], you must use one of the other supported DCV methods to demonstrate control over the domain.

MX (Mail Exchanger) records

Before we can successfully send an authentication email (DCV Email) to the domain owner (or domain controller), we must verify that an MX record (a resource record in the Domain Name System [DNS]) exists in the DNS records of the recipient's domain name. The presence of valid MX records enables us to send the authentication email.

For example, you want to receive your DCV email at one of the constructed email addresses for example.com, admin@example.com. To successfully send a DCV Email to admin@example.com, we must first find an MX record for that address that identifies the server (e.g., mailhost.example.com) set up to receive the emails for admin@example.com

If we find an MX record, we can successfully send a DCV email to admin@example.com. If we don't find an MX record, no DCV email is sent since we cannot identify the proper mail server.

Email to DNS TXT contact DCV method

For the email to DNS TXT contact DCV method, DigiCert sends an authorization email to the email addresses found in the DNS TXT record on the _validation-contactemail subdomain of the domain being validated.

Notice

To use the Email to DNS TXT contact DCV method, make sure to choose the Verification email DCV method when ordering a certificate or changing DCV methods for your domains.

DNS TXT record email contacts

To use the email to DNS TXT contact DCV method, you must place the DNS TXT record on the _validation-contactemail subdomain of the domain you want to validate. The RDATA value of this text record must be a valid email address.

Name

TTL

Message

_validation-contactemail

Default

validatedomain@digicerttest.com

See section B.2.1 DNS TXT Record Email Contact in the Appendix of the baseline requirements.

DNS TXT validation

With this validation method, you add a DigiCert generated random value (provided for the domain in your CertCentral account) to the domain’s DNS as a TXT record. When DigiCert does a search for DNS TXT records associated with the domain, we can find a record where the record's value includes the DigiCert random value.

DNS CNAME DCV method

With this validation method, you add a DigiCert generated random value (provided for the domain in your CertCentral account) to the domain's DNS as a CNAME record. Then, add dcv.digicert.com as the CNAME target. When DigiCert searches a DNS CNAME record associated with the domain, we can find a record that includes the DigiCert random value.

HTTP practical demonstration DCV method (also referred to as File and FileAuth)

With this validation method, you host a file containing a DigiCert generated random value (provided for the domain in your CertCentral account) at a predetermined location on your website: [domain]/.well-known/pki-validation/fileauth.txt. Once the file is created and placed on your site, DigiCert visits the specified URL to confirm the presence of our random value.