DNS certificate validation proves control by publishing the certificate authority's exact challenge. It is useful when the website is not live yet or when the requested certificate requires a DNS-based method.
IN THIS ARTICLE
01 Publish and verify the challenge
- Open the pending certificate request and copy its current record type, name and value. Distinguish an ordinary TXT or CNAME challenge from an ACME challenge or persistent validation record.
- Find the authoritative DNS manager for the domain. Give the DNS administrator the complete record and the certificate order reference.
- Add the record without replacing unrelated TXT records or changing the website's address. Check the manager's handling of fully qualified names so the domain suffix is not entered twice.
- Check that the expected value is visible publicly for the complete record name. If different authoritative servers return different results, resolve that inconsistency first.
- Request validation from the order interface and confirm its completed status for all required names.
- Follow the issuer's instructions about retaining the record. Persistent verification and renewal automation can depend on records remaining in place.
02 Example: verify a certificate DNS challenge before requesting validation
Use the exact record name, type and token issued by your certificate authority. This illustrates a TXT-based ACME challenge. The token is a placeholder and will not validate a real order; some other certificate workflows use different names or record types.
_acme-challenge.example.com. 300 IN TXT "REPLACE_WITH_CURRENT_CHALLENGE_TOKEN"
dig _acme-challenge.example.com TXT +noall +answerRead the result: The public answer must match the current challenge for the requested certificate. A TXT record at example.com is not equivalent to one at _acme-challenge.example.com. Account for any validation-name delegation and confirm that the provider receiving the edit is actually authoritative for that name.
Do not overwrite unrelated simultaneous challenge values without reviewing the certificate workflow. Trigger validation only after the correct authority serves the token. For automated renewals, use a scoped supported DNS integration instead of a one-time manual record that will not match the next challenge.
Common questions
Can I copy a challenge from an older order?
Only use the active instructions for this request. Tokens can change, and a value valid for a different account or order may not satisfy the current check.
Should I delete other verification records?
Keep unrelated records. Multiple business services can need TXT records, while a CNAME at a particular name has its own coexistence restrictions. Resolve a conflict at the exact challenged name with the DNS administrator.
Why does validation fail when my DNS lookup looks correct?
The certificate authority can see different cached or regional answers, or reject broken DNSSEC. Provide the failing name, record and current error to support. Repeatedly buying replacement certificates does not fix the DNS problem.