Domain Control Validation (DCV)
Before a public SSL/TLS certificate can be issued, the certificate authority (CA) must confirm that you control every name on the order—the Common Name (CN) and each Subject Alternative Name (SAN). That proof is domain control validation (DCV).
You complete DCV in CertCommand when you request or reissue a certificate.
Public from multiple locations. DigiCert corroborates DCV from several network perspectives worldwide (MPIC). DNS records and HTTP tokens must be reachable on the public internet—not behind geo-blocks, IP allowlists, or a Cloudflare orange-cloud proxy. For DNS TXT, confirm worldwide visibility with a public resolver . See SSL Domain Validation (DCV) Rules Have Changed .
How this section is organized
- Persistent DNS TXT — Publish one TXT at
_validation-persist.example.comand leave it in place. Recommended for DigiCert and GeoTrust when you can manage DNS. - DNS TXT token — One-time random TXT at
_dnsauth.example.com(not the persistent record; not the zone apex). - DNS CNAME token — CNAME that points at the CA. Available for DigiCert brands and Sectigo/PositiveSSL.
- HTTP file-based token — Host a token file at
/.well-known/pki-validation/. Required for IP-address names; not for wildcards. - Email verification — Approve a link sent to constructed administrative mailboxes (
admin@,webmaster@, and similar). - Email to DNS TXT contact — Point Email verification at any mailbox you publish at
_validation-contactemail.example.com. - Troubleshooting & FAQs — Wrong host, quotes, propagation, MPIC, and switching methods.
Choose a method in CertCommand
On a new certificate request or reissue, under Prove control over your domain, pick a DCV method from the dropdown. Available choices can be limited by the product brand and the names on the order (for example IP-only names offer HTTP only; wildcards do not offer HTTP).
On a pending order you can still open a domain’s DCV Method panel and switch methods until that name is approved. Prefer setting the method on the request or reissue form, especially for Persistent DNS TXT.
Check is optional. After you publish the DNS record or HTTP file, CertCommand and the CA retry DCV automatically. Click Check (or Check validation on some DV orders) only if you want an immediate lookup. You can change the DCV method on a pending domain until that name is approved.
Compare methods
| Method | You prove control by | Best when | Wildcards | IP names | Brands |
|---|---|---|---|---|---|
| Persistent DNS TXT | Long-lived TXT at _validation-persist.example.com |
You can leave a DNS record published | Yes | No | DigiCert, GeoTrust |
| DNS TXT token | One-time random TXT at _dnsauth.example.com |
Short-lived DNS change is acceptable; keeps apex TXT (SPF) untouched | Yes | No | DigiCert, GeoTrust |
| DNS CNAME token | CNAME host → CA target | DNS CNAME is easier than TXT, or you use Sectigo | Yes | No | All |
| HTTP file-based token | Token file on the website | You control the web root on ports 80/443 | No | Yes (only method) | All |
| Email verification | Clicking a link in a DCV email | You receive mail at constructed admin addresses | Yes | No | All |
| Email to DNS TXT contact | Same emails, plus a mailbox you list in DNS | You want email DCV without admin@ on the domain |
Yes | No | DigiCert, GeoTrust |
DV: one DCV method applies to every name on the certificate. You still complete the challenge for each name (each _validation-persist.<name> record, each email approval, each HTTP file, and so on).
OV and EV: after a domain is validated, DigiCert can reuse that validation for later OV/EV orders until the reuse period expires. DV has no reuse—every issue and reissue needs DCV again. See Change Log — 199-day domain validation reuse.
This is not ACME DCV
ACME clients prove control with HTTP-01 or DNS-01 challenges during automated enrollment. Those workflows live under Certificate Automation (ACME). The pages in this section are for CertCommand SSL/TLS orders (the request form and the pending-order DCV panel).