Domain Control Validation (DCV)
Before a public SSL/TLS certificate can be issued, the certificate authority (CA) must confirm that you control every name on the order—the Common Name (CN) and each Subject Alternative Name (SAN). That proof is domain control validation (DCV).
You complete DCV in CertCommand when you request or reissue a certificate.
Public from multiple locations. DigiCert, GeoTrust, Sectigo, and PositiveSSL corroborate DCV from several network perspectives worldwide under MPIC. DNS records and HTTP tokens must be reachable on the public internet—not behind geo-blocks, IP allowlists, or a Cloudflare orange-cloud proxy. For DNS TXT, confirm worldwide visibility with a public resolver .
How this section is organized
- Methods — Choose Persistent DNS TXT, a DNS TXT or CNAME token, an HTTP file, or email.
- Multi-Perspective Issuance Corroboration (MPIC) — Understand why DigiCert, GeoTrust, Sectigo, and PositiveSSL check DCV and CAA from multiple network locations, and how to avoid regional validation failures.
- Troubleshooting & FAQs — Wrong host, quotes, propagation, MPIC, and switching methods.
Choose a method in CertCommand
On a new certificate request or reissue, under Prove control over your domain, pick a DCV method from the dropdown. Available choices can be limited by the product brand and the names on the order (for example IP-only names offer HTTP only; wildcards do not offer HTTP).
On a pending order you can still open a domain’s DCV Method panel and switch methods until that name is approved. Prefer setting the method on the request or reissue form, especially for Persistent DNS TXT.
Check is optional. After you publish the DNS record or HTTP file, CertCommand and the CA retry DCV automatically. Click Check (or Check validation on some DV orders) only if you want an immediate lookup. You can change the DCV method on a pending domain until that name is approved.
Compare methods
| Method | You prove control by | Best when | Wildcards | IP names | Brands |
|---|---|---|---|---|---|
| Persistent DNS TXT | Long-lived TXT at _validation-persist.example.com |
You can leave a DNS record published | Yes | No | DigiCert, GeoTrust |
| DNS TXT token | One-time random TXT at _dnsauth.example.com |
Short-lived DNS change is acceptable; keeps apex TXT (SPF) untouched | Yes | No | DigiCert, GeoTrust |
| DNS CNAME token | CNAME host → CA target | DNS CNAME is easier than TXT, or you use Sectigo | Yes | No | All |
| HTTP file-based token | Token file on the website | You control the web root on ports 80/443 | No | Yes (only method) | All |
| Email verification | Clicking a link in a DCV email | You receive mail at constructed admin addresses | Yes | No | All |
| Email to DNS TXT contact | Same emails, plus a mailbox you list in DNS | You want email DCV without admin@ on the domain |
Yes | No | DigiCert, GeoTrust |
DV: one DCV method applies to every name on the certificate. You still complete the challenge for each name (each _validation-persist.<name> record, each email approval, each HTTP file, and so on).
OV and EV: after a domain is validated, DigiCert can reuse that validation for later OV/EV orders until the reuse period expires. DV has no reuse—every issue and reissue needs DCV again. See Change Log — 199-day domain validation reuse.
This is not ACME DCV
ACME clients prove control with HTTP-01 or DNS-01 challenges during automated enrollment. Those workflows live under Certificate Automation (ACME). The pages in this section are for CertCommand SSL/TLS orders (the request form and the pending-order DCV panel).
Related topics
- Multi-Perspective Issuance Corroboration (MPIC)
- Change Log — MPIC rollout
- Certificate Automation (ACME)