DNS CNAME token
DNS CNAME Token proves control by creating a CNAME whose host and target come from GeoCerts CertCommand. The Certificate Authority (CA) queries that name and completes DCV when the record matches. For DigiCert and GeoTrust, that host is _dnsauth.example.com (or _dnsauth.sub.example.com for an exact FQDN)—not a record at the zone apex.
This method is available for DigiCert, GeoTrust, Sectigo, and PositiveSSL. Copy the host and target from your order—the two brands use different shapes.
1. Copy the CNAME from CertCommand
On the request, choose DNS CNAME Token under Prove control over your domain, or set it on the pending order’s DCV Method panel. Copy the host and the value (points-to / target) using Click Text to Copy.
DigiCert / GeoTrust
Typical shape:
| Field | Example shape |
|---|---|
| Type | CNAME |
| Host | _dnsauth in the DNS UI → _dnsauth.example.com in public DNS |
| Target | {random-value}.dcv.digicert.com |
Do not use the older prefix-on-the-left CNAME format. DigiCert expects the _dnsauth host pointing at {token}.dcv.digicert.com.
Sectigo / PositiveSSL
Typical shape:
| Field | Example shape |
|---|---|
| Type | CNAME |
| Host | A unique _ + hash label under the domain |
| Target | A unique value ending in .sectigo.com |
Sectigo can accept DCV at an intermediate name (for example a CNAME under two.one.example.com when the certificate name is deeper). Prefer publishing exactly the host CertCommand shows.
2. Create the CNAME
At your DNS provider:
- No quotation marks around the target.
- No extra dots or spaces.
- If the provider auto-appends the zone, enter only the short host (
_dnsauth), not the FQDN. - On Cloudflare, set the record to DNS only (gray cloud), not proxied.
Confirm:
dig +short CNAME _dnsauth.example.com
(or the Sectigo host from your order). The answer should be the target CertCommand displayed.
DigiCert checks DNS from multiple locations (MPIC). Confirm worldwide propagation with a public lookup, not only your DNS provider’s UI. Authoritative DNS must be publicly reachable.
3. Complete the check
Click Check for an immediate lookup, or wait for automatic polling.
Check is optional. CertCommand and the CA retry DCV automatically. Click Check if you want an immediate lookup. You can change the DCV method on a pending domain until that name is approved.
Related topics
- Persistent DNS TXT — DigiCert/GeoTrust alternative if you can leave a TXT published
- DNS TXT token
- Troubleshooting & FAQs
← Back to Domain Control Validation