DNS TXT token
DNS TXT Token proves control with a random token you publish as a DNS TXT record. The CA looks up that token. This is not Persistent DNS TXT: the value comes from the pending order, and the token is meant for this validation—not as a record you keep forever.
Publish at _dnsauth, not at the zone apex. Put the token on a dedicated name—_dnsauth.example.com when you submit the base domain, or _dnsauth.sub.example.com when you submit that exact FQDN. That keeps SPF, DKIM, and other TXT records at example.com untouched. Do not add this token as another TXT on @ / the apex unless you have no other choice.
DigiCert and GeoTrust only. Sectigo and PositiveSSL do not offer DNS TXT Token in CertCommand. Use DNS CNAME, email, or HTTP file DCV instead. If you can leave a record published, prefer Persistent DNS TXT.
1. Copy the token from CertCommand
- Open the pending order in CertCommand.
- For each domain that still needs DCV, set DCV Method to DNS TXT Token (or choose it on the request under Prove control over your domain).
- Copy the token (TXT value / Token) with Click Text to Copy. Do not add quotes. Publish it at
_dnsauth…as in the next step even if an older panel still shows the domain name as TXT host.
Tokens are time-limited. Complete validation before the value CertCommand shows expires.
2. Publish the TXT record at _dnsauth
Prefer a TXT record on the _dnsauth label. This is a TXT record, not a DNS CNAME (CNAME also uses _dnsauth for DigiCert, but you pick one DCV method).
| DCV scope on the request | DNS name to publish |
|---|---|
| Submit base domains | _dnsauth.example.com |
| Submit exact domain names (FQDN) | _dnsauth.sub.example.com (match the name on the order) |
At your DNS provider:
| Field | Typical value |
|---|---|
| Type | TXT |
| Host / name | _dnsauth if the zone is example.com and the provider appends it; otherwise the full _dnsauth.example.com |
| Value | The token string from CertCommand |
If the provider appends the zone, do not paste the full FQDN or you will create _dnsauth.example.com.example.com.
Example (zone example.com, base-domain scope):
Name: _dnsauth
Type: TXT
Value: 7f4bde34a21a45b9b6c3c8b8fbd02156
Use the token from your order, not this example.
Confirm with:
dig +short TXT _dnsauth.example.com
(or _dnsauth.sub.example.com for exact-FQDN scope). You should see the token. Extra TXT records at _dnsauth are fine; the CA looks for the token string. You can also check worldwide propagation
(MPIC requires the record to be visible from multiple regions).
3. Complete the check
Click Check (or Check validation on some DV orders) for an immediate lookup, or wait for automatic polling.
Check is optional. CertCommand and the CA retry DCV automatically. Click Check if you want an immediate lookup. You can change the DCV method on a pending domain until that name is approved.
Repeat for each domain on the order.
Related topics
- Persistent DNS TXT — same idea, durable record
- DNS CNAME token
- Troubleshooting & FAQs
← Back to Domain Control Validation