Email to DNS TXT contact
Email to DNS TXT contact is not a separate dropdown item. You still choose Email Verification in CertCommand. The difference is where the CA finds extra mailboxes: a DNS TXT record at _validation-contactemail.example.com for the domain you are validating. That dedicated name leaves TXT records at the zone apex (SPF, and similar) unchanged.
Use this when you cannot receive the constructed addresses (admin@, webmaster@, and similar) but you can publish DNS. The TXT value can be one or more email addresses, separated by commas. Those mailboxes can be any valid address—they do not have to be @ the domain you are validating. Once the record is in place, you can reuse it for later Email Verification DCV.
DigiCert and GeoTrust. Set this up for DigiCert and GeoTrust SSL/TLS products. Sectigo and PositiveSSL Email Verification still uses constructed administrative addresses; they do not offer Persistent DNS TXT or DNS TXT token in CertCommand.
1. Publish the TXT record
Create a TXT record:
| Field | Value |
|---|---|
| Host / name | _validation-contactemail (DNS name: _validation-contactemail.example.com) |
| Type | TXT |
| Value | One or more email addresses you monitor, separated by commas |
If your DNS provider appends the zone automatically, enter only _validation-contactemail. Otherwise use _validation-contactemail.example.com.
Example (Route 53-style): record name _validation-contactemail, type TXT, value:
jane@yourcompany.com,ops@other-org.net
A single address is fine too (jane@yourcompany.com). Addresses do not have to share a domain with each other or with the certificate name.
Confirm the world can see it, for example:
dig +short TXT _validation-contactemail.example.com
You should see the mailbox list you published (for example "jane@yourcompany.com,ops@other-org.net"), without extra quotes you did not intend. Confirm worldwide visibility with a public resolver
, not only your DNS provider’s UI.
2. Choose Email Verification
On the new request or reissue, under Prove control over your domain, select Email Verification.
When the order is submitted, DCV mail goes to constructed administrative addresses and to the address or addresses in _validation-contactemail.<domain>. Open the link in that message to approve the domain.
Resend from the pending-order DCV panel if needed.
Related topics
- Email verification — constructed addresses and resend
- Persistent DNS TXT — skip email entirely if you can leave a DNS record published
- Troubleshooting & FAQs
← Back to Domain Control Validation