Troubleshooting & FAQs

Problems completing domain control validation on a GeoCerts SSL/TLS order in CertCommand.

Still stuck? Contact GeoCerts support with the order ID, the DCV method, the domain, and a screenshot of the DCV panel or the exact DNS/HTTP lookup you ran.

DNS records (Persistent, TXT token, CNAME, email contact)

Persistent DNS TXT hostname, URI, DCV scope, and doubled-zone failures are on the Persistent DNS TXT how-to. This page covers issues that span methods.

DIG or nslookup does not show the record

  • You published in the wrong zone (for example www.example.com instead of example.com, or the reverse).
  • The provider auto-appended the domain and you pasted the full FQDN from CertCommand, creating _validation-persist.example.com.example.com.
  • TTL/propagation: wait and query a public resolver , not only the provider’s UI.

Extra quotes or spaces in the TXT value

Copy with Click Text to Copy. Do not wrap the persistent URI or token in quotes unless the provider requires them and still stores the value without those quotes in DNS.

Persistent URI shape is digicert.com;accounturi=https://… with no space after ;. Truncating the URI fails the check.

Wrong host

Method Host you should see
Persistent DNS TXT _validation-persist.example.com (copy TXT host from CertCommand; strip the zone if your DNS UI appends it)
Email to DNS TXT contact _validation-contactemail.example.com
DNS TXT token _dnsauth.example.com (or _dnsauth.sub.example.com for exact FQDN). Prefer this over a TXT at the zone apex.
DNS CNAME (DigiCert) _dnsauth.example.com

Mixing those hosts is the most common failure.

Cloudflare orange cloud

CNAME and sometimes TXT lookups fail if the name is proxied. Set DNS only (gray cloud) for DCV records.

I deleted the persistent record after the first certificate

Publish it again and select Persistent DNS TXT on the new request. DigiCert will not reuse a record that is gone, and will not look for it if you pick Email or DNS TXT Token instead.

HTTP file

Browser shows 404 or an HTML page

The path must be /.well-known/pki-validation/<filename> on that FQDN. Create .well-known on Windows from the command line. Confirm you used fileauth.txt (DigiCert) vs the unique Sectigo filename.

Check still fails after the file looks right

Redirects, HTTPS-only with a broken HTTP path, geo-blocking, and IP allowlists fail MPIC. The CA must fetch the file from multiple regions on port 80 or 443. See SSL Domain Validation (DCV) Rules Have Changed . The file has to be on the public internet; a check that only works from your office is not enough.

Wildcards cannot use HTTP DCV. Switch to DNS or email.

Email

No message arrived

Confirm you can receive admin@, webmaster@, or another constructed address for that exact name. On the order, click Manage and read Sent to:. WHOIS contacts are not used for DigiCert DCV email (ended May 8, 2025). Resend from that same modal. Allowlist digitalcertvalidation.com.

If constructed mailboxes do not exist, use Email to DNS TXT contact or switch to a DNS method.

Method not in the dropdown

  • Persistent DNS TXT and DNS TXT Token: DigiCert and GeoTrust SSL/TLS only—not Sectigo/PositiveSSL.
  • IP-only names: HTTP file only.
  • Wildcards: no HTTP file.
  • ACME orders: use the ACME automation workflow, not this DCV panel.

Check vs waiting

You do not have to click Check. CertCommand and the CA retry on their own. Check is for an immediate retry after you know the record or file is public. Do not assume a specific number of minutes.