Domain Control Validation at Scale: Persistent DCV and ACME

Certificate lifecycle management is becoming more automated, while domain validation is becoming more stringent. As organizations prepare for shorter certificate lifetimes and more frequent renewals, Domain Control Validation is emerging as one of the most important operational challenges in public key infrastructure (PKI).

The CA/Browser Forum has begun reducing how long domain and IP validation data can be reused. As of March 15, 2026, the maximum reuse period dropped from 398 days to 200 days, and it falls again to 100 days in 2027 and 10 days in 2029. In parallel, the industry continues moving toward shorter certificate validity periods, which increases the frequency of issuance and renewal. Together, these changes mean organizations can no longer rely on occasional, manual validation.

Persistent DCV, DNS automation, and ACME-based certificate management provide a scalable path forward. Implemented well, they reduce operational overhead, improve renewal reliability, and help organizations stay compliant as PKI requirements evolve.

This blog explains how domain validation is changing, what Persistent DCV actually does, and how to build a validation model that holds up at enterprise scale.

Understanding Domain Control Validation

Domain Control Validation is the mechanism that prevents an unauthorized party from obtaining a certificate for a domain it does not own or manage. A Certificate Authority requires proof of control before it issues a certificate, and that proof is the foundation of trust in public PKI.

Several validation methods exist, the most common being DNS-based validation and HTTP-based validation. Email-based and phone-based methods also exist, but the CA/Browser Forum is phasing them out. Among the remaining options, DNS-based validation has become the preferred method for automation because it integrates cleanly with modern certificate workflows and supports large environments with minimal human involvement.

Historically, domain validation happened infrequently because certificate lifetimes were long. As renewal cycles shorten, validation shifts from an occasional event to a recurring operational function that must scale across hundreds or thousands of domains.

Why Domain Validation Reuse is Tightening

The CA/Browser Forum’s Baseline Requirements are reducing how long domain and IP validation data can be reused. Under Ballot SC-081v3, approved in April 2025, the reuse period steps down on a fixed schedule.

Effective date	Maximum domain and IP validation (DCV) reuse
Until March 14, 2026	398 days
From March 15, 2026	200 days
From March 15, 2027	100 days
From March 15, 2029	10 days

Source: CA/Browser Forum Ballot SC-081v3.

The rationale is straightforward. Validation data that was accurate six months ago may no longer reflect current domain ownership. Shorter reuse periods mean that Certificate Authorities must verify control more recently before each issuance, which directly reduces the risk of certificates being issued to parties that no longer legitimately control a domain.

Because certificate validity is shrinking at the same time, organizations face a compounding effect. Not only must each individual certificate be renewed more often, but the validation behind each renewal must also be refreshed on a shorter cycle. For large enterprises managing thousands of certificates, this creates substantial operational pressure. Organizations exploring how 47-day certificate lifetimes affect automation can see why Domain Control Validation strategy has become a critical priority alongside renewal automation.

Why Shorter Certificate Lifetimes Change Everything

For years, certificate operations centered on expiration monitoring. Teams tracked upcoming renewal dates and acted before certificates expired. Domain Control Validation was a one-time event tied to issuance, and the validation record remained usable for long enough that it rarely needed to be refreshed before a renewal.

As certificate lifetimes fall, organizations must revalidate domains much more frequently. A certificate renewed every 47 days requires a corresponding validation refresh on a similar cadence. That volume cannot be absorbed by manual processes. Each validation step requires a DNS record placement, a CA challenge, and a lifecycle event. Doing this by hand across hundreds of domains is not sustainable.

This is why Domain Control Validation has become central to certificate management complexity. The operational discipline required to keep validation current is now inseparable from the discipline required to keep certificates renewed. Organizations that address only one side of this equation tend to encounter outages on the other.

What Persistent DCV is

Persistent Domain Control Validation is a DNS-based approach that reduces repeated validation work while preserving strong assurance of domain ownership. Because it is DNS-based rather than HTTP-based, it also supports the use cases that depend on the DNS-01 challenge, such as wildcard certificates, which cannot be validated over HTTP.

The CA/Browser Forum’s Ballot SC-088v3 added a new method, “DNS TXT Record with Persistent Value,” as section 3.2.2.4.22 of the Baseline Requirements for TLS Server Certificates. It lets a domain owner establish an account-scoped DNS TXT record that can be reused across multiple certificate issuances, removing the need to create a fresh validation record for every renewal while maintaining security equivalent to existing DNS-based methods. Certificate Authorities have been able to use the method since November 11, 2025, and implementation is at each CA’s discretion. Adoption is still early, however: the underlying IETF specification remains a draft and most Certificate Authorities are still moving the method toward production, so availability varies by provider.

Persistent DCV should not be mistaken for a permanent exemption from periodic revalidation. The Baseline Requirements still cap how long any completed validation can be reused, and that cap is shrinking on the schedule above. What Persistent DCV changes is the operational pattern. The validation record stays in place under the domain owner’s control, so the Certificate Authority can re-confirm control against the same record on each cycle without anyone manually creating a new token. That is what makes frequent revalidation sustainable.

Area	Traditional DCV	Persistent DCV (SC-088v3)
Validation record	A new record is created for each issuance cycle	An account-scoped record is placed once and reused
Operational effort	Frequent DNS updates and validation actions	Reduced ongoing validation workload
Scalability	Hard to manage across large domain inventories	Better suited to enterprise-scale estates
Automation support	Often requires recurring manual intervention	Designed for automated renewal workflows
Risk of human error	Higher, due to repeated manual actions	Lower once correctly implemented

For organizations managing large certificate estates, the operational gains from persistent validation can be substantial.

DNS Automation: The Missing Piece

Persistent validation becomes far more valuable when paired with DNS automation. Modern workflows rely on DNS-based challenges, such as creating TXT records in specific validation zones, and without automation those changes require coordination among PKI teams, DNS administrators, infrastructure teams, and change management.

DNS automation removes those dependencies by letting certificate management platforms and ACME clients interact directly with DNS providers through APIs. In practice, this removes manual DNS changes, reduces human error, prevents renewal delays, clears change-management bottlenecks, and cuts cross-team coordination overhead. For organizations spanning multiple DNS providers, cloud environments, and business units, these gains compound. The combination of non-human identity management and DNS automation is increasingly central to scalable certificate operations.

ACME: The Foundation of Certificate Automation

Automatic Certificate Management Environment (ACME), defined in RFC 8555, is the standard protocol for automated certificate issuance and renewal. ACME lets a client communicate directly with a Certificate Authority, complete validation challenges, request certificates, and renew them without manual steps. Learn more in the ACME protocol overview.

As validity periods shrink, ACME is evolving from a convenience into a foundational PKI requirement. Organizations that still depend on manual requests, approvals, and installation will struggle to sustain frequent renewal cycles, because the work simply recurs too often. ACME addresses this by automating the entire flow, from validation through issuance, renewal, and deployment. The broader trajectory of the certificate lifecycle evolution shows how ACME has shifted from optional to essential.

Combined with Persistent DCV and DNS automation, ACME creates a highly scalable model. The persistent record is placed once, DNS automation maintains it through provider APIs, and ACME drives validation and renewal on a schedule, so the estate keeps pace with short lifetimes without manual intervention.

As cryptographic standards evolve, post-quantum algorithms defined in FIPS 203, FIPS 204, and FIPS 205 will eventually affect certificate issuance workflows. Organizations building scalable DCV infrastructure today should account for algorithm agility so that automated pipelines can adopt quantum-safe algorithms without redesign when CA adoption advances.

Why Certificate Operations Break at Scale

Most certificate incidents are not caused by cryptographic failures. They result from operational complexity. At small scale, manual validation can feel manageable. At enterprise scale, multiple teams, DNS zones, cloud providers, applications, and certificate authorities form a web of dependencies that is difficult to coordinate by hand. For example, a single stale DNS validation record can silently block every renewal that relies on it, so a certificate quietly fails to renew and the service it protects goes offline until someone traces the outage back to that one record.

The recurring failure modes are familiar: expired validation authorizations, missing or incorrect DNS records, failed renewals, unclear certificate ownership, disconnected automation workflows, and inconsistent validation policies across teams. As certificate lifetimes shorten, these problems occur more often and cause more disruption. Organizations that treat validation as a standalone task usually discover that the deeper challenge is governance over domain and certificate ownership, visibility into validation status and expiration across the estate, and lifecycle coordination across teams and systems.

Security Considerations

A common operational mistake is assuming validation records remain usable indefinitely. Reuse periods are governed by CA policy and are shrinking, so they must be monitored. Another is inserting a manual DNS step into an otherwise automated workflow, where a single missed update can block issuance and cause an outage. A third is separating certificate lifecycle management from validation management, which creates blind spots where teams can see expiration dates but cannot track validation status, ownership, or automation health.

To reduce operational risk, the most resilient programs standardize DNS-based validation wherever possible, since it automates more cleanly than other methods. They automate validation workflows using DNS provider APIs and ACME so that revalidation does not depend on manual action. They maintain centralized visibility into certificate inventories and validation status, not just expiration dates, and define clear ownership for domains, DNS zones, and certificate operations.

Private keys should be protected using secure key management and Hardware Security Modules (HSMs) where appropriate, ideally validated to FIPS 140-3 Level 3. Validation workflows should also be reviewed regularly as CA and browser requirements continue to evolve.

The most successful programs treat Domain Control Validation as an ongoing operational process rather than a one-time issuance step. Ballot SC-085v2 further strengthens the security posture by requiring DNSSEC validation for CAA and DCV lookups when DNSSEC is present, reducing the risk of DNS-based attacks against the validation process itself. The risks of mismanaged certificates show how quickly these gaps translate into real outages and compliance failures.

How Encryption Consulting Can Help

Managing domain validation at scale takes more than automation alone. Organizations need governance, visibility, and lifecycle control across the entire certificate ecosystem. Encryption Consulting (EC) helps design and implement scalable certificate management strategies that align with evolving CA/Browser Forum requirements and modern PKI practice.

Through Enterprise PKI Services, organizations can build validation architectures, establish governance frameworks, and design scalable lifecycle processes across business units, cloud environments, and DNS providers.

For centralized visibility and automation, CertSecure Manager provides a unified platform for certificate discovery, inventory management, lifecycle monitoring, validation tracking, and renewal orchestration. By connecting certificate workflows with DNS automation and ACME-based processes, it reduces operational complexity while improving compliance and reliability.

EC’s Encryption Advisory Services help teams evaluate Persistent DCV strategies, optimize validation workflows, implement DNS automation, and plan post-quantum migration through cryptographic discovery, Cryptographic Bill of Materials (CBOM) assessments, and quantum-safe readiness planning, without disrupting operations. The goal is not simply to automate issuance. It is to build a sustainable, scalable trust model that stays effective as certificate lifetimes, validation requirements, and operational demands continue to change.

Conclusion

Domain Control Validation is becoming one of the most critical operational components of modern PKI. As reuse periods shrink and certificate lifetimes shorten, organizations must rethink how they validate domains at scale.

Persistent DCV provides a more sustainable validation model, DNS automation reduces operational friction, and ACME delivers the automation needed to support frequent renewals. Together, they let organizations move beyond reactive certificate management toward a scalable, resilient lifecycle program.

The practical starting point is visibility and ownership: know every domain and certificate you manage, confirm how each one is validated, and identify where manual DNS steps still sit inside otherwise automated workflows. From there, persistent records, DNS APIs, and ACME can close the gaps. To assess your Domain Control Validation architecture and plan the work, contact Encryption Consulting.