Domain Control Validation (DCV)

Domain Control Validation (DCV) is the process a Certificate Authority uses to confirm that a certificate requester actually controls the domain named in the certificate, typically through a DNS record, an email confirmation, or a file placed on the web server.

DCV proves domain ownership before a CA issues a TLS certificate. The three standard methods are DNS-based validation, where the requester adds a specific DNS TXT record; HTTP-based validation, where they place a file at a defined URL path; and email-based validation, sent to a predefined address associated with the domain.

Key Takeaways

• The CA/Browser Forum defines the accepted DCV methods in its Baseline Requirements; a CA cannot issue a publicly trusted certificate without completing one.
• DNS-based validation is the most automation-friendly method and is required for wildcard certificates, since a wildcard cannot be validated via a single file path.
• HTTP-based validation is common for single-domain certificates and works well with ACME clients that can programmatically create the required file.
• Email-based validation sends a confirmation link to a small set of predefined addresses, such as admin@domain or a WHOIS-listed contact, and is the least automatable method.
• The CA/Browser Forum is shortening the maximum reuse period for a completed DCV, meaning domains will need to be revalidated more frequently alongside shorter certificate validity.

What are the Three Standard DCV Methods?

Method	How it works	Best for
DNS-based (DNS-01)	Requester adds a specific TXT record to the domain’s DNS zone	Wildcard certificates; fully automatable with API-based DNS providers
HTTP-based (HTTP-01)	Requester places a file with a specific name and content at a defined URL path	Single-domain certificates on web servers with file system or deployment access
Email-based	CA sends a confirmation link to a predefined address (e.g., admin@domain, WHOIS contact)	Low-automation environments, or as a fallback when DNS/HTTP access is unavailable

Why do Wildcard Certificates Require DNS-based Validation?

A wildcard certificate covers every subdomain under a given domain, so there is no single file path or fixed email address that could prove control over all of them at once. A DNS TXT record, added at the domain’s zone level, proves control over the entire domain and everything beneath it, which is why the CA/Browser Forum requires DNS-based validation specifically for wildcard issuance.

How Does Automated DCV Fit Into an ACME-based Certificate Workflow?

1. An ACME client requests a certificate and receives a DCV challenge from the CA.
2. For DNS-01, the client programmatically creates the required TXT record via the DNS provider’s API.
3. For HTTP-01, the client places the required file at the specified path on the web server.
4. The CA checks the DNS record or HTTP file and, once verified, issues the certificate automatically.
5. The entire cycle repeats automatically at renewal, without manual intervention, provided the DNS or web server access remains configured.

Why is DCV Reuse Also Shrinking Alongside Certificate Validity?

The CA/Browser Forum is shortening the maximum period a CA can reuse a previously completed domain validation without rechecking it, following the same rationale as the SC-081v3 certificate validity schedule: a stale validation is an exploitable window if domain control has changed hands since it was last checked. Organizations preparing for shorter certificate validity should plan for more frequent DCV revalidation as a related, but distinct, operational requirement.

How Encryption Consulting Helps

How Encryption Consulting HelpsCertSecure Manager automates DNS-01 and HTTP-01 domain control validation alongside certificate issuance and renewal, so DCV revalidation never becomes a manual bottleneck as reuse windows shrink. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

Which DCV method is best for automation?

DNS-based validation (DNS-01) is generally the most automation-friendly, since it can be completed entirely through a DNS provider’s API without touching the web server, and it is required for wildcard certificates regardless of automation preference.

Can I use email-based validation for a wildcard certificate?

No. Wildcard certificates require DNS-based validation, since a wildcard covers every subdomain under a domain and no single email address or file path can prove control over all of them simultaneously.

How often does DCV need to be repeated?

DCV reuse periods are set by the CA/Browser Forum and are shortening over time, similar to certificate validity itself, so organizations should expect to revalidate domain control more frequently going forward rather than assuming a single validation covers indefinite renewals.

What is the difference between HTTP-01 and DNS-01 validation?

HTTP-01 proves domain control by placing a specific file at a defined URL path on the web server; DNS-01 proves it by adding a TXT record to the domain’s DNS zone. DNS-01 is required for wildcard certificates and generally automates more easily across multiple servers.

Automate DCV Alongside Certificate Issuance

Take the next step CertSecure Manager automates DNS-01 and HTTP-01 domain validation as part of the full certificate lifecycle, keeping renewal and revalidation in sync. See CertSecure Manager in action.