Domain Control Validation
The Three Standard Validation Methods
Domain control validation (DCV) is the process a certificate authority uses to confirm that the applicant controls the domain name in the certificate request. It is the check behind every DV certificate and the first step of OV and EV issuance, as compared in the validation levels.
The CA/Browser Forum's rules allow a small set of methods. Each one proves control of something that only the domain owner should be able to change:
- Email: the CA sends a code or link to an address that belongs to the domain, such as an address listed in the domain's registration record or a standard administrative address like admin or hostmaster at that domain.
- HTTP: the applicant places a specific value in a file on the web server, at a path the CA specifies, and the CA fetches that file over the internet.
- DNS: the applicant adds a DNS TXT record containing a specific value, and the CA looks it up through public DNS.
Why Wildcard Certificates Need DNS Validation
A wildcard certificate, such as one for *.example.com, covers every subdomain at one level. A file on a single web server cannot show that the applicant controls every name that might be used under the domain. For that reason, wildcard certificates generally must be validated through DNS or email rather than HTTP. The product itself is explained in what a wildcard SSL certificate is.
DNS validation has a practical advantage beyond wildcards. It works when the web server is not reachable from the public internet, because the CA checks a DNS record rather than the website. This matters for servers behind firewalls and for organizations that obtain certificates before a site goes live.
Validation results are not permanent. CAs may reuse a recent validation for a limited period, then repeat the check. Automated certificate tools handle this schedule, as described in the ACME protocol.
Example: Validating a Server Behind a Firewall
A company's internal web application runs on a server that accepts no inbound connections from the internet. HTTP validation cannot work, because the CA cannot reach a file on that server. DNS validation does work. The company publishes the required TXT record in its public DNS zone, the CA looks it up, and the certificate is issued without the server ever being exposed to the internet.
Frequently asked questions
Do I have to repeat domain validation at every renewal?
Not always. A CA may reuse an earlier validation if it is still within the period the rules allow, so renewals often happen without a new check. Once that period expires, the CA must validate the domain again. Automated tools usually repeat the check at the right time.
Who can pass domain control validation?
Only someone who controls the domain's email, web server or DNS can pass validation. That is why securing those accounts matters: anyone who gains control of one of them may be able to obtain a certificate for the domain. Protecting DNS access and the mailboxes behind administrative addresses is part of protecting the certificate.