Validate your domain for an SSL certificate (email, DNS or file)
Prove domain control for your SSL certificate: approve the email, add the DNS TXT or CNAME record, or upload the validation file, check it and fix CAA problems.
- Beginner
- 15 min read
- Updated
On this page
Every publicly trusted certificate is issued only after the certificate authority (CA) checks that you control the domain. This is called domain control validation. You choose the method when you configure the certificate; this guide explains each method, how to check your side and what to do when validation stalls.
Before you start
- You have ordered the certificate and started its configuration; see order, validate and install an SSL certificate.
- You can change the DNS records of the domain (at the DNS host its nameservers point to), or upload files to its website, or read mail at an address of the domain.
Step 1: Choose a method
| Method | What you do | Good for |
|---|---|---|
Approve a message sent to admin@, administrator@, webmaster@, hostmaster@ or postmaster@ your domain | Domains with a working mailbox at one of these addresses | |
| DNS | Add the TXT or CNAME record you are given to the domain's DNS zone | Any domain, also before the website exists; wildcard certificates |
| File (HTTP) | Place the given file under /.well-known/pki-validation/ on the website | Sites that are already online on port 80 |
Step 2: Publish exactly what you are given
- Make sure the chosen address receives mail. If it does not exist, create the mailbox or a forwarder in your control panel first.
- Open the message from the certificate authority and follow its approval link.
- Approve the request for the domain shown. Check that it is your domain and your order.
DNS
- Copy the record name, type (TXT or CNAME) and value from your order.
- Add the record at the DNS host that serves your domain. Many DNS panels add the domain to the name automatically, so enter only the part in front of it if your panel works that way.
- Save, and wait for the record to appear (usually minutes, up to the record's TTL).
File (HTTP)
- Create the file with the exact name and content from your order.
- Upload it to the folder
.well-known/pki-validation/in the site's document root (create the folders if needed). - Make sure the address opens over plain HTTP on port 80. If a redirect (for example to HTTPS or to
www) is in place, the file must still be served at the end of it.
Step 3: Check your side
Check before you ask the CA to try again. For DNS, use the record name from your order:
dig TXT example.com +short
dig CNAME record-name-from-your-order.example.com +shortOn Windows, use PowerShell:
Resolve-DnsName -Type TXT example.comFor file validation, request the file the way the CA does:
curl -i http://example.com/.well-known/pki-validation/file-name-from-your-order.txtVerify: the DNS answer contains the exact value, or curl shows 200 OK (after any redirect) and the file content. The certificate is then issued; DV certificates usually within minutes.
CAA records
A CAA record names the authorities that may issue certificates for your domain. If your domain has none, any authority may issue. If it has some, the issuing authority must be among them, or the order fails:
dig CAA example.com +shortFor DigiCert, GeoTrust and RapidSSL certificates, the record value digicert.com authorises all three. Keep the entries for other authorities you use, such as the one behind free certificates on your hosting (for example letsencrypt.org).
Troubleshooting
The validation email never arrives. The address does not exist, mail for the domain goes elsewhere, or the message is in spam. Create the mailbox or forwarder, check the domain's MX records, or switch to DNS or file validation.
The DNS record cannot be found. It was added at a DNS host the domain does not use (check the nameservers), the name was doubled (example.com.example.com) by the panel, or the value has extra spaces or quotes. Compare with dig output; see change domain nameservers.
The file returns 404 or 403. It is in the wrong folder, the name differs (Linux is case-sensitive), or a rule in .htaccess, a firewall or a "coming online" page blocks it. Open the address in a private browser window.
Validation passes but the certificate is not issued. A CAA record blocks the authority, or OV and EV organisation checks are still running. Check CAA, and open a ticket if the order stays pending.
Next steps
- Install the issued certificate: order, validate and install an SSL certificate.
- Browser warnings after installing: fix SSL certificate errors.
Frequently asked questions
Which method should I choose?
DNS is the most reliable and works before the website is live; it is also the method that stays after the email method is phased out. File validation suits a site that is already online. Email works only if the approver mailbox exists.
How long does validation take?
For DV certificates, usually minutes once the email is approved or the record or file can be found. OV and EV certificates also need the organisation checks, which take longer.
Can I remove the DNS record or file afterwards?
Yes, once the certificate is issued. Keep it if you expect a reissue soon, because each reissue may ask for validation again.
Does a CAA record block my certificate?
Only if it lists other authorities. If your domain has CAA records, they must include the authority that issues your certificate, for example digicert.com for DigiCert, GeoTrust and RapidSSL certificates.