How to validate your domain: the three methods
Before it will issue a certificate, the certificate authority has to confirm the domain is yours. This is domain control validation (DCV) and it is mandatory: without it there is no certificate, however paid-for the order is.
You choose the method when you enrol the order, and you can change it later if the one you picked turns out not to work.
The three methods
| Method | How long | When it suits you |
|---|---|---|
| Approver email | Minutes | You can read a mailbox at the domain |
| DNS record | 15 min to 2 hours | You manage the DNS but not the email |
| HTTP file | Minutes | You manage the web server |
None of them is "better". The right one is the one you can finish today.
Approver email
The authority sends a confirmation link to an address at the domain itself. Your Gmail will not do: the point is to show you control the domain.
The accepted addresses are a fixed set:
admin@yourdomain.com
administrator@yourdomain.com
hostmaster@yourdomain.com
postmaster@yourdomain.com
webmaster@yourdomain.com
The address listed as the administrative contact in the domain's WHOIS also works, if it is public.
If the email does not arrive, in order: check spam; confirm that mailbox actually exists and is not a broken alias; and if your domain has WHOIS privacy protection, that address will not work. You can request a resend or change the address from your dashboard.
DNS record
The authority gives you a unique value and you create a DNS record holding it. When it sees the record, it issues.
This is the easiest method when the domain and the email are in different hands — common enough when a third party runs the mail.
Watch the TTL: if your zone has a high one, the change can take a while to propagate. Lowering it before you create the record shortens the wait.
If the domain has a CAA record, check that it authorises the authority about to issue. A misconfigured CAA blocks issuance even when validation itself is fine.
HTTP file
The authority gives you a text file and you upload it to a specific path on your server:
http://yourdomain.com/.well-known/pki-validation/<file-name>.txt
The authority downloads it and validates. This is the fastest method if you already have access to the web server.
Three things break it, and it is always the same three:
- Redirects. If your site sends everything to HTTPS or to
www, the download can fail. That path has to answer directly. - Rewrites. An
.htaccessor an nginx rule that catches every URL will catch this one too. - The content type. The file has to be served as plain text, not as HTML.
Changing method
If the one you chose is not working, you do not need to buy anything again: from your dashboard you can change the method or the approver address as often as you need, and it stays the same order.
How long validation lasts
Once validated, the domain stays validated for a period, and reissues within it do not ask again. After that, the next issuance validates afresh.
If something is not moving, get in touch with your domain and we will look at where the order actually is.
