Domain Validation (DV) and the DCV Process
-
D
A Domain Validation (DV) certificate confirms one thing: that you control the domain you are requesting a certificate for. No company paperwork, no organizational checks — just proof of domain ownership.
This makes DV certificates the fastest to issue, typically within minutes, and a good fit for blogs, personal projects, and any site where encryption is the goal rather than displaying verified business identity. For that level of trust, OV and EV certificates are the better choice.
-
*
DCV — How Domain Control Validation Works
Before issuing any certificate, the Certificate Authority needs proof that you actually control the domain. This step is called Domain Control Validation (DCV), and it applies to every certificate type, not just DV. There are three common ways to complete it.
-
Email validation
Email validation is the most traditional method. The CA sends a verification email containing a unique code and link to one of five standard administrative addresses on your domain — admin@, administrator@, hostmaster@, postmaster@, or webmaster@. You simply click the link or enter the code to confirm ownership.
-
DNS validation (CNAME or TXT)
DNS validation (CNAME or TXT) works by adding a specific DNS record — either a CNAME or a TXT record — containing a hash extracted from your CSR. The CA checks for this record and issues the certificate once it is found. This method is fully automatic and is especially useful when you do not have a working mailbox on the domain. It usually takes anywhere from a few minutes up to 24 hours, depending on your DNS provider’s TTL settings.
Tip: Use a DNS checker like WhatsMyDNS to look up the TXT or CNAME record you created. If it doesn’t show up, or the returned values don’t exactly match the validation instructions, you’ll need to fix that on your DNS side before the CA can verify it.
-
HTTP/HTTPS file validation
HTTP/HTTPS file validation is the simplest method for sites that are already live. You upload a small text file containing a hash from your CSR to a specific location on your server, and the CA verifies it is accessible over the web. If your site is already running on HTTPS, you can use the HTTPS version of this check.
Two cases where file validation is the only option — or not allowed:
- An IP address (with no fully qualified domain name) must use file-based validation — email and DNS methods are not available for it.
- Wildcard domains (such as *.example.com) cannot be validated by file. Use email or DNS validation instead.
If your server sits behind a firewall, WAF, or CDN, make sure the validation request can actually reach the file. The CA checks it from multiple locations around the world (see MPIC below) and does not publish a complete list of the IP addresses it uses, so whitelisting specific addresses isn’t reliable.
Instead, disable any geographic or country-based restrictions for the duration of validation so the file stays reachable from anywhere. You can re-enable them once the certificate has been issued.
If your server sits behind a firewall, WAF, or CDN, make sure the validation request can actually reach the file. The CA checks it from multiple locations around the world (see MPIC below) and does not publish a complete list of the IP addresses it uses, so whitelisting specific addresses isn’t reliable. Instead, disable any geographic or country-based restrictions for the duration of validation so the file stays reachable from anywhere. You can re-enable them once the certificate has been issued.
-
-
*
CAA Check
After domain ownership is confirmed, the CA also checks for a CAA (Certification Authority Authorization) record on your domain. A CAA record specifies which CAs are allowed to issue certificates for it — if your domain has one that does not include the CA you ordered from, the order is held until the record is updated. If no CAA record exists, any CA may issue by default.
-
*
MPIC — Multi-Perspective Issuance Corroboration
As of 2025, CAs are required to validate domain control from multiple independent network vantage points rather than a single location, a measure designed to prevent certain network-level attacks during validation. This requirement is known as MPIC. It applies automatically to all DCV methods and requires no extra action from you, though it can occasionally affect issuance timing. For more detail, see our guide: Multi-Perspective Issuance Corroboration (MPIC).
-
*
DNSSEC
DNSSEC (Domain Name System Security Extensions) adds cryptographic signing to DNS records, protecting against DNS spoofing and certain man-in-the-middle attacks during validation. CAs are moving toward requiring DNSSEC validation for domains that have it enabled, as part of broader industry efforts to strengthen the domain validation process. For details on this industry change and how it may affect your domain, see: DNSSEC Becoming Mandatory.
Tip: DNSSEC problems are best handled by your DNS zone manager or hosting provider. To spot issues before they hold up a certificate, check your domain on dnssec.health.
-
*
DNSSEC
In some cases, an order may be flagged for manual review even after DCV is completed successfully — for example, if the domain or request triggers an internal risk check at the CA. When this happens, review typically takes 24 to 48 hours. If your order is placed on hold, our support team can help clarify the reason and the next steps.
-
