Persistent DNS Validation (DNS-PERSIST-01): What's Changing and Why It Matters for Wildcard SSL

A Quick Recap: How DNS Validation Works Today

To prove you control a domain, a Certificate Authority (CA) needs evidence before issuing a certificate. There are two common methods:

• HTTP-01 — the CA gives you a token, you host it at a specific URL on your website, and the CA checks it's there.
• DNS-01 — the CA gives you a value to publish as a DNS TXT record, and the CA checks your DNS for it.

Wildcard certificates (*.yourdomain.com) can only use DNS-01. HTTP-01 can only prove control of one specific hostname, not an entire range of subdomains, so the CA/Browser Forum rules don't allow it for wildcards. If you run wildcard SSL, DNS validation isn't optional — it's your only path.

The Problem: DNS-01 Was Built for Occasional Use, Not Constant Renewal

Every time a certificate using DNS-01 needs to be issued or renewed, a new, unique TXT record has to be published to your DNS zone, verified, and then typically removed. That's manageable when certificates last a year. It becomes a real operational burden when certificates last 100 days — and eventually 47.

For wildcard certificates specifically, this means:

• DNS records need updating on every renewal cycle, indefinitely
• Automation tools need standing write-access credentials to your DNS provider
• Enterprise environments with change-management processes around DNS face renewal friction every 1–3 months instead of once a year

What's New: DNS-PERSIST-01

In October 2025, the CA/Browser Forum passed ballot SC-088v3, defining a new validation method: “DNS TXT Record with Persistent Value.” The IETF's ACME working group adopted the corresponding draft standard the same month. Instead of publishing a new record for every single validation, you publish one persistent DNS TXT record, once, bound to your CA and your specific ACME account. The CA can then reuse that proof of control for future issuances — including renewals — without requiring a new DNS update each time.

Major CAs and browser vendors (Chrome, Mozilla, and Cisco among them) voted in favor of the ballot, and CA's have confirmed staging support planned for early 2026 with production rollout following later in the year. GoGetSSL extends support for DNS-PERSIST-01 across ACME CaaS and AutoInstall SSL

Sample of Persisent DNS Record

{
                                     _validation-persist.example.com. IN TXT (
                                   "ca.gogetssl.com;"
                                   "accounturi=https://acme.gogetssl.com/acme/acct/234624422;"
                                  "policy=wildcard"
                                 )
                                

Regular DNS Validation vs. Persistent DNS Validation

If TCP port 80 is free on this server and reachable from the internet — common on a dedicated stunnel host — use standalone HTTP validation. A port that is free locally is not necessarily reachable, so check the OS firewall and any cloud security group first.

	Regular DNS-01 Regular DNS-01	Persistent DNS-PERSIST-01 Persistent DNS-PERSIST-01
DNS TXT Comparison
DNS TXT Automation Comparison
DNS record
DNS record	New, unique TXT value published for every validation	One TXT record, published once, reused
Effort per renewal
Effort per renewal	DNS must be updated every issuance cycle	No DNS changes needed after initial setup
Best suited for
Best suited for	Infrequent issuance, single certificates	High-frequency reissuance — short-lived certs, wildcard, large multi-domain estates
Proof freshness
Proof freshness	Fresh proof of control captured at every issuance	Reuses an earlier proof, verified once
Ongoing DNS API access needed
Ongoing DNS API access needed	Often yes, for automated clients	No — after first setup, no standing DNS credentials required
Wildcard SSL support
Wildcard SSL support	Yes — the only validation method wildcards can use	Yes — and removes the repeat-DNS-update burden unique to wildcards
Security model
Security model	Smaller exposure window per record; nothing persists	Record persists — requires periodic review and DNS security hygiene
Governing standard
Governing standard	ACME dns-01 (RFC 8555), long established	New dns-persist-01 (IETF draft + CA/Browser Forum SC-088v3, Oct 2025)
Governing standard
Availability today	Widely supported across all major CAs	Rolling out through 2026, CA by CA

Why This Matters Most for Wildcard and ACME Automation

Wildcard certificates were already the hardest case for automation — DNS-01 was mandatory, and every short renewal cycle meant another round of DNS updates. As validity periods drop toward 100 and then 47 days, that repetition compounds fast: a wildcard certificate on a 47-day cycle would need roughly 8 DNS updates a year under the old model, versus effectively zero after initial setup with DNS-PERSIST-01.

This is also a natural fit alongside ACME automation — the whole point of ACME is removing manual steps from certificate issuance, and DNS-PERSIST-01 removes the one manual step (DNS record updates) that automation tools previously had to work around using CNAME delegation tricks.

A Fair Note on Security Trade-Offs

Persistent validation isn't purely an upgrade — it's a genuine trade-off, and worth understanding honestly rather than only as a convenience win:

• Because the record persists, anyone who compromises your DNS zone could potentially request certificates for your domain until the record is removed — a longer exposure window than a one-time record that disappears after use.
• The standard includes safeguards for this: an optional persistUntil parameter to bound how long a record stays valid, and a recommendation that domain owners audit _validation-persist records after any DNS security incident, since a pre-provisioned record can outlive the window of a compromise.
• Traditional DNS-01 remains available and isn't going away — for domains where you'd rather prove fresh control at every single issuance, sticking with regular DNS-01 is still a completely valid choice.