Skip to main content

Domain Validation Instructions

Domain Validation is a core step in the SSL certificate application process. It confirms domain control through DNS records, file upload, or email verification. Its core purpose is to prevent unauthorized use, ensuring that only legitimate domain owners can apply for certificates.

I. Why Domain Validation Is Required​

Domain validation is one of the necessary processes in SSL certificate issuance. The main reasons are as follows:

1. Verify Domain Management Rights​

By adding DNS records, file verification, or email verification for the domain, the applicant obtains CA recognition of their domain management authority, verifies the applicant's control over the domain, and prevents third parties from maliciously impersonating others to obtain certificates.

2. Prevent Phishing Attacks​

The domain validation process effectively prevents attackers from forging legitimate domains to create phishing websites, protecting users from the risk of sensitive information disclosure.

3. Comply with Security Standards​

Major browsers require websites to use SSL certificates that have undergone domain validation; otherwise, they are marked as "Not Secure" websites. Domain validation reflects the compliance of SSL certificates.

II. How to Perform Domain Validation​

There are three main methods:

1. DNS Record Validation​

Log in to the domain management platform and add the validation record value provided by the CA in the domain's DNS resolution (the record type is generally TXT or CNAME).

2. File Validation​

Create a specified path in the website root directory and place the corresponding content. The specific validation content is provided by the CA.

3. Email Validation​

The CA sends a verification email to the administrator email reserved during domain registration (such as administrator, webmaster, hostmaster, postmaster@domain). The customer logs in to the email, receives the verification email, and clicks the link to confirm, completing domain validation.

III. Domain Validation Operations by Certificate Brand​

Information
  • Intranet or self-signed certificates do not require domain validation.

1. Sectigo/Positive/sslTrus​

  • DNS resolution: Record types include CNAME and TXT.

  • File validation: Only supports 80/443 port validation.

  • Email validation: WHOIS email (unavailable after June 15, 2025) or administrator email.

    Information
    • To add a TXT record for sslTrus, Sectigo, or Positive, you need to contact Racent customer service to obtain it. The default resolution type is CNAME.

2. Digicert/Geotrust/Thawte​

  • DNS resolution: The type is TXT, and the host record is fixed as: _dnsauth
  • File validation: Only supports 80/443 port validation.
  • Email validation: Administrator email; WHOIS email (unavailable after May 8, 2025).

3. CFCA​

  • DNS resolution: The type is TXT.
  • File validation: Supports 80/443 port validation.
  • Email validation: Administrator email.
Note
  • Starting July 15, 2025, email addresses obtained through WHOIS lookup cannot be used directly for domain control validation. You must use administrator email in the format of admin, administrator, webmaster, hostmaster, postmaster@+main domain for email validation.
  • Currently required by CBA, as stated in the CP/CPS rules on the CFCA official website: HTTP or HTTPS methods must be used, and the port must be an authorized port (i.e., 80 or 443). This takes effect on August 1, 2025.

4. Globalsign​

  • DNS resolution: The type is TXT, and the host record can be left blank.
  • File validation: Only supports 80/443 port validation.
  • Email validation: Administrator email.

5. RapidSSL​

  • The DNS resolution value defaults to a subdomain. If you want to add it to the main domain, the resolution value needs to be regenerated.

IV. Adding DNS Resolution on Major Platforms​

V. Resolution effective detection​

Last updated on