SC-080v3: WHOIS-based domain validation is sunset

SC-080v3 retired the domain validation methods that rely on the WHOIS "domain contact". Since 2025-07-15 a CA can no longer prove you control a domain by emailing, faxing, texting, mailing or phoning the contact listed in WHOIS; before that, from 2025-01-15, WHOIS lookups had to use official IANA-listed sources only.

What changed

SC-080v3 hardened WHOIS lookups and retired two WHOIS-based validation methods. For lookups, CAs must use WHOIS or RDAP servers listed by IANA and must not rely on HTTPS websites that present WHOIS data. This followed a 2024 disclosure showing how weak WHOIS tooling could be abused to obtain fraudulent certificates. The retired methods are 3.2.2.4.2 ("Email, Fax, SMS, or Postal Mail to Domain Contact") and 3.2.2.4.15 ("Phone Contact with Domain Contact").

Effective dates

The BR change took effect on 2024-12-16. The IANA-sources rule applied from 2025-01-15, and the two methods were banned from 2025-07-15.

Who is affected

SC-080v3 mostly affected buyers of OV and EV certificates and of certificates for domains whose owners never touch DNS or the web server, since email-to-WHOIS-contact was a common fallback. Privacy-protected WHOIS records had already made the method unreliable. ACME users are not affected.

What to do

Use a validation method based on DNS (a TXT record or DNS-01), on the website (HTTP-01 or a file upload), or on email to an address the CA constructs, such as admin@ or webmaster@, which remained allowed for now; SC-090 schedules those email methods for removal too.