SC-084: DNS validation labeled with the ACME account ID

SC-084 lets several services validate the same domain through DNS at once. It adds a validation method that works like ACME DNS-01 but puts an account-specific label in front of _acme-challenge, so each ACME account, and therefore each cloud provider, gets its own validation name.

What changed

SC-084 gives every ACME account a distinct DNS validation name that can be delegated separately. With dns-01 the TXT record always lives at _acme-challenge.<domain>. Cloud and CDN providers usually automate validation by asking you to point that name at them with a CNAME, but a name can only have one CNAME, so only one provider at a time could do it. The ballot text describes exactly this problem for organizations using several clouds. The new method, based on the IETF draft draft-ietf-acme-dns-account-label, derives that extra label from the ACME account ID and prepends it. It was proposed by Fastly and endorsed by Mozilla, DigiCert, Microsoft and Chrome.

Effective dates

The BR change took effect on 2025-03-01. CAs may offer the method from then on; it doesn't replace dns-01. The ballot says it references the current draft and that another ballot will update the reference once the draft is published as an RFC.

Who is affected

SC-084 helps organizations that put the same hostname behind more than one CDN, load balancer or hosting provider, each of which wants to obtain its own certificate automatically. Single-provider setups gain nothing and lose nothing.

What to do

No action is needed unless you hit the one-CNAME limit. If you do, ask your CA and providers whether they support the account-labeled method; ACME client and CA support depends on the draft's implementation status. See how ACME works.