# SC-084: DNS validation labeled with the ACME account ID

> SC-084 adds a DNS validation method like ACME dns-01 but with an account-specific label, so several providers can validate the same domain via CNAME.

Source: https://ssl.sh/ballots/sc-084/
Last updated: 2026-11-10

SC-084 lets several services validate the same domain through DNS at once. It adds a validation method that works like ACME [DNS-01](https://ssl.sh/glossary/dns-01/) but puts an account-specific label in front of `_acme-challenge`, so each ACME account, and therefore each cloud provider, gets its own validation name.

## What changed

SC-084 gives every ACME account a distinct DNS validation name that can be delegated separately. With dns-01 the TXT record always lives at `_acme-challenge.<domain>`. Cloud and CDN providers usually automate validation by asking you to point that name at them with a CNAME, but a name can only have one CNAME, so only one provider at a time could do it. The ballot text describes exactly this problem for organizations using several clouds. The new method, based on the IETF draft draft-ietf-acme-dns-account-label, derives that extra label from the ACME account ID and prepends it. It was proposed by Fastly and endorsed by Mozilla, DigiCert, Microsoft and Chrome.

## Effective dates

The BR change took effect on 2025-03-01. CAs may offer the method from then on; it doesn't replace dns-01. The ballot says it references the current draft and that another ballot will update the reference once the draft is published as an RFC.

## Who is affected

SC-084 helps organizations that put the same hostname behind more than one CDN, load balancer or hosting provider, each of which wants to obtain its own certificate automatically. Single-provider setups gain nothing and lose nothing.

## What to do

No action is needed unless you hit the one-CNAME limit. If you do, ask your CA and providers whether they support the account-labeled method; ACME client and CA support depends on the draft's implementation status. See [how ACME works](https://ssl.sh/learn/acme-protocol/).


| Field | Value |
|---|---|
| Ballot | SC-084 |
| Status | Passed |
| Adopted | 2025-01-28 |
| Effective | 2025-03-01 |
| BR version | 2.1.4 |
| Official page | https://cabforum.org/2025/01/28/ballot-sc084-dns-labeled-with-acme-account-id-validation-method/ |