SC-088v3: a persistent DNS TXT record for domain validation

SC-088v3 lets you validate a domain once with a DNS TXT record that never has to change. The new method 3.2.2.4.22 binds a TXT record to your account at the CA; as long as it stays in DNS, the CA can re-check it for every new certificate without you touching DNS again.

What changed

SC-088v3 added "DNS TXT Record with Persistent Value" to §3.2.2.4 of the Baseline Requirements, so one TXT record can serve every validation. Existing DNS methods, such as DNS-01 in ACME, require a fresh random value in a TXT record for each validation, which means DNS API credentials on the server or a manual DNS edit every time. The new record lives at _validation-persist.<domain> and uses CAA-style syntax: the CA's issuer domain name plus an accounturi parameter naming your account, optionally with a persistUntil expiry timestamp:

_validation-persist.example.com. IN TXT "authority.example; accounturi=https://authority.example/acct/123"

The ballot text says this keeps security equivalent to the existing DNS methods while removing the per-renewal DNS update. Amazon Trust Services proposed it; Google Chrome, DigiCert and Sectigo endorsed it.

Effective dates

The method became available on 2025-11-10, when the BR change took effect. It is optional: CAs may offer it but don't have to. Validations with this method must use MPIC, and the current BR caps their reuse at 10 days, so the CA re-checks the record often; the point is that the re-check needs no DNS change.

Who is affected

SC-088v3 helps operators who can't or don't want to keep DNS API keys on web servers, and organizations where a separate team owns DNS. It pairs well with the shorter lifetimes coming in 2026–2029 and with the end of email validation under SC-090.

What to do

Check whether your CA supports method 3.2.2.4.22 and what record format it expects. Keep the record protected like any other authorization, and remove it if you stop using that CA account.