SC-090: email and phone domain validation phased out by 2028

SC-090 ends domain validation by email and phone. Between 2026-03-15 and 2028-03-15, CAs must stop using every email-based and phone-based method for proving control of a domain or IP address, starting with the "IP Address" method that the ballot says enables crossover attacks.

What changed

SC-090 sunsets eight validation methods from the Baseline Requirements. Email and phone methods: 3.2.2.4.4 (constructed email to admin@, administrator@, webmaster@, hostmaster@ or postmaster@), 3.2.2.4.13 (email to DNS CAA contact), 3.2.2.4.14 (email to DNS TXT contact), 3.2.2.4.16 and 3.2.2.4.17 (phone contact via DNS TXT or CAA), and for IP addresses 3.2.2.5.2 and 3.2.2.5.5. The crossover-prone method: 3.2.2.4.8 (IP Address). The ballot's reasoning: MPIC can check the DNS lookup of a contact address, but it cannot stop an attacker who hijacks the mail server's IP address and intercepts the validation email.

Effective dates

The BR change took effect on 2026-01-12. Method 3.2.2.4.8 ends on 2026-03-15; the phone methods and IP-contact email on 2027-03-15; the remaining email methods on 2028-03-15.

Who is affected

SC-090 affects anyone who validates domains by clicking a link in an email to admin@ or webmaster@, a common choice for manually ordered OV, EV and some DV certificates, and for organizations where the certificate buyer can't edit DNS or the web server. ACME users already use DNS or HTTP validation.

What to do

Move to DNS-based validation (a TXT record, DNS-01, or the reusable persistent TXT record from SC-088v3) or website-based validation (HTTP-01). If DNS is managed by another team, agree on a delegation (for example a CNAME for the validation label) well before March 2028.