中文

Glossary

Domain Control Validation (DCV)

Last verified

Definition

Domain control validation (DCV) is the check a CA performs to confirm that a certificate applicant controls each domain name the certificate will contain.

Domain control validation is required before any publicly trusted TLS certificate is issued, and for a DV certificate it is the only identity check. The Baseline Requirements (section 3.2.2.4) list the permitted methods. The main families are placing a random value in a DNS TXT record, serving a file under /.well-known/pki-validation/, answering an ACME challenge such as HTTP-01, DNS-01 or TLS-ALPN-01, and replying to email sent to a constructed address such as admin@ or hostmaster@ the domain.

Why it matters

DCV is the security foundation of the web PKI: if it can be fooled, a CA issues a valid certificate to an attacker. That is why the rules keep tightening. Ballot SC-067 requires MPIC, and Ballot SC-081v3 shortens how long a CA may reuse a completed validation: 200 days from 2026-03-15, 100 days from 2027-03-15 and only 10 days from 2029-03-15. Teams that validate by hand will have to repeat DCV far more often, which pushes everyone toward automation.

Example

Confirm that the values a CA asked for are publicly visible before clicking "verify":

# DNS method: TXT record with the CA's random value
dig TXT example.com +short @8.8.8.8

# File method: the CA-specified file must load over plain HTTP
curl -i http://example.com/.well-known/pki-validation/<file-from-ca>.txt

Common misconceptions

  • DCV proves who owns the domain. It only proves control at that moment; OV and EV certificates add organization checks.
  • A domain is validated once and for all. Reuse periods are limited and shrink to 10 days from 2029-03-15.
  • Wildcards can be validated with an HTTP file. File-based methods cannot validate wildcard names; ACME CAs require DNS-01 for them.

See also