# What Is Domain Control Validation (DCV)? Definition and Examples

> Domain control validation (DCV) is the check a CA performs to confirm that a certificate applicant controls each domain name the certificate will contain.

Source: https://ssl.sh/glossary/dcv/
Last updated: 2026-11-10

Domain control validation is required before any publicly trusted TLS certificate is issued, and for a [DV certificate](https://ssl.sh/glossary/dv-certificate/) it is the only identity check. The Baseline Requirements (section 3.2.2.4) list the permitted methods. The main families are placing a random value in a DNS TXT record, serving a file under /.well-known/pki-validation/, answering an [ACME](https://ssl.sh/glossary/acme/) challenge such as HTTP-01, DNS-01 or TLS-ALPN-01, and replying to email sent to a constructed address such as admin@ or hostmaster@ the domain.

## Why it matters
DCV is the security foundation of the web PKI: if it can be fooled, a CA issues a valid certificate to an attacker. That is why the rules keep tightening. Ballot SC-067 requires [MPIC](https://ssl.sh/glossary/mpic/), and Ballot SC-081v3 shortens how long a CA may reuse a completed validation: 200 days from 2026-03-15, 100 days from 2027-03-15 and only 10 days from 2029-03-15. Teams that validate by hand will have to repeat DCV far more often, which pushes everyone toward automation.

## Example
Confirm that the values a CA asked for are publicly visible before clicking "verify":

```bash
# DNS method: TXT record with the CA's random value
dig TXT example.com +short @8.8.8.8

# File method: the CA-specified file must load over plain HTTP
curl -i http://example.com/.well-known/pki-validation/<file-from-ca>.txt
```

## Common misconceptions
- **DCV proves who owns the domain.** It only proves control at that moment; OV and EV certificates add organization checks.
- **A domain is validated once and for all.** Reuse periods are limited and shrink to 10 days from 2029-03-15.
- **Wildcards can be validated with an HTTP file.** File-based methods cannot validate wildcard names; ACME CAs require DNS-01 for them.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。
- [DNS-01](https://ssl.sh/zh/glossary/dns-01/): DNS-01 是一种 ACME 验证方式，客户端在 _acme-challenge 子域名下发布由 CA 质询计算出的 TXT 记录来证明域名控制权。
- [TLS-ALPN-01](https://ssl.sh/zh/glossary/tls-alpn-01/): TLS-ALPN-01 是一种 ACME 验证方式，服务器在 443 端口针对 acme-tls/1 协议出示一张特殊证书来证明域名控制权。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。
- [DV 证书](https://ssl.sh/zh/glossary/dv-certificate/): DV 证书是 CA 只验证申请者对域名的控制权、不核实申请者身份的 TLS 证书，签发快且可以完全自动化。
- [Baseline Requirements](https://ssl.sh/zh/glossary/baseline-requirements/): Baseline Requirements 是 CA/B 论坛制定的基线要求，规定公开信任的 CA 在验证、签发和吊销 TLS 服务器证书时必须遵守的规则。