DNS-01 Challenge (DNS-01)

DNS-01 is the ACME challenge that validates through DNS. The client computes the base64url-encoded SHA-256 digest of the key authorization and publishes it as a TXT record at _acme-challenge.example.com; the CA queries that name from several network perspectives and compares the value. It is the only ACME method that can validate a wildcard certificate, and it works for servers that are not reachable from the internet at all.

Why it matters

DNS-01 decouples certificates from web servers: one machine holding DNS API credentials can obtain certificates for internal hosts, load-balanced clusters or wildcard names and deploy them elsewhere. The costs are security and timing. DNS API keys are powerful, so limit their scope, and the record must be visible on every authoritative server before the CA checks it. A common hardening step is to point _acme-challenge with a CNAME to a separate zone, so the ACME client needs write access only there. CAA records still apply as usual.

Example

acme.sh with the Alibaba Cloud DNS API, issuing a certificate for the bare domain and a wildcard:

export Ali_Key="<key>" Ali_Secret="<secret>"
acme.sh --issue --dns dns_ali -d example.com -d '*.example.com'

# Check what the CA will see
dig TXT _acme-challenge.example.com +short

Common misconceptions

• DNS-01 needs the web server to be online. It only needs DNS; the server can be offline or private.
• A low TTL makes the record appear instantly. TTL controls caching, not how fast your provider publishes the record to all its authoritative servers.
• A wildcard certificate covers the bare domain. *.example.com does not match example.com; request both names, which places two TXT values at the same _acme-challenge name.