# What Is DNS-01 Challenge (DNS-01)? Definition and Examples

> DNS-01 is an ACME challenge in which the client proves domain control by publishing a CA-derived value in a TXT record at _acme-challenge.

Source: https://ssl.sh/glossary/dns-01/
Last updated: 2026-11-10

DNS-01 is the [ACME](https://ssl.sh/glossary/acme/) challenge that validates through DNS. The client computes the base64url-encoded SHA-256 digest of the key authorization and publishes it as a TXT record at _acme-challenge.example.com; the CA queries that name from several network perspectives and compares the value. It is the only ACME method that can validate a [wildcard certificate](https://ssl.sh/glossary/wildcard-certificate/), and it works for servers that are not reachable from the internet at all.

## Why it matters
DNS-01 decouples certificates from web servers: one machine holding DNS API credentials can obtain certificates for internal hosts, load-balanced clusters or wildcard names and deploy them elsewhere. The costs are security and timing. DNS API keys are powerful, so limit their scope, and the record must be visible on every authoritative server before the CA checks it. A common hardening step is to point _acme-challenge with a CNAME to a separate zone, so the ACME client needs write access only there. [CAA](https://ssl.sh/glossary/caa/) records still apply as usual.

## Example
acme.sh with the Alibaba Cloud DNS API, issuing a certificate for the bare domain and a wildcard:

```bash
export Ali_Key="<key>" Ali_Secret="<secret>"
acme.sh --issue --dns dns_ali -d example.com -d '*.example.com'

# Check what the CA will see
dig TXT _acme-challenge.example.com +short
```

## Common misconceptions
- **DNS-01 needs the web server to be online.** It only needs DNS; the server can be offline or private.
- **A low TTL makes the record appear instantly.** TTL controls caching, not how fast your provider publishes the record to all its authoritative servers.
- **A wildcard certificate covers the bare domain.** *.example.com does not match example.com; request both names, which places two TXT values at the same _acme-challenge name.

## Related terms

- [ACME](https://ssl.sh/zh/glossary/acme/): ACME 是 IETF 标准协议（RFC 8555），让软件自动向 CA 证明域名控制权，并自动申请、续期和吊销证书。
- [DCV](https://ssl.sh/zh/glossary/dcv/): DCV 即域名控制权验证，是 CA 在签发证书前确认申请者确实控制证书中每一个域名的检查。
- [HTTP-01](https://ssl.sh/zh/glossary/http-01/): HTTP-01 是一种 ACME 验证方式，客户端通过 80 端口以普通 HTTP 提供 CA 指定的令牌内容来证明域名控制权。
- [通配符证书](https://ssl.sh/zh/glossary/wildcard-certificate/): 通配符证书是名称以星号开头（如 *.example.com）、可匹配该域名下任意一级子域名的 TLS 证书。
- [MPIC](https://ssl.sh/zh/glossary/mpic/): MPIC 是要求 CA 从多个网络位置重复进行域名验证和 CAA 检查、只有足够多位置结果一致才签发证书的规则。
- [DNSSEC](https://ssl.sh/zh/glossary/dnssec/): DNSSEC 是一组 DNS 扩展，让解析器能沿着从根区开始的签名链，验证 DNS 应答确实来自权威方且未被篡改。
- [CAA 记录](https://ssl.sh/zh/glossary/caa/): CAA 记录是一种 DNS 记录，用来声明哪些证书颁发机构可以为该域名签发证书，所有公共 CA 签发前都必须检查。