Skip to content

Domain Validation (DCV)

Before issuing any certificate, every Certificate Authority (CA) needs to confirm one thing: that whoever is requesting the certificate actually controls the domain. This process is called DCV — Domain Control Validation, and it's mandatory for every certificate type, DV, OV or EV.

Why this step exists

Without DCV, anyone could request a certificate for bank.com without ever having controlled the domain — which would break the entire guarantee SSL/TLS exists to provide. DCV is the barrier that prevents this: the CA only issues the certificate after receiving proof of control that only the domain's owner can supply.

Three methods are accepted. InteSys guides and follows up on all three through to issuance.

The CA provides a unique value (a CNAME or TXT record) that you publish in the domain's DNS zone. The CA queries public DNS, finds the record and confirms control.

Why it's the preferred method:

  • it doesn't depend on a specific mailbox being active;
  • it works even for domains with no email configured;
  • it can be automated for future renewals, when the DNS provider supports an API;
  • it's the most predictable method for environments with multiple subdomains or a Wildcard.

DNS record propagation can take anywhere from a few minutes to a few hours depending on the zone's TTL — that's the main source of delay with this method, not a CA limitation.

Email method: which addresses it's sent to

The CA sends a confirmation email to a predefined set of administrative addresses for the domain, such as:

[email protected]
[email protected]
[email protected]
[email protected]
[email protected]

Or to the domain's WHOIS contact email, when publicly available. The requester clicks the confirmation link received, and validation completes immediately after the click.

Watch out: if none of these addresses is active or monitored, the method fails silently until someone checks the mailbox — the DNS method tends to be more reliable when you're not sure these mailboxes are checked regularly.

File-upload method: when to use it

The CA provides a file with a specific name and content, which must be published at a predetermined path on the web server, typically:

http://yourdomain.com/.well-known/pki-validation/provided-file.txt

The CA accesses that URL over HTTP and confirms the content. It's a good alternative when you have access to the web server but not quick access to the DNS panel — for example, DNS managed by a different team or provider.

What changes for OV and EV

For DV certificates, DCV is the only verification — once domain control is confirmed, issuance is nearly immediate.

For OV and EV, DCV is still mandatory, but it's only the first step. The CA adds a verification of the company's legal existence, through:

  • checks against government/business registries (tax ID, chamber of commerce or equivalent);
  • a phone confirmation in some cases, for EV;
  • additional identity verification of the requester, for EV.

That's why OV takes 1 to 3 business days and EV takes 3 to 5 business days to issue, while DV can go out in minutes — the domain is validated the same way in all three cases, but OV and EV add the company check on top.

Why DCV is repeating more often

A CA can, within certain limits, reuse a domain validation that was already performed instead of repeating the full DCV on every issuance. The CA/Browser Forum has drastically cut that reuse window: from 398 days down to just 10 days for domain validation (organization-existence validation for OV/EV stays at 398 days for now).

In practice, this means almost every reissuance — even within a multi-year subscription with automatic reissuance — has to repeat DCV, because the previous validation is no longer inside the reuse window. Environments relying on the DNS method with an automated API feel this least: the record is recreated and confirmed with no manual intervention on every cycle. Environments validating by email or manual file upload will need to repeat that action every few months, not once a year.

How InteSys follows through to issuance

When you request a certificate with InteSys, our team:

  1. identifies the DCV method best suited to your environment (DNS in most cases);
  2. provides the record, email address or file required by the CA;
  3. follows the propagation/confirmation through to the CA recognizing the validation;
  4. for OV/EV, guides you through any additional documentation the CA may request;
  5. delivers the issued certificate, ready for installation.

You're not left alone editing DNS records or interpreting CA requirements — validation still involves these manual steps today, but they're handled together with our team.

Request your certificate and our team handles DCV through to issuance — see InteSys SSL Certificates

Next Steps