Topic starter
24/06/2026 7:06 pm
TL;DR: A new DNS-based domain control validation method lets certificate authorities verify ownership with a persistent TXT record instead of recurring DNS write access, reducing operational friction and attack surface, according to DigiCert and the CA/Browser Forum. The shift matters because certificate automation now depends less on standing DNS privileges and more on tightly scoped, auditable domain control.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “A New DNS Validation Method for Simplified Certificate Automation”.
Key questions
Q: How should teams govern persistent DNS validation for certificate automation?
A: Teams should treat persistent DNS validation as a governed lifecycle object, not a one-time technical workaround.
Q: Why does DNS-PERSIST-01 reduce risk compared with recurring DNS-01 updates?
A: It reduces risk because the older model depends on standing DNS write privileges every time a record must be created or refreshed.
Q: What breaks when DNS automation and certificate lifecycle share the same credential?
A: The credential becomes over-burdened and harder to govern.
Practitioner guidance
- Reclassify DNS validation as governed lifecycle state Track persistent validation records alongside certificates, owners, and renewal schedules so the proof of control is reviewable and revocable.
- Remove recurring DNS write access where possible Use the persistent DNS method for supported domain and CA pairings so operators do not retain standing DNS change rights for routine renewals.
- Bind validation records to explicit expiry Require an expiration value and an accountable owner for each persistent TXT record so validation does not outlive the relationship it represents.
Bottom line: Persistent DNS validation reduces the need for recurring DNS write access, which changes certificate automation from an access problem into a lifecycle governance problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:15 am
Persistent DNS validation is really a lifecycle control, not just a technical shortcut. The important change is that validation no longer depends on repeated DNS write access for every certificate renewal. That shifts the security question from operational convenience to governance over a durable trust artefact, which is exactly where certificate lifecycle discipline belongs. Practitioners should treat the validation record as a governed identity assertion, not a convenience setting.
A question worth separating out:
Q: What should security teams review before adopting persistent DNS validation?
A: They should confirm who owns the validation record, how the CA and account identifier are scoped, whether expiry is enforced, and how offboarding will work when domains or providers change. Those questions determine whether the method reduces risk or simply moves privilege into a less visible place.
👉 Read our full editorial: Persistent DNS validation changes certificate automation governance