DNS proves control of a record
04A TXT record carries a digest of the challenge’s key authorization.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8.4 ↗
RFC 8555 · § 8.4EXAMPLE
3 / 3
03
CA resolves
The expected TXT value proves the required control for this challenge.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
dns-01 uses a name under _acme-challenge.
- dns-01 uses a name under _acme-challenge.
- The TXT value is the base64url-encoded SHA-256 digest of the key authorization.
- The CA checks the record against the expected value.
The illustration is schematic. Example values are illustrative; profiles and later security guidance can add requirements.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy