Add one record to your DNS, and your ACME client (such as Certbot or acme.sh) completes DNS validation automatically every time it issues an SSL certificate, without access to your DNS account.
per delegation, per year
Why delegated DNS validation?
When a certificate authority issues an SSL certificate through ACME, it must confirm that you control the domain. The common HTTP validation needs a validation file on your website that the certificate authority can read over the internet on port 80. In the following cases HTTP validation is not possible, and only DNS validation (DNS-01) works, which means adding a specific TXT record to the domain's DNS before every issuance:
- Wildcard certificates: such as
*.example.com; certificate authorities accept DNS validation only. - Servers without a website: such as mail servers (SMTP, IMAP, POP3), VPN, FTP or database servers.
- Devices with no public port 80: such as intranet servers, firewalls, NAS, printers and IoT devices.
- One certificate on several servers: such as servers behind a load balancer, where the validation file may not be on the server that answers the request.
DNS validation itself is simple. The difficulty is automating it, because every issuance changes your DNS.
- Give your DNS provider's API key to the ACME client
- That key can usually change every record of every domain in the account
- If the server is compromised, your DNS can be changed too
- Some DNS providers have no API at all
With delegated DNS validation
- Add one CNAME record, once
- No DNS provider API key needed
- A dedicated key that can only handle the validation records of one domain
- Works with any DNS provider
Benefits
You keep control of your DNS
No DNS account or API key to hand over. Your website, email and other DNS records are not touched.
Set up once
The CNAME record never needs to change. Every later issuance or renewal is validated automatically.
Wildcard certificates supported
One delegation covers validation for example.com, www.example.com and *.example.com certificates.
Limited permissions
Each delegation has its own dedicated key, which can only add or remove the validation records of that domain and nothing else.
How it works
-
Apply
Tell us the domain to delegate. We provide a CNAME target name and a dedicated key for that domain.
-
Add the CNAME record
Add a CNAME record to your DNS that points to the target name we provide. For
example.com:_acme-challenge.example.com CNAME (the target name we provide)If a TXT record already exists under this name, delete it first.
-
Set up your ACME client
Install our validation script on your server (for Certbot or acme.sh) and enter the dedicated key.
-
Validation runs automatically
Whenever a certificate is issued or renewed, the script adds and removes the validation record by itself. No manual work is needed.
Pricing
| Item | Details |
|---|---|
| Delegated DNS validation | HK$300 per delegation, per year |
| Each delegation covers | One domain and its www name, such as example.com and www.example.com, including the *.example.com wildcard certificate |
| Other subdomains | Each subdomain needs its own delegation, such as shop.example.com |
The fee covers the delegated DNS validation service only, not the SSL certificate.
Frequently asked questions
No. Your domain and DNS stay with your current provider. You only add one CNAME record.
No. The CNAME record is used for certificate validation only (its name starts with _acme-challenge) and is separate from your website and email records.
We provide validation scripts for Certbot and acme.sh. To use another ACME client, please contact us.
It works for certificates issued through the ACME protocol, such as DigiCert or Sectigo ACME certificates. Certificates ordered without ACME use a different validation method and are not covered.
If the service is not renewed, the dedicated key is disabled and later validations need another method. Certificates already issued are not affected and stay valid until they expire.
