Delegated DCV

What is DCV

Domain Control Validation (DCV) is the process by which a certification authority (CA) verifies that an applicant controls a domain before issuing a certificate.

Use cases

• For CNAME-accessed sites whose domain does not resolve to ESA, the ESA console defaults to HTTP verification for Let's Encrypt certificates. If you cannot deploy the HTTP verification file, configure delegated DCV to bypass HTTP verification.

• DigiCert certificates support only DNS verification. For CNAME-accessed sites, configure delegated DCV to ensure correct certificate issuance and renewal.

Configure delegated DCV

1. In the ESA console, choose Websites. In the Website column, click the target site.

2. In the navigation pane on the left, choose SSL/TLS > Edge Certificates.

3. In the Delegated DCV section, copy the CNAME record information.

   

   Note

   Instructions for replacing hostname:

   • If the delegated domain is a wildcard domain, such as *.example.com, hostname is example.com.

   • If the delegated domain is not a wildcard domain, such as esa.example.com, hostname is esa.example.com.

4. Add a CNAME record at your DNS provider. This example uses Alibaba Cloud DNS. Log on to the Alibaba Cloud DNS console. In the navigation pane on the left, click Public Zone. On the Public Zone page, find the domain name and click Settings.

   

5. On the Settings page, click Add Record. Set Record Type to CNAME. Paste the values from Step 3 into the Hostname and Record Value fields. Click OK.

   Domain name type	Example domain name	Host record for your DNS provider	Record value
   Root domain	example.com	_dnsauth	example.com.SiteID.dcv.aliyun-esa.com
   Subdomain	www.example.com	_dnsauth.www	www.example.com.SiteID.dcv.aliyun-esa.com
   Wildcard domain name	*.example.com	_dnsauth	example.com.SiteID.dcv.aliyun-esa.com
   Multi-level subdomain	api.test.example.com	_dnsauth.api.test	api.test.example.com.SiteID.dcv.aliyun-esa.com

After you add or modify the delegated DCV CNAME record at your DNS provider, go to the ESA console to manually apply for a free certificate. The system does not automatically trigger verification after DNS changes.

Keep the following in mind:

• After the certificate is successfully issued, do not delete the DCV record from your DNS provider. Deleting it causes future auto-renewal failures.

• If certificate application fails or keeps timing out: verify that DNS propagation has taken effect (typically up to 10 minutes); confirm the host record format is correct (_acme-challenge for Let's Encrypt, _dnsauth for DigiCert); delete any conflicting old validation records and retry.

Multi-level subdomains: When applying for a certificate for a multi-level subdomain (such as hw.drive.example.com), set the host record to only the prefix (for example, _dnsauth.hw.drive). Do not include the full domain name in the host record—this causes validation to fail. Note that wildcard certificates (such as *.example.com) do not cover third-level or deeper subdomains. Apply for a separate certificate and configure a corresponding DCV record for each multi-level subdomain.

Verification

If your certificate covers multiple domains, configure a CNAME record for each. Run the following commands to verify that the records have taken effect.

If certificate application fails, the certificate status is abnormal, or the certificate shows as untrusted, use the dig commands in this section to verify that DNS resolution is correctly configured. For Let's Encrypt certificates, some scenarios may also require verifying the _acme-challenge record. DNS propagation typically takes a few minutes to 10 minutes. If verification fails, wait and retry, or check your DNS configuration for errors.

# [DigiCert certificate]
dig _dnsauth.<hostname> CNAME # Replace <hostname> with your domain name, for example: dig _dnsauth.example.com CNAME

# [Let's Encrypt certificate]
dig _acme-challenge.<hostname> CNAME  # Replace <hostname> with your domain name, for example: dig _acme-challenge.example.com CNAME

FAQ