Skip to content

CNAME delegation for domain validation

Use CNAME delegation to validate domain ownership when you don't have API access to your primary DNS provider. With CNAME delegation, Certificate Manager - SaaS follows a CNAME record from your primary DNS zone to a zone managed by a supported DNS provider where it creates the validation TXT record.

When to use CNAME delegation

Use CNAME delegation in these scenarios:

  • Your primary DNS provider doesn't support API access
  • Your primary DNS provider isn't in the supported provider list
  • You manage domains across multiple DNS providers and want to centralize validation records

Before you begin

Verify that you have:

  • Permission to create CNAME records in your primary DNS provider
  • A DNS zone with a supported DNS provider for validation records
  • The required credentials for the supported DNS provider

Set up CNAME delegation

  1. In your primary DNS provider, create a CNAME record that delegates the ACME challenge subdomain to your zone with the supported DNS provider:

    _acme-challenge.example.com. CNAME example.com.acme-validation.example.net.

  2. Wait for DNS propagation to complete. This typically takes 1-5 minutes.

  3. Verify the CNAME record resolves correctly:

    dig _acme-challenge.example.com CNAME

    The command returns the CNAME record pointing to your DNS zone.

  4. In Certificate Manager - SaaS, configure the CA with the appropriate DNS provider and credentials.

Certificate Manager - SaaS now follows the CNAME delegation when validating domain ownership.

Limitations

  • CNAME chains can't exceed 3 hops
  • DNS propagation delays increase validation time by 1-5 minutes
  • The CNAME record must resolve from both the VSatellite and the certificate authority