CNAME Delegation for Domain Validation
Use CNAME delegation to validate domain ownership when you don't have API access to your primary DNS provider. With CNAME delegation, Next-Gen Trust Security follows a CNAME record from your primary DNS zone to a zone managed by a supported DNS provider, where it creates the validation TXT record.
When to Use CNAME Delegation
Use CNAME delegation in these scenarios:
Your primary DNS provider doesn't support API access.
Your primary DNS provider isn't in the supported provider list.
You manage domains across multiple DNS providers and want to centralize validation records.
Before You Begin
Verify that you have:
Permission to create CNAME records in your primary DNS provider.
A DNS zone with a supported DNS provider for validation records.
The required credentials for the supported DNS provider.
Set Up CNAME Delegation
In your primary DNS provider, create a CNAME record that delegates the ACME challenge subdomain to your zone with the supported DNS provider:
_acme-challenge.example.com. CNAME example.com.acme-validation.example.net.
Wait for DNS propagation to complete. This typically takes 1-5 minutes.
Verify that the CNAME record resolves correctly:
dig _acme-challenge.example.com CNAME
The command returns the CNAME record pointing to your DNS zone.
In Next-Gen Trust Security, configure the CA with the appropriate DNS provider and credentials.
Next-Gen Trust Security now follows the CNAME delegation when validating domain ownership.
Limitations
CNAME chains can't exceed 3 hops.
DNS propagation delays increase validation time by 1-5 minutes.
The CNAME record must resolve from both the VSatellite and the certificate authority.
