This is the working area for the IETF ACME Working Group Internet-Draft, "ACME Challenge for Persistent DNS TXT Record Validation".
The draft defines dns-persist-01, a new ACME challenge type that validates control of a domain via a persistent DNS TXT record at _validation-persist.<fqdn>. The record binds the domain to a specific Certification Authority and account, and may be reused for repeated issuance without renewed real-time interaction. This supports multi-tenant hosting, pre-validation, strict change-management environments, wildcard certificates, and IoT deployments.
Status: Working group document. Substantive protocol discussion occurs in the issue tracker and on the ACME working group mailing list.
- RFC 8657 — CAA
accounturiandvalidationmethods, the basis for account binding in this draft. - RFC 8659 — CAA record format; the
issue-valuesyntax is reused for the validation record. - RFC 9444 — ACME for Subdomains. Related to but distinct from the subdomain validation defined here.
- CA/Browser Forum — Baseline Requirements, including the ongoing ballot to enshrine DNS Persist for IP address validation via reverse zones (see issue #32).
Formatted text and HTML versions of the draft can be built using make.
makeThis requires that you have the necessary software installed. See the instructions.
See the guidelines for contributions. Discussion of this work occurs on the ACME WG mailing list (archive).
Agents and reviewers: AGENTS.md describes authoring conventions, the build loop, and commit style. .github/copilot-instructions.md captures the project's protocol review rules and applies to all reviewers, human or automated.
Meeting materials are in presentations/.