---
title: "What is the ACME DNS-01 challenge?"
canonical: https://enum.co/learn/what-is-the-acme-dns-01-challenge
locale: en
topic: Network
publishedAt: 2026-11-01
updatedAt: 2026-11-01
author: "Max Heyer"
summary: "The ACME DNS-01 challenge proves you control a domain by publishing a TXT record, so a certificate authority can issue TLS certificates, including wildcards."
---

# What is the ACME DNS-01 challenge?

The ACME DNS-01 challenge proves you control a domain by publishing a TXT record, so a certificate authority can issue TLS certificates, including wildcards.

After reading this you will be able to:

- Explain how a DNS-01 TXT record proves control of a domain
- Compare DNS-01 with HTTP-01 and TLS-ALPN-01 validation
- Limit the risk of DNS API credentials used for certificates

## What is the ACME DNS-01 challenge?

The ACME DNS-01 challenge is a way to prove control of a domain name before a certificate authority issues a TLS certificate for it. The ACME client publishes a TXT record at `_acme-challenge` under the domain, and the certificate authority looks it up. If the value matches, the domain is validated.

Think of a building manager who asks you to put a specific code word on the noticeboard in the lobby. Only someone with access to the building can do that. Your DNS zone is the noticeboard, and only someone who can edit the zone can publish the code.

## How does DNS-01 work?

The client asks the certificate authority for a certificate and receives a random token for each name. It combines that token with a fingerprint of its ACME account key. This string is the key authorization.

The client hashes the key authorization with SHA-256, base64url-encodes the result and publishes it as a TXT record. For `www.example.org`, the record name is `_acme-challenge.www.example.org`:

```
_acme-challenge.www.example.org. 300 IN TXT "gfj9Xq...Rg85nM"
```

The certificate authority computes the same digest on its side, queries the TXT records for that name and checks that one of them matches. The client can then remove the record.

### Propagation

The record has to be visible on every authoritative nameserver for the zone before validation starts. Most clients wait a set time or poll the nameservers before asking for validation. A DNS API that confirms when a change is live saves that guesswork.

## Why use DNS-01 instead of HTTP-01?

HTTP-01 puts a file on your web server and must be reached on port 80. TLS-ALPN-01 runs on port 443. Both need a public server answering for the name, and neither can validate wildcard names.

DNS-01 needs no reachable server at all:

- Wildcard certificates such as `*.example.com`.
- Internal hosts that have a public DNS name but no public web server.
- Many load-balanced servers, where an HTTP challenge file would have to be on every one of them.
- Issuing a certificate before the service is live, for example during a migration.

The cost is that the client needs write access to your DNS zone, and the provider needs an API for it.

## How do you limit the risk of DNS credentials?

Anyone who can edit your zone can redirect your traffic, not only get certificates. Keep DNS-01 credentials off public-facing servers, scope them as narrowly as the provider allows, and run issuance on a separate system that hands certificates out.

### Delegating the challenge with a CNAME

Point `_acme-challenge.example.com` at a record in a separate, low-value zone with a CNAME. The ACME client then only needs credentials for that zone, and the validation lookup follows the CNAME.

## How enum handles the ACME DNS-01 challenge

[enum DNS](/dns) supports ACME DNS-01 with cert-manager, so clusters can issue certificates for zones hosted on enum, wildcards included. enum DNS is free for every enum account, with TXT and CAA records, DNSSEC and zone management through the enum API and enumctl. An enum API key works for every zone in its project, so to scope DNS-01 credentials to one zone, put that zone in a project of its own.

## FAQ

**Can I get a wildcard certificate without DNS-01?**
In practice, no. HTTP-01 and TLS-ALPN-01 cannot validate wildcard names, so a certificate for `*.example.com` needs a TXT record under `_acme-challenge.example.com`, the base domain without the asterisk.

**Should I delete the TXT record after validation?**
Yes. Several TXT records can exist at the same name, but old values pile up over renewals, and very large DNS responses can make validation fail. Most ACME clients remove the record automatically.

**Does DNS-01 work with DNSSEC turned on?**
Yes. The TXT record is signed like any other record in the zone. Make sure your DNS provider signs records added through its API, so validating resolvers do not reject the challenge.