What is Domain Validation?
Also known as: DV
Domain Validation (DV) is the lowest level of certificate validation used in TLS/SSL, where the certificate authority verifies only that the applicant controls the domain name, typically via an HTTP or DNS challenge.
Domain Validation (DV) is the simplest and least rigorous method of certificate validation in the public key infrastructure (PKI) for TLS/SSL certificates. It requires the certificate authority (CA) to confirm only that the applicant has administrative control over the domain name being certified. No verification of the requesting organization's legal identity, physical address, or operational existence is performed. This makes DV certificates the cheapest and fastest to obtain, often issued within minutes.
The validation process works by having the CA issue a challenge that the applicant must complete. The two most common methods are: (1) placing a file with a specific token at a well-known URL on the domain (e.g., http://example.com/.well-known/pki-validation/token.txt), which the CA fetches over HTTP; or (2) adding a DNS TXT record with a CA-provided value to the domain's authoritative DNS zone. The CA then checks for the expected response and, if found, issues the certificate. Automated protocols like ACME (RFC 8555) fully automate this workflow, enabling services like Let's Encrypt to issue DV certificates at scale.
DV certificates sit at the lowest end of the validation assurance spectrum, below Organization Validation (OV) and Extended Validation (EV). They are suitable for websites where encryption is the primary goal and where the identity of the site owner is not critical to the user's trust decision. However, because DV does not verify organizational identity, they offer no protection against phishing attacks that use lookalike domains. Browsers have historically treated DV, OV, and EV certificates differently in the address bar, but as of 2023, most major browsers no longer display EV-specific indicators, further flattening the visual distinction between validation levels.
Key facts
- DV certificates verify only domain control, not organizational identity.
- Common validation methods include HTTP file retrieval and DNS TXT record lookup.
- ACME protocol (RFC 8555) automates DV issuance, used by Let's Encrypt.
- DV certificates are typically issued in minutes and are the cheapest TLS option.
- They provide encryption but no assurance of the certificate holder's legal identity.
- Browsers have largely stopped showing EV indicators, reducing visual differences.
How it works in practice
Related terms
References
More in TLS & PKI
ACME Protocol
ACME (Automated Certificate Management Environment) is a protocol that automates the issuance, renewal, and revocation of TLS certificates, defined in RFC 8555.
Certificate Authority
A Certificate Authority (CA) is a trusted entity that issues digital certificates after verifying that the requester controls the domain or identity named in the certificate.
Certificate Chain
A certificate chain is an ordered list of certificates, starting with the server certificate and ending with a root CA, that a client validates to establish trust in the server's identity.
Certificate Pinning
A security technique where an application trusts only a specific, pre-selected certificate or public key for a given server, bypassing the standard chain of trust.
Cipher Suite
A cipher suite is a named set of cryptographic algorithms negotiated during a TLS handshake, specifying key exchange, authentication, encryption, and integrity protection for secure communications.
ECH
Encrypted Client Hello (ECH) is a TLS extension that encrypts the Client Hello message, including the Server Name Indication (SNI), to prevent on-path observers from learning the target hostname during the handshake.
Extended Validation
Extended Validation (EV) is the highest level of TLS certificate assurance, requiring the certificate authority to perform rigorous, human-verified checks on the legal identity and operational existence of the requesting organization before issuance.
HSTS
HTTP Strict Transport Security (HSTS) is a web security policy mechanism that forces browsers to interact with a website only over HTTPS, preventing downgrade attacks and cookie hijacking.
Intermediate Certificate
An intermediate certificate is a subordinate CA certificate signed by a root CA, used to sign end-entity certificates and enable path validation while the root remains offline.
Let's Encrypt
Let's Encrypt is a free, automated, public certificate authority operated by the Internet Security Research Group (ISRG) that issues short-lived Domain Validation (DV) TLS certificates via the ACME protocol.