{"id":4609,"date":"2026-09-25T10:46:24","date_gmt":"2026-09-25T10:46:24","guid":{"rendered":"https:\/\/cheapsslweb.com\/blog\/?p=4609"},"modified":"2026-09-25T10:46:29","modified_gmt":"2026-09-25T10:46:29","slug":"dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world","status":"publish","type":"post","link":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/","title":{"rendered":"DNS-PERSIST-01: Handling Domain Control Validation in a Short-lived Certificate World"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The competition to get certificates as short as possible is on. By 2029, <a href=\"https:\/\/cheapsslweb.com\/blog\/ssl-tls-certificate-lifespans-reduced-to-47-days-by-2029-ca-b-approved\/\">TLS certificates will expire after only 47 days<\/a>, with only 10 days left to renew them after completing domain control validation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Now, this compressed time period isn&#8217;t urgent anymore, as automation takes care of the renewals. As certificates get more transient, however, the hassle of having to frequently prove that you&#8217;re in control starts to be a kind of headache.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>This is when DNS-PERSIST-01 comes into play.<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><em>DNS-PERSIST-01<\/em>&nbsp;is a new ACME challenge type that eliminates the DNS-01 \u201cchange DNS on every renewal\u201d problems<\/li>\n\n\n\n<li>DNS-PERSIST-01 uses persistent authorisation rather than repeated validation. A single DNS record grants unlimited authorisation to issue certificates for a certain CA and ACME account.<\/li>\n\n\n\n<li>It\u2019s designed for high-frequency certificate issuance. With lifetimes of <a href=\"https:\/\/cheapsslweb.com\/blog\/5-must-do-steps-for-a-quick-and-effective-transition-to-47-day-tls-ssl-certificates\/\">47 days<\/a> by 2029, removing repeated DNS changes will be necessary for operational reasons.<\/li>\n\n\n\n<li>The security paradigm changes; it doesn&#8217;t get better. ACME account keys become valuable. Treat them appropriately.<\/li>\n\n\n\n<li>Usage depends on your operations. High-frequency operations, IoT, and multi-tenant systems will benefit most. Low-frequency operations should use DNS-01.<\/li>\n\n\n\n<li>Implementation support is coming, but not ubiquitous. Let\u2019s Encrypt aims for Q2 2026 implementation. Ensure CA and client support is in place first.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>At this time, there are a few methods most teams use to achieve this level of security:<\/strong> HTTP-01 (hosting challenge responses on Web servers), DNS-01 (adding temporary DNS records), and TLS-ALPN-01, a rare one.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/blog\/acme-challenges-for-domain-validation-which-is-best\/\">ACME Challenges for Domain Validation: Which is Best?<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">They all need to be validated afresh at every renewal, new DNS record, floating API credentials, propagation delays, and a shortage of time.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">The DNS-PERSIST-01 changes the paradigm completely. No duplicate proof-of-freshness; only one permanent DNS record mapping a domain to a particular CA and ACME account. The CA does the validation and gives unlimited certificates without contacting DNS again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What You&#8217;ll Learn<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This guide will help you learn:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Traditional DCV is becoming more and more impractical because of the desire to reduce certificate lifetimes.<\/li>\n\n\n\n<li>This will explain how the <a href=\"https:\/\/cheapsslweb.com\/blog\/acme-challenges-for-domain-validation-which-is-best\/\">HTTP-01, DNS-01, and TLS-ALPN-01<\/a> spec requirements work and what they mean (and what their limitations are).<\/li>\n\n\n\n<li>What is DNS-PERSIST-01 and how persistent authorisation works<\/li>\n\n\n\n<li>The key differences between DNS-01 and DNS-PERSIST-01 are<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Why Shorter Certificate Lifetimes Are Changing Domain Validation?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The industry is changing quickly. Certificates were valid for up to 398 days in 2024. In 2029, this maximum is decreased to 47 days, a 10-fold decrease. This isn&#8217;t theoretical. There are already calls for this transition from major browsers and standards groups as a security measure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The catch? The DCV reuse window is shrinking even faster.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Period<\/strong><\/td><td><strong>Max Cert Lifetime<\/strong><\/td><td><strong>DCV Reuse Window<\/strong><\/td><\/tr><tr><td>Till Feb, 2026<\/td><td>398 days<\/td><td>398 days<\/td><\/tr><tr><td>2026<\/td><td>200 days<\/td><td>200 days<\/td><\/tr><tr><td>2027<\/td><td>100 days<\/td><td>100 days<\/td><\/tr><tr><td>2029<\/td><td>47 days<\/td><td>10 days<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Organisations will be required to re-validate their domain control every ten days or so by 2029. This puts a wall between the person who handles certificates for dozens or hundreds of people. Manual DNS changes are no longer possible. Automation is no longer optional, but compulsory.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The problem that you actually face is the following: today&#8217;s automation technology <a href=\"https:\/\/cheapsslweb.com\/ssl-certificate-automation\">automates SSL issuance and renewal<\/a>, while domain control validation still requires repeated action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">New DNS records, API calls, propagation delays, and distributed certificates are needed to renew each certificate. A thousand of those will make your overhead load unbearable.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">DNS-PERSIST-01 avoids this by eliminating unnecessary validation from the picture.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/blog\/manual-vs-automated-ssl-certificate-management\/\">Manual vs Automated SSL Certificate Management<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Traditional ACME Domain Control Validation? Works?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">In order to really grasp DNS-PERSIST-01, it is important to pay attention to the thing that it replaces. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Today, three ways to prove domain control: challenge-based methods called <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-acme-importance-of-automated-certificate-management\/\">ACME<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The concept of HTTP-01 is the simplest. The CA sends back a challenge token and then requires that you place it somewhere in your web server&#8217;s webroot: <em><strong>http:\/\/example.com\/.well-known\/acme-challenge\/TOKEN<\/strong><\/em>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CA gets it from the public Internet, verifies the match, and provides you with your certificate. It works, provided you have infrastructure that can provide access to web services via the public Internet, and for your web services the infrastructure is under your control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A different approach is taken with DNS-01. You place a TXT record at <em>_acme-challenge.example.com<\/em> with the challenge token, rather than host the file. The token validation is performed by the CA, which queries DNS or the registry. No exposure to the public is necessary. It treats these as all it is perfect for internal systems and wildcard certificates alike.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read<\/strong>: <a href=\"https:\/\/cheapsslweb.com\/resources\/acme-dns-01-challenge-setup-for-wildcard-ssl-certificates\/\">ACME DNS-01 Challenge Setup for Wildcard SSL<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The downside is friction in the process. There needs to be a DNS update for each validation. Propagation of DNS can take time and be erratic. If you want to make changes automatically, your automation tools must have a set of DNS API credentials with very broad permissions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>TLS-ALPN-01<\/strong> is hardly used. It forces negotiation of a special TLS negotiation on <a href=\"https:\/\/cheapsslweb.com\/blog\/port-80-http-vs-port-443-https-major-difference-to-know\/\">port 443<\/a>, and it also creates certificates on the fly on your server. It appears to be technically correct, but it possesses too much complexity in its operation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Interestingly, each of these methods has this in common: they confirm control each time a certificate is issued. This addresses that fundamental model with DNS-PERSIST-01, which introduces an alternative way of authorising, in what is considered persistence, as opposed to repeated proof.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What is DNS-PERSIST-01?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>DNS-PERSIST-01 or Persistent ACME DNS Validation<\/strong>, is a new ACME challenge type that uses a single, persistent DNS TXT record to authorize a Certificate Authority (CA) and an ACME account indefinitely.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It takes the validation model from &#8220;assertions&#8221; to &#8220;claims&#8221; (which is not the normal order, just reading from left to right). You do not have to make a new DNS record for each certificate renewal, but for a specific CA and ACME account, you make a single DNS record that allows them to issue certificates for your domain forever.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The record for it is as follows:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>_validation-persist.example.com. 3600 IN TXT \n\"sectigo.com; \naccounturi=https:\/\/acme.sectigo.com\/v2\/DV\/account\/abc123xyz\"<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code><em>\"letsencrypt.org;accounturi=https:\/\/acme-v02.api.letsencrypt.org\/acme\/acct\/1234567890\"<\/em><\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Which, from this one DNS entry will allow Sectigo (or any other CA that needs to support) to know that example.com can be served certificates through this account. After it gets published, your automation can ask to get new certificates without reaching out to DNS again.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are layers of controls for this record. To allow for <a href=\"https:\/\/cheapsslweb.com\/ssl-types\/cheap-wildcard-ssl-certificates\">wildcard certificates<\/a>, add <em><strong>policy=wildcard<\/strong>.<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Add <em><strong>persistUntil=TIMESTAMP<\/strong><\/em> to specify expiration time; this will cause you to refresh authorisation periodically for more security.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\">The very basic difference becomes that of DNS-01: you have to prove ownership on renewal. With DNS-PERSIST-01, you have to give the permits for control and then rely on that control to continue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-acme-external-account-binding-eab\/\">What is ACME External Account Binding?<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How DNS-PERSIST-01 Works: Step-by-Step<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Change a dynamic dance of repeated validations to a simplified authorisation process with DNS-PERSIST-01.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create and Publish the Persistent TXT Record:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The domain owner establishes a persistent TXT Record<\/strong> for his domain with <em>_validation-persist.example.com.<\/em> Setup is once only.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: The Record indicates who the Authorised CA is:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The record specifies which CA is allowed to utilise it (for instance, <em>letsencrypt.org, sectigo.com)<\/em>. This provides a check that none of the other CAs is stealing your authorisation.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: This Step shows the Authorised ACME Account:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Locks issuance to a specific account, with the <strong>accountURI parameter<\/strong>. However, if an attacker manages to compromise your DNS but not your ACME keys, they still cannot get certificates till he doesn&#8217;t have your public key.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Now your Client requests a Certificate for the ACME Service:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The automation tries to reach the CA&#8217;s API with your credentials for the authorised user.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: The CA checks the Persistent DNS Record:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">First, the CA does not create a new challenge token; instead, it requests a record from<strong> <em>_validation-persist.example.com<\/em><\/strong> and validates that the record is there and correct.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Straighten out the Account match by the CA:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Validation is successful at once if the CA name and account URL in the DNS record are the same as the request.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Issuing of Certificates Stages:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No new DNS Record is required to create your certificate.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td>Domain Owner &nbsp;&nbsp;&nbsp;&nbsp; \u2193 Creates Persistent TXT Record &nbsp;&nbsp;&nbsp;&nbsp; \u2193 Authorises CA + ACME Account &nbsp;&nbsp;&nbsp;&nbsp; \u2193 ACME Client Requests Certificate &nbsp;&nbsp;&nbsp;&nbsp; \u2193 CA Checks Persistent Authorisation &nbsp;&nbsp;&nbsp;&nbsp; \u2193 Certificate Issued (No DNS Changes Required)<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">DNS-01 vs DNS-PERSIST-01: What Actually Changes?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The difference is operational, not conceptual. Here&#8217;s what shifts:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Feature<\/strong><\/td><td>DNS-01<\/td><td>DNS-PERSIST-01<\/td><\/tr><tr><td><strong>DNS record<\/strong><\/td><td>New record per validation<\/td><td>Persistent authorization record<\/td><\/tr><tr><td><strong>Validation frequency<\/strong><\/td><td>Repeated for each renewal<\/td><td>Reusable indefinitely<\/td><\/tr><tr><td><strong>DNS write access<\/strong><\/td><td>Frequently required<\/td><td>Primarily needed during setup<\/td><\/tr><tr><td><strong>Propagation delays<\/strong><\/td><td>Can affect each validation<\/td><td>Eliminated during renewals<\/td><\/tr><tr><td><strong>API credentials<\/strong><\/td><td>Often distributed through pipeline<\/td><td>Can remain centralised<\/td><\/tr><tr><td><strong>Security model<\/strong><\/td><td>Fresh proof of control<\/td><td>Persistent authorization<\/td><\/tr><tr><td><strong>Best for<\/strong><\/td><td>General automation<\/td><td>High-volume, large-scale deployments<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The traffic\/operation friction backlash of the core trade-off is clear here: <strong>For every DNS change<\/strong>, DNS-PERSIST-01 returns operational efficiency. But it doesn&#8217;t use the &#8220;proof-of-freshness&#8221; pledge mechanism any longer, instead using persistent authorisation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>With DNS-01<\/strong>, the CA validates your control every time. Another challenge, another DNS record, new proof. <strong>DNS-PERSIST-01<\/strong> is a single control, set during setup. All thereafter are based on the static DNS record for the authorisation of issuance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The overall paradigm of security adapts drastically. You aren&#8217;t demonstrating control again; you are giving a standing licence to a particular account.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Also Read:<\/strong> <a href=\"https:\/\/cheapsslweb.com\/blog\/what-is-the-difference-dns-over-tls-vs-dns-over-https\/\">What is the Difference? DNS over TLS vs DNS over HTTPS?<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>The Security Trade-Off: Convenience vs Fresh Proof of Control<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Different assets are protected by DNS-01 and DNS-PERSIST-01.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">DNS-01&#8217;s Security Model:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The CA generates a fresh challenge token for each validation. You have categorically proven yourself in control by hosting that unique token in your DNS infrastructure. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>New proof is needed for each renewal<\/strong>. The sensitive resource is the ability to write to DNS \u2013 any person with control of your DNS API could issue certificates. But this access is required only at issuance, and the exposure window is relatively small.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">DNS-PERSIST-01&#8217;s Security Model: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You allow a specific ACME account to make certificates by publishing its URI in DNS. That account can issue certificates as many times as it wants, without interfering in DNS again. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>A persistent record in DNS is now a standing authorisation<\/strong>. The very valuable resource moves into different hands: Your ACME account key is now the gem stone.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The primary danger is the potential loss of the keys<\/strong> for your ACME account if someone else compromises them, allowing them to ask for certificates for any domain that it had authorised. DNS-PERSIST-01 doesn&#8217;t eliminate this threat\u2014it changes the attack surface.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\"><strong>But DNS-PERSIST-01 does make things easier:<\/strong> No more going around your infrastructure with DNS credentials. Once set up, DNS access can be tightly controlled. However, ACME&#8217;s tasks will now require organisations to protect those account keys in the same way they protected their DNS API keys.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <strong>&#8220;trade-off&#8221; reality<\/strong>. The question is: Do organisations want to trade off convenience for moving the security paradigm?<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Wildcard Certificates and Authorisation Scope<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The <em>`<strong>policy=wildcard<\/strong>`<\/em> argument sets what kinds of certificates your permanent authorisation will apply to.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Without <em>policy=wildcard:<\/em><\/strong> Authorise only the specified FQDN in a DNS Record. Assuming your record is set in <em>`<strong>_validation-persist.example.com<\/strong><\/em>`, then it sets up certificates for `<strong>example.com<\/strong>`, but not for <em>example.com<\/em>. SUBDOMAIN\/ WILDCARD are prohibited.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>With <em>policy=wildcard:<\/em><\/strong> The scope expands significantly. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>The Persistent Authorisation now covers:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The validated domain (<em>example.com<\/em>)<\/li>\n\n\n\n<li>Wildcard certificates (<em>*.example.com<\/em>)<\/li>\n\n\n\n<li>Matching subdomains (<em>sub.example.com, another.example.com<\/em>)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This is potent in case you have lots of subdomains. However, the wider the scope, the higher the risk. Should an attacker log in to your ACME account, they can ask for all certificates on your domain tree.<\/p>\n\n\n\n<p class=\"quote-section wp-block-paragraph\"><strong>Security Note: <\/strong>Do not enable wildcard authorisation if it&#8217;s not really necessary. The smaller the permission you give to account access, the less damage will be done if it&#8217;s downloaded and the people with the credentials use it. Rely on conservative policies, and only relax when needed.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>Using <em>persistUntil<\/em> to Limit Authorisation Lifetime<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The `<strong>persistUntil<\/strong>` parameter extends your persistent authorisation&#8217;s validity:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>persistUntil=1767225600<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This occurs when this timestamp (in seconds since 1970 as UTC time) expires. Since that day, the CA will no longer accept the record for new validations. It provides a permission schedule, rather than an indefinite granting of authorisations.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Why use it? <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Periodic review is required because of expiring authorisations. Refreshing the record is necessary, but has to be done with conscious effort and provides an opportunity to review if there is still a need for the authorisation and if account security is intact.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What does this mean?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Start setting reminders in the calendar well before the date so they don&#8217;t get missed. Wherever possible, automate record changes. Run workflows for testing renewals in advance of the date. This strikes a middle ground between the convenience of automation for the long term and security monitoring for the short term.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Who becomes the biggest Winner in DNS-PERSIST-01?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DNS-PERSIST-01 is not required in every instance. It is a problem in certain situations that cause actual turmoil because of repeated validation of DNS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Large-scale Certificate Automation: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">When an organisation has hundreds of domains with thousands of certificates, there is an accumulation of overhead with repeated domain name changes. That&#8217;s gone with DNS-PERSIST-01, with one authorisation record and unlimited renewals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">IoT Deployments: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">An asset&#8217;s ability to handle sophisticated certificates can sometimes be missing. With persistent authorisation, there&#8217;s no need to automate reauthorization on thousands of edge nodes.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Multi-tenant Platforms: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The great thing about SaaS businesses providing customer domain certificates is that they simply reap the benefits. Platforms can set up persistent authorisation, and their credentials will be used for the whole lifetime of the customers&#8217; domain without having to manage them for each domain.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Internal Infrastructure: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It is important to note that organisations can also secure their DNS access after setup and only seek authorisation after it has been issued, which is applicable for renewals.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Organisations with Tight DNS Security Policies:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Persistent authorisation is an effective way for companies to reduce the amount and exposure of such credentials, since they are treated as high-value assets for them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s Encrypt explicitly lists scenarios like Internet of Things (IoT), multi-tenant platforms or batch certificate operations as perfect examples of DNS-PERSIST-01.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">DNS-PERSIST-01 and the 47-Day Certificate Future<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For the reason this technology has been created, the lifespan of certificates keeps decreasing while the number of renewals increases.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It is reduced to 18 months from 47 days in 2029. This implies that automatic and regular issuance will be required. This approach is unsatisfactory at this stage since each time a record has to be renewed, it scales poorly due to the DNS-01 validation requirement of new records being created.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Doing a manual DNS change is no longer possible. Automated DNS updates will continue to build up operational overheads and create points of failure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Persistent Authorisation addresses this issue directly. With the exclusion of DNS changes from the renewal process, DNS-PERSIST-01 opens up high-frequency issuance operations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, do not confuse it with a full-fledged solution. One aspect in <a href=\"https:\/\/cheapsslweb.com\/ssl-certificate-automation\">certificate lifecycle automation<\/a> is persistent authorisation. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Discovering unmanaged certificates, alerting on expiration dates, orchestrating renewals and key management and securing private keys in organisations still rely on discovery tools, monitoring, and orchestrating renewals and key management processes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Domain validation is done by DNS-PERSIST-01. All else is subsidiary.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Study of the Timelines and Processes of Adoption<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a><\/a>DNS-PERSIST-01 is ready to jump over the standards hurdle, but is limited in production support.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">October 2025:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The CA\/Browser Forum (CABF) voted to adopt persistent DNS validation as a CABF-adopted best practice and is making it part of the CA\/Browser Forum (CABF) Server Certificate Baseline Requirements (SCBR). During the same month, the draft relating to ACME was formally adopted by the IETF ACME Working Group.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Early 2026: <\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Let&#8217;s Encrypt announced support for it and planned to have a staging rollout in late Q1 2026, and would expect full production availability in Q2 2026.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The key here is that the approval of standards and adoption of the ACME protocol does not guarantee immediate availability. It will be supported by Let&#8217;s Encrypt in 2026. Other CAs will follow at their own time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There is still a lot of work to do for <a href=\"https:\/\/cheapsslweb.com\/blog\/what-are-acme-clients-popular-acme-clients-for-ssl-tls-certificate-automation\/\">ACME clients such as Certbot and lego<\/a>. Adoption will not be a phenomenon that happens all at once; rather, it will occur gradually across the ecosystem.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Should Organizations Implement DNS-PERSIST-01?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The adoption process is related to the operational reality and not to the technology novelty.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>Adopt DNS-PERSIST-01 if:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You issue certificates at high volume and DNS changes create bottlenecks.<\/li>\n\n\n\n<li>Your infrastructure requires frequent certificate renewal.<\/li>\n\n\n\n<li>You want to minimise DNS API credentials in certificate automation pipelines.<\/li>\n\n\n\n<li>You operate IoT deployments, multi-tenant platforms, or batch issuance environments.<\/li>\n\n\n\n<li>Your CA and ACME client support it.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a><\/a>If you believe you need to stick with DNS-01, you should:<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Your certificate volume is low, and you have working automation.<\/li>\n\n\n\n<li>You need to have new proof of DNS control regularly.<\/li>\n\n\n\n<li>Your CA or ACME client doesn&#8217;t yet support DNS-PERSIST-01.<\/li>\n\n\n\n<li>You find persistent authorisation records hard to deal with.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Main principle:<\/strong> Don&#8217;t adopt it for the sake of it because it&#8217;s new.<strong>&nbsp;<\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">DNS-PERSIST-01 is solving a genuine problem by removing repeated domain validation in situations where certificates become short-lived. A single persistent DNS record takes the place of many renewals. But it switches from repeated validation to persistent authorisation.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a><\/a>Frequently Asked Questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What is DNS-PERSIST-01?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A new method for validating a domain using ACME, relying on a persistent TXT record to let a specific Certificate Authority and certificate account generate certificates on a domain without needing to validate it again after the certificates that it issued have expired.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is different between DNS-PERSIST-01 and DNS-01?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For every validation (renewal), DNS-01 will need a new challenge record, or a new DNS update will be made. DNS-PERSIST-01 generates one \u201clazy\u201d authorisation record, which allows the issuance to continue indefinitely in the future. It was not necessary to update the DNS.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Will DNS be removed in DNS-PERSIST-01?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It drastically reduces their numbers. The persistent authorisation record needs to be created and managed for periods of time by the DNS admin. No more recurring DNS write access, and that can be centralised or moved out of the issuance pipeline completely \u2013 certificate automation has arrived.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does DNS-PERSIST-01 have a higher security model than DNS-01 does?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">I think all that&#8217;s different is that it&#8217;s not better, worse&#8230; Find repeated challenges to strengthen the proof of control, as DNS-01 states. DNS-PERSIST-01 states that the protection of a persistent authorisation record and related ACME account key is important. Security Model changes\u2014make them depending on the level of risk you are ready to take.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is there any way to use wildcard certificates with DNS-PERSIST-01?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes, if you add it to a persistent DNS record, as well as the Policy specification: policy=wildcard. The parameter is required for the issuance of a wildcard. This enables organisations to limit scope and risk at certain informed levels if they are not using wildcard certificates.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The competition to get certificates as short as possible is on. By 2029, TLS certificates will expire after only 47 days, with only 10 days left to renew them after completing domain control validation. Now, this compressed time period isn&#8217;t urgent anymore, as automation takes care of the renewals. As certificates get more transient, however,&hellip; <a class=\"more-link\" href=\"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/\">Continue reading <span class=\"screen-reader-text\">DNS-PERSIST-01: Handling Domain Control Validation in a Short-lived Certificate World<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":4610,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[435,109],"tags":[445,444,446],"class_list":["post-4609","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-certificate-automation","category-ssl-certificate","tag-dns-persist-01","tag-domain-control-validation-persistent","tag-persistent-dns-validation","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing<\/title>\n<meta name=\"description\" content=\"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing\" \/>\n<meta property=\"og:description\" content=\"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/\" \/>\n<meta property=\"og:site_name\" content=\"CheapSSLWeb.com Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/cheapsslweb\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-25T10:46:24+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-25T10:46:29+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif\" \/>\n\t<meta property=\"og:image:width\" content=\"960\" \/>\n\t<meta property=\"og:image:height\" content=\"621\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Janki Mehta\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif\" \/>\n<meta name=\"twitter:creator\" content=\"@cheapsslweb\" \/>\n<meta name=\"twitter:site\" content=\"@cheapsslweb\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Janki Mehta\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"15 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/\"},\"author\":{\"name\":\"Janki Mehta\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/person\\\/d8997d6347486bdb48bdef47d50eb850\"},\"headline\":\"DNS-PERSIST-01: Handling Domain Control Validation in a Short-lived Certificate World\",\"datePublished\":\"2026-09-25T10:46:24+00:00\",\"dateModified\":\"2026-09-25T10:46:29+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/\"},\"wordCount\":3198,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dns-persistence.avif\",\"keywords\":[\"DNS-PERSIST-01\",\"Domain Control Validation Persistent\",\"Persistent DNS Validation\"],\"articleSection\":[\"Certificate Automation\",\"SSL Certificate\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/\",\"name\":\"DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dns-persistence.avif\",\"datePublished\":\"2026-09-25T10:46:24+00:00\",\"dateModified\":\"2026-09-25T10:46:29+00:00\",\"description\":\"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#primaryimage\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dns-persistence.avif\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/dns-persistence.avif\",\"width\":960,\"height\":621,\"caption\":\"Domain Control Validation Persistent\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Certificate Automation\",\"item\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/certificate-automation\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"DNS-PERSIST-01 - Persistent DNS Validation for SSL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\",\"name\":\"CheapSSLWeb.com Blog\",\"description\":\"Encryption and Web Security Blog\",\"publisher\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#organization\",\"name\":\"CheapSSLWeb\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/03\\\/logo.png\",\"width\":177,\"height\":60,\"caption\":\"CheapSSLWeb\"},\"image\":{\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/cheapsslweb\",\"https:\\\/\\\/x.com\\\/cheapsslweb\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.pinterest.com\\\/cheapsslweb\\\/\",\"https:\\\/\\\/www.instagram.com\\\/cheapsslweb\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/#\\\/schema\\\/person\\\/d8997d6347486bdb48bdef47d50eb850\",\"name\":\"Janki Mehta\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g\",\"caption\":\"Janki Mehta\"},\"description\":\"Janki Mehta is a Cyber-Security Enthusiast who constantly updates herself with new advancements in the Web and Cyber Security niche. With having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence.\",\"sameAs\":[\"https:\\\/\\\/cheapsslweb.com\\\/\",\"https:\\\/\\\/www.linkedin.com\\\/in\\\/pw-jankimehta\\\/\"],\"url\":\"https:\\\/\\\/cheapsslweb.com\\\/blog\\\/author\\\/janki-mehta\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing","description":"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/","og_locale":"en_US","og_type":"article","og_title":"DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing","og_description":"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.","og_url":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/","og_site_name":"CheapSSLWeb.com Blog","article_publisher":"https:\/\/www.facebook.com\/cheapsslweb","article_published_time":"2026-09-25T10:46:24+00:00","article_modified_time":"2026-09-25T10:46:29+00:00","og_image":[{"width":960,"height":621,"url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","type":"image\/webp"}],"author":"Janki Mehta","twitter_card":"summary_large_image","twitter_image":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","twitter_creator":"@cheapsslweb","twitter_site":"@cheapsslweb","twitter_misc":{"Written by":"Janki Mehta","Est. reading time":"15 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#article","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/"},"author":{"name":"Janki Mehta","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/person\/d8997d6347486bdb48bdef47d50eb850"},"headline":"DNS-PERSIST-01: Handling Domain Control Validation in a Short-lived Certificate World","datePublished":"2026-09-25T10:46:24+00:00","dateModified":"2026-09-25T10:46:29+00:00","mainEntityOfPage":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/"},"wordCount":3198,"commentCount":0,"publisher":{"@id":"https:\/\/cheapsslweb.com\/blog\/#organization"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","keywords":["DNS-PERSIST-01","Domain Control Validation Persistent","Persistent DNS Validation"],"articleSection":["Certificate Automation","SSL Certificate"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/","url":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/","name":"DNS-01 vs DNS-PERSIST-01: How ACME Validation Is Changing","isPartOf":{"@id":"https:\/\/cheapsslweb.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#primaryimage"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#primaryimage"},"thumbnailUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","datePublished":"2026-09-25T10:46:24+00:00","dateModified":"2026-09-25T10:46:29+00:00","description":"Learn how ACME DNS-PERSIST-01 challenge works, how it differs from standard DNS-01, and why it eliminates DNS API keys on renewal workloads.","breadcrumb":{"@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#primaryimage","url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","contentUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2026\/09\/dns-persistence.avif","width":960,"height":621,"caption":"Domain Control Validation Persistent"},{"@type":"BreadcrumbList","@id":"https:\/\/cheapsslweb.com\/blog\/dns-persist-01-handling-domain-control-validation-in-a-short-lived-certificate-world\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cheapsslweb.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Certificate Automation","item":"https:\/\/cheapsslweb.com\/blog\/certificate-automation\/"},{"@type":"ListItem","position":3,"name":"DNS-PERSIST-01 - Persistent DNS Validation for SSL"}]},{"@type":"WebSite","@id":"https:\/\/cheapsslweb.com\/blog\/#website","url":"https:\/\/cheapsslweb.com\/blog\/","name":"CheapSSLWeb.com Blog","description":"Encryption and Web Security Blog","publisher":{"@id":"https:\/\/cheapsslweb.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cheapsslweb.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cheapsslweb.com\/blog\/#organization","name":"CheapSSLWeb","url":"https:\/\/cheapsslweb.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2022\/03\/logo.png","contentUrl":"https:\/\/cheapsslweb.com\/blog\/wp-content\/uploads\/2022\/03\/logo.png","width":177,"height":60,"caption":"CheapSSLWeb"},"image":{"@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/cheapsslweb","https:\/\/x.com\/cheapsslweb","https:\/\/www.linkedin.com\/company\/cheapsslweb\/","https:\/\/www.pinterest.com\/cheapsslweb\/","https:\/\/www.instagram.com\/cheapsslweb\/"]},{"@type":"Person","@id":"https:\/\/cheapsslweb.com\/blog\/#\/schema\/person\/d8997d6347486bdb48bdef47d50eb850","name":"Janki Mehta","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1fba817ef81065f1393461fc3a0d85c40f2cc826919819ea4df4b12d76566e62?s=96&d=https%3A%2F%2Fcheapsslweb.com%2Fblog%2Fwp-content%2Fuploads%2F2023%2F02%2Fjanki-mehta-jpg.webp&r=g","caption":"Janki Mehta"},"description":"Janki Mehta is a Cyber-Security Enthusiast who constantly updates herself with new advancements in the Web and Cyber Security niche. With having 7+ years of experience and knowledge about Encryption, Digital Certificates and Online Security, She helps online users to stay safe and protect their online presence.","sameAs":["https:\/\/cheapsslweb.com\/","https:\/\/www.linkedin.com\/in\/pw-jankimehta\/"],"url":"https:\/\/cheapsslweb.com\/blog\/author\/janki-mehta\/"}]}},"_links":{"self":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/comments?post=4609"}],"version-history":[{"count":2,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4609\/revisions"}],"predecessor-version":[{"id":4612,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/posts\/4609\/revisions\/4612"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/media\/4610"}],"wp:attachment":[{"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/media?parent=4609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/categories?post=4609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cheapsslweb.com\/blog\/wp-json\/wp\/v2\/tags?post=4609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}