What DCV is

DCV is the gatekeeping step in TLS certificate issuance: before a CA can issue a cert for example.com, it has to confirm that whoever is asking for it controls example.com. The CA/Browser Forum's Baseline Requirements define the permitted DCV methods, and every publicly trusted CA must use one of them.

The methods have evolved considerably over time. The 2026-2029 window is a particularly active one for method deprecation, as the CA/B Forum tightens the set of acceptable methods.

The current permitted methods

HTTP-01 / Web server file challenge

The CA generates a token; the applicant serves that token at a known URL on the domain (http://example.com/.well-known/acme-challenge/<token>). The CA fetches the URL, confirms the token matches, and considers the domain controlled.

Automatable: yes
Can issue wildcards: no
Still permitted after 2028: yes

DNS-01 / TXT record challenge

The CA generates a token; the applicant publishes a TXT record at _acme-challenge.example.com with that token as its value. The CA resolves the record and validates.

Automatable: yes (requires DNS API access)
Can issue wildcards: yes (the only method that can)
Still permitted after 2028: yes

tls-alpn-01 / TLS ALPN challenge

The CA initiates a TLS handshake using the acme-tls/1 ALPN protocol; the applicant responds with a self-signed certificate containing the token in a specific extension.

Automatable: yes
Can issue wildcards: no
Still permitted after 2028: yes

Email-based validation

The CA sends a verification email to one of five fixed addresses on the domain (admin@, administrator@, hostmaster@, postmaster@, webmaster@) or to the registrant's contact email in the WHOIS record. The applicant clicks a verification link in the email.

Automatable: barely (requires an email inbox and a click)
Retiring: 2028. After this date, email-based DCV is no longer permitted for publicly trusted TLS certificates.

Phone-based validation

The CA calls a phone number from the registrant's WHOIS or domain contact and asks for a spoken verification code.

Automatable: no
Retiring: March 2027. The CA/B Forum has set a hard end-date.

The retirement timeline

Method	Status
HTTP-01	Permitted indefinitely
DNS-01	Permitted indefinitely
tls-alpn-01	Permitted indefinitely
Phone-based validation	Retires March 2027
Email-based validation	Retires 2028

For operators still using email or phone validation anywhere in their renewal pipeline, the migration deadlines are firm. The shape of the migration is: move to protocol-based DCV (HTTP-01 for single certs, DNS-01 for wildcards), automate it through an ACME client, and delete the human-in-the-loop steps.

DCV reuse

CAs are permitted to reuse a successful DCV result for up to some validity window — meaning subsequent certificate issuances to the same account for the same domain don't require re-running the challenge. The window has been tightening alongside certificate validity:

Date	Max validity	Max DCV reuse
Pre-March 2026	398 days	398 days
From March 2026	200 days	200 days
From March 2027	100 days	100 days
From March 2029	47 days	10 days

At 10-day DCV reuse (post-2029), every certificate renewal cycle will trigger a fresh DCV. Automation is no longer optional.

MPIC and DCV

Multi-Perspective Issuance Corroboration (MPIC) means DCV is performed from multiple network perspectives simultaneously. If a CA only reached your /.well-known/acme-challenge/ URL from one network vantage, an on-path BGP hijack could spoof the validation. MPIC requires the CA to see consistent results from 3+ perspectives before accepting.

For operators: firewall and WAF rules that whitelist specific CA source IPs break under MPIC — the CA now reaches your endpoint from several network paths. Allow the full set.

Common operational mistakes

Relying on email DCV. It's going away in 2028. Migrate now.
Hardcoding specific CA IP ranges in firewall allowlists. MPIC breaks this. Allow the challenge path broadly, or use DNS-01.
Shipping HTTP-01 behind an HTTPS-only redirect. The ACME challenge must be reachable on port 80. Many web stacks force HTTPS redirect; this breaks the challenge.
Using DNS-01 with a DNS provider without API access. You'll be manually updating records every renewal. Pick a DNS provider with an API or move the zone.

Domain Control Validation