← Back to notes
NETWORKINGUpdated Jun 29, 2026 · 6 min read

Delegate ACME DNS-01 validation

Separate certificate validation records from production DNS with CNAME delegation and tightly scoped API access.

#dns-01#acme#tls

Design

Delegate _acme-challenge to a validation-specific zone so the ACME client never needs write access to the production DNS zone.

_acme-challenge.example.com. 300 IN CNAME _acme-challenge.example.validation.example.net.

Procedure

  1. Create the validation zone and a narrowly scoped API token.
  2. Add the CNAME in the authoritative production zone.
  3. Configure the ACME client to write TXT records to the validation target.
  4. Confirm delegation from two independent resolvers.
dig +short CNAME _acme-challenge.example.com
dig +short TXT _acme-challenge.example.validation.example.net