DNS-PERSIST-01 without DNS keys

One TXT record, published once

DNS validation normally requires something that can write to your DNS zone at every issuance, which means a DNS API key somewhere on your network. With DNS-PERSIST-01 you publish one TXT record per domain once and leave it in place. The record tells the CA which account may issue for the domain. From then on, certificates are issued immediately.

No DNS keys on servers, agents or appliances

sslbrain Cloud orders the certificate from the CA and uses your permanent TXT record. Service agents and appliances order through sslbrain Cloud or acme.sslbrain.com, where the names are approved in advance. No client has to support DNS-PERSIST-01 itself, and no DNS API key sits on any server.

CAs

• DigiCert, including RapidSSL, GeoTrust, Thawte and DigiCert. Requires your own DigiCert account.
• Google Trust Services. Requires EAB (External Account Binding).
• Let’s Encrypt: not yet, planned.
• GlobalSign: planned for 2027.
• ZeroSSL and Sectigo ACME do not support the method.

The record

The exact record is shown in the appliance under dns-persist and in sslbrain Cloud. For DigiCert the value looks like this:

digicert.com; accounturi=<uri>; policy=wildcard

The value policy=wildcard means the record also covers subdomains and wildcard certificates. The record follows the CA’s format. If a CA changes format, such as Google moving from version -01 to -02 of the IETF draft with a hashed accounturi, sslbrain Cloud shows the new value and you publish it once. See the domain setup in the manual.

Independent of the standard’s timeline

The IETF draft is at version -02 of 20 September 2026. Let’s Encrypt has no date, and certbot does not support it yet. None of this affects sslbrain customers, because sslbrain Cloud orders the certificates and your servers never speak the method themselves.