TXT

import { Render, TabItem, Tabs } from "~/components";

You choose one certificate validation method when you create a custom hostname. The API accepts one ssl.method value: http, txt, or email.

When to use

Generally, you should use TXT-based DCV when you cannot use HTTP validation or Delegated DCV, or when you need the certificate active before your customer changes DNS.

Non-wildcard custom hostnames

Selecting ssl.method: txt uses TXT validation for initial certificate issuance. During an Automated Certificate Management Environment (ACME) renewal, Cloudflare may use automatic HTTP validation for an eligible non-wildcard hostname.

Automatic HTTP validation at renewal succeeds as long as your customer's hostname points to your SaaS target and they do not have any CAA records blocking your chosen certificate authority.

This automatic HTTP attempt does not mean that the Create Custom Hostname API accepts both HTTP and TXT validation methods in one request. The ssl.method field accepts one value.

Hostnames with properly configured Delegated DCV remain TXT-based. Keep the delegation CNAME record in place for future renewals. With manual TXT validation, share each certificate order's current DCV tokens with your customer. For more information, refer to Renew certificates.

Wildcard custom hostnames

This means that - if you choose to use wildcard custom hostnames - you will need a way to share these DCV tokens with your customer.

1. Get TXT tokens

Once you create a new hostname and choose this validation method, your tokens will be ready after a few seconds.

2. Share with your customer

You will then need to share these TXT tokens with your customers.

3. Add DNS records (customer)

4. (Optional) Fetch new tokens

Your DCV tokens expire after a certain amount of time, depending on your certificate authority.

This means that, if your customers take too long to place their tokens at their authoritative DNS provider, you may need to get new tokens and re-share them with your customer.