How Do I Check Whether Domain Name Verification Takes Effect?

Prerequisites

• Domain name verification has been configured.
• The domain name has been licensed. Obtain the license for the domain name because the domain name verification will fail if the domain name has not been licensed.

Checking Verification by DNS

1. Obtain the host record and record value.
   1. Log in to the management console.
   2. In the Operation column of the certificate for which domain name verification is to be performed, click Verify Domain Name.
   3. On the Verify Domain Name page, view the content for Host Record, Record Type, and Record Value. shows an example.

      If Host Record, Record Type, and Record Value are not displayed, log in to the mailbox to view. The mailbox is the one you provide during certificate application.

2. Select a method based on the record type and OS and check whether the DNS configuration takes effect.

   Use TXT record _dnsauth.domain.com as an example.

   • For TXT records
     • Windows OSs
       1. On the Windows menu, click Start and enter cmd to start the command dialog box.
       2. Enter the nslookup -q=TXT _dnsauth.domain.com command.
     • Linux OSs
       1. Right-click the desktop and choose terminal to go to the command prompt dialog box.
       2. Enter the dig TXT _dnsauth.domain.com command.
     • macOS OSs
       1. Choose Go >Utilities, and click Terminal to open the command prompt dialog box.
       2. Enter the dig TXT _dnsauth.domain.com command.
   • For CNAME records
     • For Windows OSs:
       1. On the Windows menu, click Start and enter cmd to start the command dialog box.
       2. Enter the nslookup -q=CNAME _dnsauth.domain.com command.
     • For Linux OSs:
       1. Right-click the desktop and choose terminal to go to the command prompt dialog box.
       2. Enter the dig CNAME _dnsauth.domain.com command.
     • For macOS OSs:
       1. Choose Go >Utilities, and click Terminal to open the command prompt dialog box.
       2. Enter the dig CNAME _dnsauth.domain.com command.

   If the record value in the command output (value of text) is the same as that returned by the domain name service provider, the configuration of domain ownership verification has taken effect.

3. If the configuration of DNS verification does not take effect, rectify the fault based on the following possible causes until the verification takes effect:

   Table 1 Possible causes

   Possible Cause	Procedure
   A wrong domain name management platform was selected.	DNS verification can be performed only on the platform where your domain name is hosted. Check whether the platform you select is the right one.
   The old record set is not deleted.	The record added can be deleted once the current certificate is issued. If the record added for the previous certificate is not deleted, the record added for the current certificate will not take effect. Check whether the record added last time is deleted.
   The record configuration is incorrect.	Check settings of Host Record, Type or Value.
   It requires a long period of time for the configuration to take effect.	Check whether the effective time (TTL) is too long. It is recommended that you set the TTL to 5 minutes. This value varies depending on the DNS service provider. In our DNS platform, the default value is 5 minutes, so the configuration takes effect in 5 minutes by default. If the configured effective time does not arrive, verify after the time is right.

Checking Verification by File

1. Log in to the management console.
2. On the Verify Domain Name page, view the Record Value.

   If the page is not displayed, log in to your email (the one specified during certificate application) to view the recorded value.

3. Open a browser and access the URL address: https://your domain/.well-known/pki-validation/whois.txt or http://your domain/.well-known/pki-validation/whois.txt.

   Replace your domain in the URL address with the domain name bound during certificate application.

   • If your domain name is a common domain name, perform the following operations:

     For example, if your domain name is example.com, the access URL address is https://example.com/.well-known/pki-validation/whois.txt or http://example.com/.well-known/pki-validation/whois.txt.

   • For a wildcard domain name, perform the following operations:

     For example, if your domain name is *.domain.com, the access URL address is https://domain.com/.well-known/pki-validation/whois.txt or http://domain.com/.well-known/pki-validation/whois.txt.

4. Check whether the verification URL address can be properly accessed in the browser and whether the record value displayed on the page is the same as that on the order progress page.
   • If the record value displayed on the page is the same as that displayed on the domain name verification page of the SCM console, the configuration of domain name verification has taken effect.
   • If they are different, the configuration of domain name verification does not take effect.

5. If the configuration does not take effect, check and handle the issue from the following aspects:
   • Check whether the verification URL address exists in HTTPS accessible addresses. If yes, use HTTPS to re-access the URL address in the browser. If the browser displays a message indicating that the certificate is untrusted or the displayed content is incorrect, disable the HTTPS service for the domain name temporarily.
   • Ensure that the verification URL address can be accessed at any place. Detection servers of some CAs are located outside China. Check whether your site has images outside China or whether the smart DNS service is used.
   • Check whether the verification URL address contains 301 or 302 redirection. If such redirection exists, cancel the related settings to disable the redirection.

     You can run the wget -S URL address command to check whether the verification URL address is redirected.