How Does DNS-PERSIST-01 Work?
Eliminating Repeated Validation with Let's Encrypt's Persistent DNS Auth Records
The traditional DNS-01 challenge required creating a new _acme-challenge. TXT record every time a certificate was issued or renewed. This meant providing DNS API credentials to the ACME client, and DNS propagation delay was also problematic. DNS-PERSIST-01 sets the CA URI and ACME account URI in a _validation-persist.example.com TXT record just once, and the CA checks this record for domain ownership verification on subsequent certificate issuance/renewal. DNS changes are completely removed from the issuance path, enabling automatic renewal without DNS API credential exposure.
Architecture Diagram
"acme-challenge=persist;
ca=https://acme-v02.api.letsencrypt.org/directory;
account=https://acme-v02.api.letsencrypt.org/acct/12345;
policy=wildcard;
persistUntil=2027-01-01T00:00:00Z"
ca
ACME directory URL of allowed CA (multiple CAs supported)
account
ACME account URI allowed to issue certificates
policy
wildcard: includes subdomains, exact: this domain only
persistUntil
Validity period of this auth record (must reset after expiry)
How It Works
Traditional DNS-01: issuance request → CA issues random token → create _acme-challenge. TXT record → wait for DNS propagation → verification
Set CA URI + ACME account URI in _validation-persist.example.com TXT record (once only)
ACME client requests certificate issuance from Let's Encrypt
Let's Encrypt queries _validation-persist. TXT record → verifies account match
Domain ownership verified → certificate issued (no DNS changes)
Same record reused on renewal → no DNS API calls needed
Pros
- ✓ No DNS changes needed for certificate issuance/renewal
- ✓ Reduced risk of DNS API credential exposure
- ✓ Applicable to wildcard certificates
- ✓ Control auth expiry timing with persistUntil
- ✓ Multiple CAs can be authorized simultaneously
Cons
- ✗ ACME account key protection becomes more critical (key leak = unauthorized issuance)
- ✗ Let's Encrypt support planned for after Q2 2026 (still waiting)
- ✗ DNS spoofing risk exists as DNSSEC is not mandatory
- ✗ Persistent auth means immediate record removal needed on key compromise