SSL Automation
AutoDNS: automated domain validation
With FairSSL AutoDNS you create a single DNS CNAME record per domain, and we handle all domain validation automatically. No manual validation steps, no expired tokens, no delays on renewal.
How it works
You create a CNAME record in your DNS
Point _dnsauth.your-domain.com to your unique AutoDNS address (shown in the FairSSL portal).
FairSSL handles validation automatically
When a CA (DigiCert, RapidSSL, GeoTrust, Thawte) needs to validate your domain, FairSSL AutoDNS automatically responds to the DNS challenge via the CNAME pointer.
Permanent and automatic
The CNAME record is permanent. All future certificate issuances and renewals on the domain from your FairSSL account are validated automatically, without any action required from you.
DNS setup
In the FairSSL portal you will find your unique AutoDNS destination. Create the following CNAME record with your DNS provider:
Tip: Trailing dot
Some DNS servers require a dot (.) at the end of the destination to prevent your domain name from being appended automatically. In that case use your-unique-value.autodns.fairssl.dk.
Verify your setup
Once the CNAME record is created, you can verify that it works using nslookup or Google Dig:
nslookup -type=CNAME _dnsauth.your-domain.com
The result should show a CNAME with a target of your-unique-value.autodns.fairssl.dk. When it does, AutoDNS is ready to use.
You can also use the built-in DNS check in the FairSSL portal, which automatically verifies your CNAME configuration and provides error messages if something is misconfigured.
Supported CAs and brands
AutoDNS works with all DigiCert products and DigiCert brands:
DigiCert brand
AutoDNS is also used in the FairSSL ACME solution for automatic validation of DigiCert brands.
Persistent validation: one more record, instant issuance
In addition to the AutoDNS record you can create a permanent TXT record at _validation-persist.your-domain.com. It enables the CA/Browser Forum method DNS-PERSIST-01, where the domain is approved in advance, so certificates from the DigiCert brands are issued immediately, both in the portal and through the FairSSL ACME solution. The record approves an entire certificate account, so we offer it only where that account means one customer: you hold your own DigiCert account, or you use OV/EV with your own organization. You create the record yourself, with the value we give you. If you cannot create _dnsauth records at all, get in touch: we can look at moving you to a DigiCert account used only by you, so persistent validation becomes available.
The two records do not compete. _dnsauth is the one AutoDNS uses to answer the validation for each order, and it stays in place for the products that are validated per order. _validation-persist removes the per-order validation for the DigiCert brands. You only need one record per capability. Most customers use _dnsauth alone, because the persistent record requires an account used only by them.
Both records must stay in place permanently. If the persistent record is deleted, future orders fall back to validation per order.
Benefits of AutoDNS
Set up once
One CNAME per domain. After that, validation is automatic for all certificates and renewals.
No firewall openings
AutoDNS uses DNS validation, so it works behind firewalls, load balancers and reverse proxies.
No DNS API keys
AutoDNS does not require each ACME client to modify your domains' DNS, which improves security.
Supports wildcards
Wildcard certificates require DNS validation. AutoDNS handles it automatically.
Faster issuance
No waiting for manual validation. DV certificates are issued in under 2 minutes and under 15 seconds via ACME.
Hands-free renewal
Certificates can be renewed automatically without anyone needing to approve or click anything.
Multiple domains, one account
All domains with a CNAME pointing to your account are validated automatically. Add new domains any time.
Get started
Your unique AutoDNS destination can be found in the FairSSL customer portal. Log in and navigate to AutoDNS under your domain. If you need help setting up or verifying your DNS configuration, contact our support by email or phone.
Certificates on many servers and appliances
A publicly trusted SSL certificate can be valid for at most 199 days now, 99 days by 15 March 2027 and 46 days by 15 March 2029. Each certificate then has to be replaced at least twice a year now and at least eight times a year from 2029, on every server, firewall and load balancer that uses it. sslbrain from FairSSL runs as an appliance in your own network and renews and installs the certificates from one place, including on devices without an agent.
ACME and automatic DNS validation in sslbrain(opens sslbrain.com in a new tab)Questions about AutoDNS
Find answers to the most common questions about SSL certificates and FairSSL.
Ready for automated domain validation?
Create a free account and order your first certificate. A DV certificate is issued in under 2 minutes.