DNS-01 validation
Prove domain control with a TXT record at _acme-challenge. Required for wildcard certificates and useful when port 80 is not reachable.
How it works
The CA asks you to publish a TXT record. The platform returns the record name and value on the certificate order. After you publish it — or Cloudflare does — call the validate endpoint so the order can proceed to finalize.
Manual vs automated
Manual DNS is always available. Cloudflare automation uses a token you store encrypted on a DNS integration. We do not host DNS for you.
Wildcards
A name like *.example.com cannot be validated with HTTP-01. Use DNS-01. The platform rejects wildcard requests that specify http-01.