isitdns?

_acme-challenge check: DNS-01 before validation

_acme-challenge check

Is the DNS-01 token published where the certificate authority will look, and has a cached negative answer stopped it?

isitdns.net/#dig: the same question over DoT, Do53 over TCP and UDP, IPv6, or at any public resolver address.

read
  • GO NOERROR with a TXT holding the token the ACME client published (RFC 8555 section 8.4).
  • NO GO type TXT: NXDOMAIN, or NOERROR with 0 answers and an SOA in AUTHORITY: the negative answer is cached for the smaller of the SOA record's own TTL and its MINIMUM field (RFC 2308 section 5) -> you: publish the record at every nameserver, then validate after that TTL has passed.
  • NO GO type TXT answering a CNAME and no TXT behind it (ANSWER holds the CNAME, no TXT record, an SOA in AUTHORITY): the resolver followed the CNAME and the target has no token, or its negative answer is cached in the target's zone for the same smaller-of-two TTL -> you: publish the TXT at the target at every nameserver, then validate after that TTL has passed.
  • NOT RUN type CNAME: a CNAME at _acme-challenge means the token lives at the target and this read did not look there; NOERROR with 0 answers means no CNAME, not a missing token, and the TXT read decides. Ask TXT at the same name: a resolver follows the CNAME (RFC 1034 section 3.6.2) and returns the target's TXT, and GO is that TXT holding the token.
example

_acme-challenge.example.com TXT, read 2026-10-18T22:02:05Z:

  isitdns · dig · _acme-challenge.example.com TXT
  ;; asked 2026-10-18T22:02:05.021Z over DoH (dnssec on) from the Cloudflare edge, not your network

  ;; @cloudflare (cloudflare-dns.com) over DoH · 18 ms · 387 bytes · NOERROR · flags: qr rd ra ad
  ;; asked 2026-10-18T22:02:05.021Z from the Cloudflare edge (IAD), remote address unavailable from this vantage
  ;; ANSWER (5)
  _acme-challenge.example.com.     300  IN  TXT    "12Z-wRjmkwPupycBbFJ3ZjujOps9gCGmBPj9BzUSvyA"
  _acme-challenge.example.com.     300  IN  TXT    "DUB6OB4ruWFHMZ7mVn1z01dC6kZBeCjthZsKCP94VjE"
  _acme-challenge.example.com.     300  IN  TXT    "EHeiHtGZ-zmDoSCWFUlc59SAmtiZVEDwHB1kos0M76Y"
  _acme-challenge.example.com.     300  IN  TXT    "Y1I_ADGr2MsnUUJs7A0wu5dnKYzRPz-YcQRIjuSzXN4"
  _acme-challenge.example.com.     300  IN  RRSIG  TXT 13 3 300 20261019230205 20261017210205 34505 example.com. S4qMyuLPiufJNyuxSLGTCipiV+9FbmulTNTdkgxMZpNKelqySQaNhAIsz4dBIfy2XzcuirhZiVCqOeKoy1HTSg==  ; key tag 34505, inside its window, expires 24 h after this read (the signature itself is not checked here)
  ;; EDE: none received

  ;; the same question from your own machine: dig +https @cloudflare-dns.com _acme-challenge.example.com TXT +dnssec

  browser: https://isitdns.net/dig?name=_acme-challenge.example.com&type=TXT&resolver=cloudflare
from your own machine
dig +https @cloudflare-dns.com _acme-challenge.example.com TXT +dnssec
dig +norec @hera.ns.cloudflare.com _acme-challenge.example.com TXT

The second asks one of the zone's own servers with recursion off: the record is either there or it is not, no cache in between.

the manual
other jobs