Date: July 1, 2026
Google Trust Services now supports the dns-account-01 challenge type for
Automated Certificate Management Environment (ACME) domain validation.
This new challenge type, defined in the Internet-Draft
draft-ietf-acme-dns-account-challenge, lets you validate domain control
using DNS records that are specific to your ACME account.
Why use dns-account-01?
In the standard dns-01 challenge, validation requests use a fixed DNS label
(_acme-challenge.example.com). This can cause conflicts if you use multiple
ACME clients or CAs that require delegation using CNAME records.
The dns-account-01 challenge solves this by incorporating a hash of your ACME
Account URL into the DNS label (e.g.,
_acme-challenge_accountUniqueValue.example.com). This allows:
- Concurrent Delegation: Different teams or systems can validate the same domain concurrently using different ACME accounts.
- Reduced Coordination: No need to coordinate CNAME records between different integrations.
How to use it
To use the new challenge type, configure your ACME client to request
dns-account-01 validation.