What is different between the CNAME and DNS-01 challange?

100% There are no similarities between them.

so what is difference here for using CNAME method i need to add txt for every renewal

I think you need to be a lot clearer in your questions in order to get more helpful advice. I'll try to cover an overview of possible validation methods, though: Let's Encrypt follows CNAME records when validating records, just like any system querying DNS does. The current challenge types that Let…

[image] Buchi: using CNAME method The is no CNAME authentication method. You can augment authentication methods by using a CNAME to delegate your FQDN to some other FQDN; but no CA will [currently] validates merely because you created a CNAME record in DNS.

[image] rg305: The is no CNAME authentication method. Well, not through ACME (directly, though yes of course CNAME records get followed). But a CA can validate a domain name through method 3.2.2.4.7 DNS Change, which allows for a CNAME with a random value.

[image] rg305: CA will validate merely because you created a CNAME record in DNS. This is not quite true. The Baseline Requirements allow the Random Token to be placed in a CNAME record, e.g. as part of a subdomain label. However, few CAs actually do this, and no ACME CAs do it. But the mere …

CNAME validation

Help

AtmosphericIgnition April 10, 2026, 5:05pm 8

I had what seems to be a similar question a couple of weeks ago, maybe this thread will help you understand CNAME better.

Topic		Replies	Views
Does Certbot support CNAME challenge? How does CNAME validation work vs DNS-01? Help	2	203	April 15, 2026
CNAME Unknown for certbot renew Help	7	2117	April 30, 2021
How to know which _acme-challenge DNS record to configure? Help	19	10102	October 5, 2021
Instructions for renewing ACME wildcard certificates Help	11	1409	February 13, 2021
DNS-PERSIST-01 and _validation-persist CNAME Issuance Tech	3	351	April 7, 2026

CNAME validation

Related topics