# DNS challenge question for user owned domains **URL:** \ **Category:** Help\ **Created:** [July 19, 2017, 5:22pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458 "2017-07-19T17:22:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![billsader1987](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@billsader1987](https://community.letsencrypt.org/u/billsader1987)\ **Post date:** [July 19, 2017, 5:22pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/1 "2017-07-19T17:22:29Z")
My question isn’t about a specific domain, but rather to better understand the process which you use dns-01 to validate a domain and if the steps can be separated. I’ll list out my desired process below. - Client registers custom domain to replace their [subdomain.application.com](http://subdomain.application.com) - We begin a DNS challenge, requesting the TXT record value from Let’s Encrypt - We return that TXT record to the client, with instructions on how to update/add the entry - We have a process that periodically checks the \_acme-challenge TXT entry to see if it’s present/valid (based on what was previously returned) - When that check returns positive, we finalize the authorization and get the appropriate cert files from Let’s Encrypt, allowing us to deliver secure content over their domain (or subdomain) that is pointing to our application via CNAME. The issue with this is since we’re relying on our users to update their DNS entries, it can take anywhere from hours to days for the TXT record to be put in place. At the moment, I’m having trouble finding out how to “split” the dns challenge process into requesting the record value, and authenticating the record value into two individual requests. Is this even possible with Let’s Encrypt/ACME, or should I look for another solution? ---
**Author:** ![tob](https://avatars.discourse-cdn.com/v4/letter/t/a88e57/32.png) [@tob](https://community.letsencrypt.org/u/tob)\ **Post date:** [July 19, 2017, 6:50pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/2 "2017-07-19T18:50:52Z")
Let the user make a CNAME \_acme-challenge to a record in one of your own zones, and change this record to the desired challenge response. ---
**Author:** ![billsader1987](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@billsader1987](https://community.letsencrypt.org/u/billsader1987)\ **Post date:** [July 19, 2017, 7:11pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/3 "2017-07-19T19:11:09Z")
I love this idea - it would solve the reauthorizing problem as well. I wasn’t aware you could set a CNAME for a subdomain and have the TXT entry where the CNAME is pointing to. If that works then this is definitely the end-all solution to my problem. ---
**Author:** ![jared.m](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jared.m/32/17871_2.png) [@jared.m](https://community.letsencrypt.org/u/jared.m)\ **Post date:** [July 19, 2017, 7:11pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/4 "2017-07-19T19:11:33Z")
I don’t believe that solves the issue. It seems the concern is that clients will take considerable amounts of time to enter this, and thus the question is how to split up the receiving of an authz and asking for its verification. I’m not sure if certbot can do this, it will probably take a different, or custom-coded, ACME client. ---
**Author:** ![billsader1987](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@billsader1987](https://community.letsencrypt.org/u/billsader1987)\ **Post date:** [July 19, 2017, 7:31pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/5 "2017-07-19T19:31:18Z")
If I am able to do what tob indicated, and somehow pass along the TXT request via CNAME to a DNS server that I own, I could update that automatically after the initial CNAME is created. I wouldn’t have to start the Let’s Encrypt process until after the CNAME is already present. Unfortunately I’m not sure _how_ to what tob suggested, I’ve tried a few tests and I’m not able to get it working. ---
**Author:** ![billsader1987](https://avatars.discourse-cdn.com/v4/letter/b/f4b2a3/32.png) [@billsader1987](https://community.letsencrypt.org/u/billsader1987)\ **Post date:** [July 19, 2017, 7:47pm UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/6 "2017-07-19T19:47:00Z")
Hey guys just to want to tie this off - I was able to solve this by what tob suggested initially. I’ll need to setup a dedicated DNS host so I can programmatically add/update the required TXT entries, but this brings all of the validation for their domains into my environment. You guys are lifesavers! ---
**Author:** ![ahaw021](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/ahaw021/32/14882_2.png) [@ahaw021](https://community.letsencrypt.org/u/ahaw021)\ **Post date:** [July 20, 2017, 10:55am UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/7 "2017-07-20T10:55:59Z")
can you explain this a bit more what did you actually create I am still a bit confused on the CNAME for the TXT RECORD \_acme-challenge.example.com points to your DNS server? I would have thought it would have made more sense to use TLS-SNI or HTTP Challenge and get the clients to add one CNAME pointing at a web server that you own and can pass challenges with. Andrei ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 19, 2017, 10:56am UTC](https://community.letsencrypt.org/t/dns-challenge-question-for-user-owned-domains/38458/8 "2017-08-19T10:56:09Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.