I am an ACME client author, and I'm looking to add dns-persist-01 support to my client. While I am aware that test servers based on, e.g., Pebble, could be used at the moment, I wonder if there is a more concrete indication of where dns-persist-01 is supported right now (staging? production?), and …

it's working in staging right now, but it's using draft-00 version nether pebble and boulder is doing precheck at order creation time. (and LE is not planning to do that)

I think the only public statement is at the end of this blog post: [image] DNS-PERSIST-01: A New Model for DNS-based Challenge Validation When you request a certificate from Let’s Encrypt, our servers validate that you control the hostnames in that certificate using ACME challenges. For…

Are there any updates to this? We're in Q2 now and it would be helpful to be able to plan if this is "soon" or, as another community politely puts it, "Voron soon".

The specification is still evolving, so it is somewhat difficult to predict. It may end up shipping in Q3, if consensus on some open issues do not resolve quickly at IETF.

[image] mcpherrinm: if consensus on some open issues do not resolve quickly at IETF. Personally I think it should be safe to ship the draft-00 spec in production at end of Q2. The CAB/F forum vote is approved, so "legally" there is no problem issuing certificates based on a DNS-PERSIST-01 va…

[image] sebastiannielsen: CAB/F allows approving a DNS-PERSIST-01 object based on the caaIdentities object (basically, an domain accepted for DNS-PERSIST-01 MUST be present in caaIdentitites array), and since letsencrypt only have one object in that array: " letsencrypt.org " - it should not be a …

[image] sebastiannielsen: The missing consensus is how certain objects should be populated There is also work on how wildcard will be validated. Aaron has posted about wanting an "ADN" to be set by the ACME Client. See: Will Let's encrypt support tree climbing for dns-persist-01 records? - …

[image] MaxHearnden: suitable issuer-domain-name as the domain is not signed with DNSSEC I read that requirement as - that the CA must protect the infrastructure behind "issuer-domain-name" with robust security measures - so a attacker could not spoof lets say: acme-v02.api.letsencrypt.org I…

Currently, accounturi is still missing from the challenge object in the staging environment. However, there is a commit that adds it. Update draft-ietf-acme-dns-persist-00 support to 01 (#8725) committed 02:39PM - 29 Apr 26 UTC (UTC) …

Dns-persist-01 deployment status and timeline

Issuance Tech

aarongable June 25, 2026, 2:49pm 17

We will not be deploying dns-persist-01 until Record should include client-computed information · Issue #64 · ietf-wg-acme/draft-ietf-acme-dns-persist · GitHub is resolved.

Does Certbot currently support the ACME `dns-persist-01` challenge?

Topic		Replies	Views
Does Certbot currently support the ACME `dns-persist-01` challenge? Help	1	382	June 26, 2026
How code the dns-persist-01 challenge Client dev	23	832	May 28, 2026
DNS-PERSIST without spending an Order Client dev	13	1044	May 5, 2026
Dns-persist-01 challenge Client dev	19	974	March 3, 2026
Problem finding dns-persist-01 in staging Client dev	25	1030	April 8, 2026

Dns-persist-01 deployment status and timeline

Related topics