ietf draft's section 5 and 6 mentions persist record with policy=wildcard allows and nested subdomain, but nether pebble and boulder currently do that tree climbing check. so I expect they won't but I'd like to have explict word for this

We currently do not plan to do tree-climbing. We would prefer to have the client indicate to us which (parent) domain we should be looking at, confirm it is a valid ADN, and then check just that one location.

I vaguely recall seeing some discussion about ways to let clients tell the ACME server which name(s) to check against for the persist records. It's not in the draft yet though.

Links that may be of interest: Dns-persist-01 wildcard authorisation depth - #2 by aarongable Subdomain validation prompting · Issue #33 · ietf-wg-acme/draft-ietf-acme-dns-persist · GitHub

Also, nothing prevents you from configuring your DNS server to allow _validation-persist.*.example.com. Note that this is not a standard feature, why you might need DNS server support able to do this, for example PowerDNS with LUA support or similiar. Also, validation complexity can appear, if yo…

from baseline rule about this challenge both are allowed to issue, but draft doesn't have why to ask acme server to look up upper domain name for persistent txt record.

Will Let's encrypt support tree climbing for dns-persist-01 records?

Issuance Policy

dextercd March 30, 2026, 6:45pm 3

Links that may be of interest:

Dns-persist-01 wildcard authorisation depth - #2 by aarongable
Subdomain validation prompting · Issue #33 · ietf-wg-acme/draft-ietf-acme-dns-persist · GitHub

Topic		Replies	Views
Subdomains with dns-persist-01 (staging) Client dev	7	903	May 29, 2026
Dns-persist-01 wildcard authorisation depth Issuance Tech	6	564	February 26, 2026
DNS-PERSIST without spending an Order Client dev	13	1308	May 5, 2026
Dns-persist-01 deployment status and timeline Issuance Tech	18	8925	July 21, 2026
DNS-PERSIST-01 and _validation-persist CNAME Issuance Tech	3	464	April 7, 2026

Will Let's encrypt support tree climbing for dns-persist-01 records?

Related topics