DCV Checker
Check Sectigo/Comodo domain-control validation (HTTP file & CNAME).
Derive the Sectigo/Comodo HTTP-file and CNAME domain-control values from your CSR, then verify them live.
Only the domain and the two hashes are sent — never the CSR itself.
Quick answer
DCV Checker verifies that Sectigo/Comodo domain-control validation is correctly in place, checking both the HTTP validation file at /.well-known/pki-validation/ and the CNAME DNS record against the MD5 and SHA-256 values the CA expects. It catches missing files, typos, and unpropagated records before the CA rejects your request.
DCV Checker verifies that the domain-control validation you set up for a Sectigo or Comodo certificate is actually in place and correct, before the CA tries to validate it. Domain Control Validation is the step where a CA proves you control the domain you are requesting a certificate for. This tool checks the two automated Sectigo methods, an HTTP validation file and a CNAME DNS record, so you can confirm they are live and match the expected values rather than waiting for the CA to reject a broken setup.
The checks run from your browser against the public web and DNS. You provide the domain and the validation hashes Sectigo gave you (an MD5 and a SHA-256 value, plus a unique value for the CNAME method), and the tool fetches the file or resolves the record and compares what it finds to what the CA expects. A mismatch, a missing file, or an unresolved CNAME is exactly the kind of small error that stalls issuance, and catching it here saves a slow round trip with the CA.
The two Sectigo DCV methods
Sectigo (formerly Comodo CA) supports HTTP file validation and CNAME (DNS) validation for automated domain control. HTTP validation asks you to publish a specific text file at a fixed path on your site. CNAME validation asks you to add a specific DNS CNAME record. Both encode hashes derived from your CSR so the CA can confirm the request and your control of the domain are linked. This tool checks whichever you chose, so you know it is right before submitting.
HTTP file validation, worked example
For HTTP validation you place a file named after the MD5 hash at http://yourdomain/.well-known/pki-validation/<MD5>.txt. Its contents are the SHA-256 hash on the first line, then sectigo.com on the second line, and the unique value on a third line if one was issued. For example, for the file 1A2B3C...D4.txt the body reads the full SHA-256 hex on line one and sectigo.com on line two. The checker fetches that URL over plain HTTP (as the CA does) and confirms the file exists and its contents match.
CNAME validation, worked example
For CNAME validation you create a record whose host is the MD5 hash under your domain and whose target is built from the SHA-256 hash split across two labels, ending in sectigo.com. Concretely, _<MD5>.yourdomain.com points via CNAME to <first 32 hex chars of SHA-256>.<remaining 32 hex chars>.<uniqueValue>.sectigo.com. The tool resolves that name and checks the CNAME target matches the expected value, catching typos, a missing underscore, or a record that has not propagated yet.
Why check DCV before the CA does
When DCV is wrong, the CA simply reports validation failed, often with little detail and after a delay, and you retry blindly. Checking it yourself gives an immediate, specific answer: the file is missing, the contents differ, the CNAME does not resolve, or the value is stale. That turns an opaque back-and-forth into a quick fix. It is especially useful during automated or bulk issuance where one silent DCV failure can hold up a whole batch.
Frequently asked questions
- What is Domain Control Validation?
- DCV is how a Certificate Authority proves you control the domain before issuing a certificate for it. You demonstrate control by publishing something the CA specifies, an HTTP file, a DNS record, or by responding to an email. This tool checks the Sectigo HTTP-file and CNAME methods so you can confirm your proof is correctly in place before the CA validates it.
- Which DCV methods does this tool check?
- It checks the two automated Sectigo/Comodo methods: HTTP file validation, where a text file is published at /.well-known/pki-validation/, and CNAME validation, where a specific DNS CNAME record is added. Email validation cannot be checked externally because it depends on a mailbox, so this tool focuses on the file and DNS methods that are publicly verifiable.
- Where exactly does the HTTP validation file go?
- At http://yourdomain/.well-known/pki-validation/<MD5>.txt, where <MD5> is the hash Sectigo provided. The file's first line is the SHA-256 hash, the second line is sectigo.com, and a third line holds the unique value if you were given one. The CA fetches it over plain HTTP on port 80, so make sure that path is reachable without a redirect that strips it.
- What does the CNAME record look like?
- The host is the MD5 hash under your domain, like _<MD5>.yourdomain.com, and it CNAMEs to a target built from the SHA-256 hash split into two labels plus your unique value, ending in sectigo.com: <SHA-256 first half>.<SHA-256 second half>.<uniqueValue>.sectigo.com. Copy the values exactly; a single wrong character or a missing label fails validation.
- My DCV check fails but I set the record, why?
- Common causes are DNS not yet propagated (wait for the TTL and recheck), a typo in the long hash values, a missing underscore or label in the CNAME, or an HTTP file behind a redirect or blocked path. For the file method, confirm it is reachable over plain HTTP, not only HTTPS. Fix the specific mismatch this tool reports, then retry.
- Can I use this for bulk or automated issuance?
- Yes. Verifying DCV yourself before submitting is especially valuable at scale, where one silent validation failure can stall an entire batch. Checking each domain's file or CNAME here first gives an immediate pass or fail per domain, so you resolve problems up front instead of discovering them through slow, low-detail CA rejections.