What is the difference between automatic DNS verification and manual verification when applying for a DV certificate?

　　The core difference between automatic and manual DNS validation when applying for a DV certificate lies in who adds the validation record. With automatic validation, the system handles the task for you; with manual validation, you must add the record yourself via the domain's DNS management console.

　　Automatic DNS Validation: Handled by the System

　　Automatic DNS validation is the method recommended by cloud service providers. The logic is straightforward: if the account used to apply for the certificate is the same as the account managing the domain's DNS, the system has the authority to automatically add a TXT record—used to verify ownership—directly into your DNS records.

　　All you need to do is submit the application and wait. The system automatically completes the entire process in the background: adding the record, undergoing CA validation, and issuing the certificate. Platforms such as Alibaba Cloud, Huawei Cloud, and Tencent Cloud offer this feature. The typical requirements are that you are purchasing a DV certificate, the domain and certificate application are under the same account, and you are using the platform's own DNS resolution service.

　　The system automatically deletes this record after the certificate is issued, so you do not need to worry about it.

　　Manual DNS Validation: Do It Yourself

　　Manual validation is suitable for scenarios where the certificate application account differs from the domain DNS management account, or when the domain uses a third-party DNS service provider.

　　In these cases, the system cannot perform the action automatically; you must log in to the domain's DNS management console and manually add a TXT record. The Certificate Authority (CA)—such as DigiCert or GeoTrust—will provide a random string of characters that you must enter into the corresponding host record field.

　　Requirements vary slightly depending on the certificate brand. DigiCert and GeoTrust typically require a TXT record, whereas TrustAsia may require a CNAME record. Once added, you wait for the DNS changes to propagate; the CA will detect the record and issue the certificate.

　　You can choose to delete or retain the manually added record after the certificate is issued. DigiCert also offers a "persistent TXT record" mode, allowing you to configure the record once and reuse it for renewals without needing to add it again each time. How to choose: Consider account and DNS ownership

　　The criteria for deciding are actually quite simple:

　　If the certificate and the domain's DNS settings are managed under the same cloud platform account, prioritize automatic DNS verification. It is convenient, eliminates the risk of input errors, and offers faster issuance—usually completed within 1–2 business days.

　　If the domain's DNS is managed elsewhere (e.g., on Cloudflare, DNSPod, or by your company's IT department), you must use manual DNS verification. You simply obtain the record value provided by the Certificate Authority (CA), add it to the corresponding platform, and wait for it to take effect.

　　If the website server is not yet live, or if opening ports 80/443 to the public is not feasible, manual DNS verification is the only viable option. It does not rely on server ports; you only need access to the DNS management dashboard.

　　A common pitfall:

　　When manually adding a TXT record, pay close attention to the host record format. For a root domain certificate, the host record is usually `_dnsauth`; for a subdomain certificate, the format is something like `_dnsauth.qn`. You must copy the long string of characters provided by the CA exactly; even an extra space can cause verification to fail.

　　Additionally, if a CNAME record is already configured for the domain, you cannot add a TXT record under the same host record, as they will conflict. However, since the `_dnsauth` prefix is ​​a dedicated subdomain used specifically for verification, it typically does not conflict with existing CNAME records.

　　To verify if the configuration is active, you can use the command `nslookup -q=TXT _dnsauth.yourdomain.com`. If the returned record value matches the one provided by the CA, the configuration is correct.