Delegate certificate DNS validation without exposing the main zone credential

Confirm that both the certificate authority and your chosen ACME client support the intended delegated challenge workflow. Identify every certificate name, including wildcard and non-wildcard requests that may share a challenge owner name.

1. Create a validation-specific destination or child zone with an access-controlled account. Give the automation credential only the permissions needed for its challenge records.
2. Publish the required CNAME or child-zone NS delegation at the original _acme-challenge name. Keep ordinary website and mail records unchanged.
3. Configure the ACME client to place TXT values at the actual delegated destination. A certificate authority following the alias does not mean every client plugin automatically writes to the correct zone.
4. Use the authority's staging environment for an initial issuance and renewal test. Confirm the TXT value is authoritative before the client asks the authority to validate it.
5. Arrange secure certificate deployment to the web service and reload through its supported process. Clean up completed challenge values without deleting another concurrent validation's active TXT value.

Test unattended renewal with the main-zone credential absent from the application server. Verify the resulting certificate names, deployment path, service reload and monitoring of future renewal failures.

If validation fails, query the original challenge name and follow the actual delegation to its TXT answer. Check the client's alias support, record name, cache timing and CAA policy before replacing working website DNS.

• Delegate a subdomain to another authoritative DNS provider
• Use CAA records to authorise the certificate authorities your services need
• Add a provider's DNS verification record and remove it only when appropriate
• Review unexplained DNS changes and recover control of the authorised account

• Let's Encrypt: challenge types
• RFC 8555