# Coordinate other certificate issuers before delegating Cloudflare DCV

> The validation CNAME becomes a continuing authority path, not a disposable one-time proof.

- Canonical URL: https://update.dsesecurity.com/updates/coordinate-other-certificate-issuers-before-delegating-cloudflare-dcv/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:59+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The validation CNAME becomes a continuing authority path, not a disposable one-time proof.

## Potentially affected

This concerns the documented Cloudflare delegated-validation method.

## DSE recommendation

DSE recommends inventorying all issuers and systems that validate the same hostnames before creating the CNAME.

## Article

The validation CNAME becomes a continuing authority path, not a disposable one-time proof.

## Source facts

Cloudflare documents delegated DCV for Advanced certificates in partial DNS setups, not Universal certificates. It uses persistent validation CNAME records so future orders can validate automatically. The guide warns that delegation is limited to one provider at a time and can interfere with other CDN or origin issuance workflows. Conflicting challenge TXT records also require review.

Source: [Cloudflare — Delegated DCV — Domain Control Validation — SSL/TLS](https://developers.cloudflare.com/ssl/edge-certificates/changing-dcv-method/methods/delegated-dcv/).

## Applicability

This concerns the documented Cloudflare delegated-validation method.

## DSE recommendation

DSE recommends inventorying all issuers and systems that validate the same hostnames before creating the CNAME. Coordinate origin, edge, and other-CDN renewal requirements and choose an alternative method where their coexistence demands it. Keep the validation record in the DNS inventory with a certificate owner and purpose. Do not remove it after initial issuance or delete conflicting records until their current owners and dependencies are understood. Have every current certificate issuer owner review the delegation before creating it. Record the intended ongoing renewal use beside the DNS entry and retain a contact for conflicts. Treat another issuer’s failed challenge as a coordination finding rather than deleting the continuing CNAME speculatively.

## Verification

Query the challenge CNAME through the authoritative path and inspect the intended target. Confirm certificate issuance and the documented renewal configuration in a controlled workflow. Check other issuer requirements separately and record the retained delegation, avoiding an assumption that temporary absence of a TXT token means the continuing CNAME is unnecessary.

## Official reference

[Cloudflare — Delegated DCV — Domain Control Validation — SSL/TLS](https://developers.cloudflare.com/ssl/edge-certificates/changing-dcv-method/methods/delegated-dcv/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Delegated DCV — Domain Control Validation — SSL/TLS
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/ssl/edge-certificates/changing-dcv-method/methods/delegated-dcv/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Coordinate other certificate issuers before delegating Cloudflare DCV,” DSE Security, https://update.dsesecurity.com/updates/coordinate-other-certificate-issuers-before-delegating-cloudflare-dcv/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.