Coordinate other certificate issuers before delegating Cloudflare DCV

The validation CNAME becomes a continuing authority path, not a disposable one-time proof.

Source facts

Cloudflare documents delegated DCV for Advanced certificates in partial DNS setups, not Universal certificates. It uses persistent validation CNAME records so future orders can validate automatically. The guide warns that delegation is limited to one provider at a time and can interfere with other CDN or origin issuance workflows. Conflicting challenge TXT records also require review.

Source: Cloudflare — Delegated DCV — Domain Control Validation — SSL/TLS.

Applicability

This concerns the documented Cloudflare delegated-validation method.

DSE recommendation

DSE recommends inventorying all issuers and systems that validate the same hostnames before creating the CNAME. Coordinate origin, edge, and other-CDN renewal requirements and choose an alternative method where their coexistence demands it. Keep the validation record in the DNS inventory with a certificate owner and purpose. Do not remove it after initial issuance or delete conflicting records until their current owners and dependencies are understood. Have every current certificate issuer owner review the delegation before creating it. Record the intended ongoing renewal use beside the DNS entry and retain a contact for conflicts. Treat another issuer’s failed challenge as a coordination finding rather than deleting the continuing CNAME speculatively.

Verification

Query the challenge CNAME through the authoritative path and inspect the intended target. Confirm certificate issuance and the documented renewal configuration in a controlled workflow. Check other issuer requirements separately and record the retained delegation, avoiding an assumption that temporary absence of a TXT token means the continuing CNAME is unnecessary.

Official reference

Cloudflare — Delegated DCV — Domain Control Validation — SSL/TLS. Reviewed October 20, 2026.