DNS-Persist-01: A New Model for DNS-Based Challenge Validation

Re:DNS-Persist-01: A New Model for DNS-Based Challenge Valid... by liambigelow on Wednesday February 18, 2026 @04:20PM (#47066583)

CAA records including an accounturi already expose the account identity in the same manner, so I feel like that ship has already sailed somewhat (and I would prefer that the CAA and persist record formats match).

[ Parent | on HN ]

Re:DNS-Persist-01: A New Model for DNS-Based Challenge Valid... by Bender on Thursday February 19, 2026 @01:26PM (#47077165)

I think the difference is that using the existing DNS method listing the account is entirely optional. I have left it out on domains that I don't want correlated for that very reason.

[ Parent | on HN ]

Re:DNS-Persist-01: A New Model for DNS-Based Challenge Valid... by TrueDuality on Friday February 20, 2026 @05:08PM (#47094706)

The accounturi is an optional extension. Email, and phone are also optional. This is the first challenge that publicly requires you to specify your account ID publicly. There may be implementations that require it but neither Let's Encrypt or the protocols require them.

[ Parent | on HN ]