具持久性紀錄值之 DNS TXT 紀錄

DNS TXT Record with Persistent Value

Confirming the Applicant’s control over the ADN by verifying the presence of a Persistent DCV TXT Record identifying the Applicant. The record MUST be placed at the “_validation-persist” label prepended to the ADN being validated (i.e., “_validation-persist.[Authorization Domain Name]”).

透過檢查持久性 DCV TXT 紀錄（Persistent DCV TXT Record）是否存在來識別申請者（Applicant）身分，以確認申請者對經授權網域名稱（Authorization Domain Name，ADN）的控管權。該紀錄應（MUST）設置於待驗證之經授權網域名稱（ADN）加上前頭的「_validation-persist」標籤所形成的 DNS 紀錄名稱（即「_validation-persist.[經授權網域名稱]」）下。

The CA MUST confirm the Persistent DCV TXT Record’s RDATA value fulfills the following requirements:

憑證機構（Certification Authority，CA）應（MUST）確認持久性 DCV TXT 紀錄的 RDATA 值符合以下要求：

1. The RDATA value MUST conform to the issue-value syntax as defined in RFC 8659, Section 4.2; and

1. RDATA 值應（MUST）符合 RFC 8659 第 4.2 節 所定義的 issue-value 語法；且

2. The issuer-domain-name value MUST be an Issuer Domain Name disclosed by the CA in Section 4.2 of the CA’s Certificate Policy and/or Certification Practices Statement; and

2. issuer-domain-name 之值應（MUST）為 CA 於憑證政策（Certificate Policy，CP）及／或憑證實務作業基準（Certification Practice Statement，CPS）第 4.2 節中記載的簽發者網域名稱（Issuer Domain Name）；且

3. The issue-value MUST contain an accounturi parameter, where the parameter value is a unique URI (as described by RFC 8657, Section 3) identifying the account of the Applicant which requested validation for this FQDN; and

3. issue-value 應（MUST）包含 accounturi 參數，其參數值為唯一 URI（如 RFC 8657 第 3 節 所述），用以識別請求 FQDN 驗證的申請者帳號；且

4. The issue-value MAY contain a persistUntil parameter. If present, the parameter value MUST be a base-10 encoded integer representing a UNIX timestamp (the number of seconds since 1970-01-01T00:00:00Z ignoring leap seconds); and

4. issue-value 得（MAY）包含 persistUntil 參數。若該參數存在，其參數值應（MUST）為 10 進位編碼的整數，代表 UNIX 時間戳記（自 1970-01-01T00:00:00Z 起計算的秒數，忽略閏秒）；且

5. The issue-value MAY contain additional parameters. CAs MUST ignore any unknown parameter keys.

5. issue-value 得（MAY）包含額外的參數。CA 應（MUST）忽略任何未知的參數名稱（Parameter Key）。

If the persistUntil parameter is present, the CA MUST evaluate its value. If the time of the check is after the time specified in the persistUntil parameter value, the CA MUST NOT use the record as evidence of the Applicant’s control over the FQDN.

若存在 persistUntil 參數，CA 應（MUST）評估其參數值。若檢查的時間晚於 persistUntil 參數值所指定的時間，CA 不得（MUST NOT）將該紀錄作為申請者擁有 FQDN 控管權之證據。

For example, the Persistent DCV TXT Record might look like: _validation-persist.example.com IN TXT "authority.example; accounturi=https://authority.example/acct/123; persistUntil=1782424856"

例如，持久性 DCV TXT 紀錄看起來可能像： _validation-persist.example.com IN TXT "authority.example; accounturi=https://authority.example/acct/123; persistUntil=1782424856"

For the purposes of Section 4.2.1, CAs MUST consider 10 days as the maximum validation data reuse period for validations completed using this method.

為了符合第 4.2.1 節之方針，對於使用此方法完成之驗證，CA 應（MUST）將 10 日視為可重複使用已驗證資料之最大天數。

The following table shows how the persistUntil parameter affects whether a DNS record can be used for validation at different points in time:

下表顯示 persistUntil 參數在不同的時間點，如何影響 DNS 紀錄是否可被用於驗證：

Examples of how the persistUntil parameter affects validation

Date/time of validation	persistUntil	Usable for validation	Explanation
2025-06-15T12:00:00Z	2026-01-01T00:00:00Z (1767225600)	Yes	Validation time is before persistUntil timestamp, so record is usable
2025-06-15T12:00:00Z	2025-01-01T00:00:00Z (1735689600)	No	Validation time is after persistUntil timestamp, so record is not usable
2025-06-15T12:00:00Z	(not present)	Yes	No persistUntil parameter present, so no time restriction applies

CAs performing validations using this method MUST implement Multi-Perspective Issuance Corroboration as specified in Section 3.2.2.9. To count as corroborating, a Network Perspective MUST observe a Persistent DCV TXT Record that demonstrates the Applicant’s control over the domain and contains the same accounturi parameter as the Primary Network Perspective.

使用此方法進行驗證的 CA 應（MUST）實施第 3.2.2.9 節所規範之多視角簽發佐證（Multi-Perspective Issuance Corroboration）。若要算作有效佐證，其他網路視角（Network Perspective）應（MUST）觀察到申請者證明其網域控管權的持久性 DCV TXT 紀錄，且其中包含與主要網路視角（Primary Network Perspective）相同的 accounturi 參數。