Standard DNS-01 ACME challenges require creating a unique TXT record for each renewal attempt and deleting it afterwards. For automated agents in environments where DNS API access is unreliable, or where DNS propagation delays cause failures, this create-and-delete cycle is a common source of renewal errors. DNS-PERSIST-01 eliminates the cycle: the TXT record is derived from your ACME account key and never changes, so the agent sets it once and all future renewals just work.
Dns Persist 01

​
What it is

DNS-PERSIST-01 is an ACME challenge variant where the value placed at _acme-challenge.<domain> is derived from your ACME account key thumbprint rather than a per-authorization token. Because the record value depends only on the account key — not on the individual renewal — it stays valid across every renewal as long as the account key remains the same. TigerTrust provides a built-in helper to compute the correct record value and a verification step to confirm the record is live before submitting the challenge to the CA.

​
When to use it

  • Automate renewals in environments where your DNS provider does not expose an API for dynamic record management.
  • Avoid DNS propagation race conditions that cause DNS-01 failures when the CA checks before the record has propagated.
  • Manage certificates for domains hosted on DNS providers with slow propagation or strict API rate limits.
  • Simplify agent configuration by eliminating the per-renewal DNS write permission requirement.

​
Set it up

1

Open ACME integration settings

Go to Integrations > ACME and open the account for which you want to use DNS-PERSIST-01.
2

Select DNS-PERSIST-01 as the challenge type

In the challenge type dropdown, select DNS-PERSIST-01. The wizard shows the exact TXT record value to create, pre-computed from your account key thumbprint.
3

Create the DNS TXT record

In your DNS provider’s management console, create a TXT record at _acme-challenge.<your-domain> with the value shown in the wizard. You only need to do this once per domain.
4

Verify the record

Click Verify record in the wizard. TigerTrust performs a live DNS lookup and confirms the record matches the expected value before proceeding.
5

Save and use for renewals

Save the configuration. All future renewals for this domain using this ACME account will use the stable record without any further DNS changes.

​
What you’ll see

After the record is verified, the ACME account detail page shows DNS-PERSIST-01 as the active challenge type with a green Record verified badge. Renewals using this account no longer attempt to create or delete DNS records — the challenge passes automatically if the stable record is in place.
DNS-PERSIST-01 is not yet ratified by the IETF. CA support varies — check your CA’s ACME documentation before depending on this challenge type for production renewals. The standard dns-01 challenge type remains the safe default for most scenarios.

ACME

Full ACME integration including HTTP-01 and DNS-01.

DNS Providers

Provider integrations used to create TXT records automatically.

Renewal Automation

How challenge handling fits into the automated renewal flow.