_globalsign-domain-verification is a TXT DNS record required by GlobalSign, a Certificate Authority (CA), to verify domain ownership before issuing an SSL/TLS certificate.
This is part of the Domain Control Validation (DCV) process, ensuring only the legitimate domain owner can obtain an SSL certificate.
Once the TXT record is detected by GlobalSign, they proceed with issuing the SSL certificate.
When applying for an SSL certificate, GlobalSign provides a unique TXT record in this format:
Copy this exact value as you will need it in the next step.
Before adding the record, let's understand its structure.
Below is a visual representation of how the TXT record should be structured.
| Name | Type | Value |
|---|---|---|
| _globalsign-domain-verification | TXT | "abcdef1234567890abcdef1234567890" |
_globalsign-domain-verification"abcdef1234567890abcdef1234567890"Before adding the TXT record, confirm where the DNS for your domain is managed.
Use the following command-line tools to identify the authoritative DNS server.
(Replace example.com with your actual domain.)
Use online tools:
The output will list the DNS provider, where you need to log in to add the TXT record.
Once you know where the domain's DNS is managed, add the TXT record to your DNS settings.
If you manage your own BIND DNS server, follow these steps.
_globalsign-domain-verification IN TXT "abcdef1234567890abcdef1234567890"
The TXT record is now active.
Once the TXT record is added, it may take a few minutes to 48 hours to propagate.
To check if the record is available:
If the correct verification value appears in the output, the setup is complete.
Use external tools:
If verification is urgent, reduce the TTL (Time to Live) before adding the TXT record.
$TTL 300
(This reduces the waiting time to 5 minutes.)
Once the TXT record is confirmed to be live, GlobalSign will automatically detect it.
If verification does not complete within 24 hours, manually notify GlobalSign support.
| Issue | Solution |
|---|---|
| TXT record not found | Ensure it is added in the correct zone file and DNS is reloaded. |
| Incorrect TXT value | Copy the exact value provided by GlobalSign, ensuring no typos. |
| DNS record not propagating | Lower TTL and wait up to 48 hours for propagation. |
| Query returns old data | Clear the local cache using systemctl restart nscd. |
| External queries fail | Verify firewall settings to allow external DNS queries. |
| Step | Action |
|---|---|
| 1 | Obtain the _globalsign-domain-verification TXT record from GlobalSign. |
| 2 | Find where the domain's DNS is managed. |
| 3 | Edit the DNS zone file and add the TXT record. |
| 4 | Reload the DNS service to apply changes. |
| 5 | Verify the record using dig or nslookup. |
| 6 | Ensure proper DNS propagation. |
| 7 | Wait for GlobalSign to detect the record and issue the SSL certificate. |
By following this guide, a system administrator can successfully add the _globalsign-domain-verification TXT record and complete the domain validation process for SSL certificate issuance.
This method ensures secure, automated verification while preventing unauthorized certificate issuance.