Telegram Bot
Adding _globalsign-domain-verification TXT Record in DNS Settings — A Detailed Guide
4 min read
What is _globalsign-domain-verification?
_globalsign-domain-verification is a TXT DNS record required by GlobalSign, a Certificate Authority (CA), to verify domain ownership before issuing an SSL/TLS certificate.
For the conceptual overview and the parallel quick-add guide, see What is _globalsign-domain-verification? and How to Add _globalsign-domain-verification TXT Record (detailed).
This is part of the Domain Control Validation (DCV) process, ensuring only the legitimate domain owner can obtain an SSL certificate.
Why Do You Need to Add This TXT Record?
- Verifies that you own the domain before SSL issuance.
- Ensures a secure and automated certificate validation.
- Used as an alternative to email-based or HTTP-based validation.
Once the TXT record is detected by GlobalSign, they proceed with issuing the SSL certificate.
Step 1: Get the TXT Record from GlobalSign
When applying for an SSL certificate, GlobalSign provides a unique TXT record in this format:
Copy this exact value as you will need it in the next step.
Step 2: Understanding the TXT Record Format
Before adding the record, let's understand its structure.
Diagram of the TXT Record
Below is a visual representation of how the TXT record should be structured.
| Name | Type | Value |
|---|---|---|
| _globalsign-domain-verification | TXT | "abcdef1234567890abcdef1234567890" |
Breakdown of the Fields
- Name >
_globalsign-domain-verification - Type > TXT
- Value >
"abcdef1234567890abcdef1234567890"
Step 3: Determine Where DNS is Hosted
Before adding the TXT record, confirm where the DNS for your domain is managed.
How to Find Your DNS Provider
Use the following command-line tools to identify the authoritative DNS server.
Check via Command Line (Linux/macOS)
or
nslookup -type=NS example.com
(Replace example.com with your actual domain.)
Check via WHOIS Lookup
Use online tools:
The output will list the DNS provider, where you need to log in to add the TXT record.
Step 4: Add the TXT Record in the DNS Zone File
Once you know where the domain's DNS is managed, add the TXT record to your DNS settings.
Example DNS Zone File Entry (BIND or Similar DNS Server)
If you manage your own BIND DNS server, follow these steps.
- Open the DNS Zone File
sudo nano /etc/bind/zones/example.com.db
- Add the TXT Record
_globalsign-domain-verification IN TXT "abcdef1234567890abcdef1234567890" - Save and Exit the File.
- Reload the DNS Service to Apply Changes
sudo systemctl reload named
or
sudo rndc reload
The TXT record is now active.
Step 5: Verify the TXT Record Propagation
Once the TXT record is added, it may take a few minutes to 48 hours to propagate.
Verify Using Command Line
To check if the record is available:
or
nslookup -type=TXT _globalsign-domain-verification.example.com
If the correct verification value appears in the output, the setup is complete.
Verify Using Online Tools
Use external tools:
Step 6: Reduce DNS TTL for Faster Verification
If verification is urgent, reduce the TTL (Time to Live) before adding the TXT record.
- Open the DNS Zone File
sudo nano /etc/bind/zones/example.com.db
- Set a Lower TTL
$TTL 300(This reduces the waiting time to 5 minutes.)
- Save and Reload DNS
sudo systemctl reload named
Step 7: Notify GlobalSign & Complete SSL Verification
Once the TXT record is confirmed to be live, GlobalSign will automatically detect it.
If verification does not complete within 24 hours, manually notify GlobalSign support.
Troubleshooting Issues
| Issue | Solution |
|---|---|
| TXT record not found | Ensure it is added in the correct zone file and DNS is reloaded. |
| Incorrect TXT value | Copy the exact value provided by GlobalSign, ensuring no typos. |
| DNS record not propagating | Lower TTL and wait up to 48 hours for propagation. |
| Query returns old data | Clear the local cache using systemctl restart nscd. |
| External queries fail | Verify firewall settings to allow external DNS queries. |
Summary
| Step | Action |
|---|---|
| 1 | Obtain the _globalsign-domain-verification TXT record from GlobalSign. |
| 2 | Find where the domain's DNS is managed. |
| 3 | Edit the DNS zone file and add the TXT record. |
| 4 | Reload the DNS service to apply changes. |
| 5 | Verify the record using dig or nslookup. |
| 6 | Ensure proper DNS propagation. |
| 7 | Wait for GlobalSign to detect the record and issue the SSL certificate. |
Final Thoughts
By following this guide, a system administrator can successfully add the _globalsign-domain-verification TXT record and complete the domain validation process for SSL certificate issuance.
This method ensures secure, automated verification while preventing unauthorized certificate issuance.
Hosting
Cloud Solutions
For You
VDS
Website Builders
Our services
Client Area
USD - United States Dollar
EUR - Euro
GBP - British Pound
CAD - Canadian Dollar
CHF - Swiss Franc
JPY - Japanese Yen
AUD - Australian Dollar
RUB - Russian Ruble
TRY - Turkish Lira
CNY - Chinese Yuan
INR - Indian Rupee
UAH - Ukrainian Hryvnia