Recently, during the automatic renewal of the SSL certificate, Cloudflare sent me an email requesting to add the DNS record _acme-challenge.
At first glance, the situation looked strange: Cloudflare already had a Universal SSL certificate for the domain, and the certificate covered both the main domain and the wildcard:
example.com
*.example.com
But for the next renewal, Cloudflare asked to manually add a TXT record.
Let's figure out what this is and why it is needed. But first, I checked if this was really an email from Cloudflare and not some clever way to steal the domain. After verification, I went to sort out this _acme-challenge.
ACME is a protocol that automates the issuance and renewal of SSL/TLS certificates. It is used, in particular, by Let's Encrypt, as well as other certificate authorities.
During verification, it is necessary to prove that the person or service requesting the certificate actually controls the domain.
One way to do this is the DNS-01 challenge.
In this case, a TXT record is created that looks something like this:
_acme-challenge.example.com
with a specific value:
y_DgjAHPWuxNmcyKLHhljRL-5e734ndz99rk_DLeSrF
The value is generated automatically and is part of a specific verification.
How verification works
In simplified form, the process looks like this:
Cloudflare / ACME
↓
generates challenge
↓
needs TXT record
↓
_acme-challenge.example.com
↓
DNS
↓
verification by the certificate authority
↓
certificate renewed
The certificate authority checks the DNS and looks for the required TXT record.
If the value matches the expected one, control over the domain is confirmed.
Why did Cloudflare ask me to add it manually
In my case, Cloudflare sent an email stating that it could not automatically perform the verification.
Among the possible reasons, Cloudflare mentioned:
use of partial CNAME DNS setup;
presence of a wildcard certificate;
the domain no longer resolves through the Cloudflare network;
Cloudflare's inability to add the necessary validation record on its own.
Especially important in my case was the wildcard certificate.
In the Edge Certificates settings, there was a certificate for:
example.com
*.example.com
That is, Cloudflare was using a certificate that covers not only the domain itself but also all its subdomains.
For wildcard certificates, DNS-based validation is used.
What record needs to be added
Cloudflare sent a specific TXT record that needed to be added to DNS.
It looks something like this:
Type: TXT
Name: _acme-challenge
Content: <unique value from Cloudflare>
As a result, the full DNS name will be:
_acme-challenge.example.com
Important: do not create a separate A record or CNAME for this if Cloudflare specifically requests TXT.
Also, do not invent the TXT value — it should be exactly what Cloudflare provided.
Why does _acme-challenge start with _
This is a service DNS name.
Underscore (_) is often used for special DNS mechanisms that are not intended for regular access through a browser.
Therefore:
_acme-challenge.example.com
does not mean that a new subdomain has appeared on the site.
This is a service record used for ACME validation.
Is it necessary to keep the TXT record forever?
Not necessarily.
If the record was created for a specific one-time verification, it may no longer be needed after it is completed.
But caution is needed here.
If you have automatic certificate renewal set up and are using DNS-01, the system may automatically create and delete such records.
Therefore, do not just delete all _acme-challenge records without understanding what they are used for.
Why there can be multiple records
In DNS, you can see several TXT records for one _acme-challenge.
Multiple validation records can exist if different verifications are occurring simultaneously or multiple certificates are using the same domain.
Therefore, it is not advisable to delete old records randomly.
What about Universal SSL in Cloudflare?
This can also be confusing.
In Cloudflare's SSL/TLS → Edge Certificates section, you can see several certificates at the same time.
For example:
Universal SSL → Managed
Backup → Managed
At the same time, one certificate may have an expiration date later than another.
Therefore, an email requesting to undergo validation does not automatically mean that the current HTTPS has already stopped working.
Cloudflare may be preparing or renewing another certificate within its management system.
What happens if _acme-challenge is not added
If Cloudflare cannot confirm control over the domain and cannot renew the necessary certificate before it expires, the certificate may be removed from Cloudflare Edge.
As a result, users may receive a TLS/SSL error when connecting to the site.
Therefore, such emails from Cloudflare are better not to ignore.
What I did in my case
Cloudflare sent me a TXT record for _acme-challenge.
I added it to the DNS records in Cloudflare. Because Namecheap (the domain registrar) points to Cloudflare. So the matter is in the Cloudflare configs.
But keep in mind that even if the site operates through Cloudflare, it does not always mean that Cloudflare manages the authoritative DNS records.
If the DNS is with another provider, Cloudflare may not always be able to create the necessary _acme-challenge on its own (or, as in my case, could not create it for itself).
The idea is simple: set up the delegation of _acme-challenge once, after which Cloudflare will be able to automatically place validation records during subsequent certificate renewals.
Another option is to use full DNS configuration of Cloudflare, where the authoritative nameservers of the domain point to Cloudflare.
In this case, Cloudflare has full control over DNS and can automatically create the necessary validation records. And to summarize:
_acme-challenge is not an error and not a "fake" subdomain.
This is a service DNS record used for ACME DNS-01 validation — confirming that you control the domain.
If Cloudflare asks to add:
_acme-challenge
as a TXT record, it means that it needs to pass DNS verification for the issuance or renewal of the SSL/TLS certificate.
In my case, this manifested during the renewal of Cloudflare Universal SSL, and the certificate included a wildcard *.<domain>. That is why the issue of DNS validation became particularly relevant.
