DNS-PERSIST-01: A NEW MODEL FOR DNS-BASED CHALLENGE VALIDATION

Summary from the TLDR InfoSec newsletter

DNS-01 is a standard for validating ACME certificate issuance by publishing a DNS record to verify the domain ownership. The mechanism can lead to operational complexity because it requires a new TXT record for each issuance, which may need DNS API credentials to be embedded in automation scripts. It also makes the renewal process vulnerable to DMS propagation delays. Let's Encrypt has proposed a new standard called DNS-PERSIST-01, which enables a persistent DNS record to pin an ACME request and specific CA that can issue records.