Definition
Domain Validation (DV) is the lowest tier of TLS certificate issuance, requiring only proof of control over a domain — typically via DNS record or HTTP challenge. Compromised DNS makes DV issuance exploitable.
Key Points
- 2026-10-06: cctld-registry-hijack enabled attackers to pass DV checks for Google and other domains (tls-certificates)
- CAs followed correct procedures; vulnerability is architectural — DV cannot detect registry-level compromise
- Post-incident: CT monitoring, CAA restrictions, browser CRLSet emergency blocks