What is DNS-PERSIST-01?

DNS-PERSIST-01 is an ACME challenge type that Let's Encrypt announced on 18 February 2026. It validates control of a domain through DNS, like DNS-01, but instead of publishing a fresh challenge token for every issuance it uses one standing record. You publish a TXT record at _validation-persist under the domain that names the certificate authority and the ACME account you authorise to issue for it, and that record is reused for the first certificate and for every renewal after it.

The problem it solves is operational. DNS-01 is the only challenge that works for wildcards and for hosts with no port 80, but a client that answers it needs live credentials for your DNS provider, and those API keys end up stored inside renewal jobs, CI pipelines and containers. A leak of one of them is a leak of the whole zone. DNS-PERSIST-01 moves the DNS change out of the renewal path: the record is set once by a person, and the client never touches DNS again.

The record binds two things, the CA and the account. A record that names Let's Encrypt and account 12345 authorises that account alone. Another CA ignores it, and another Let's Encrypt account cannot use it, so publishing it does not open issuance to anyone who can reach your ACME endpoint. The specification is an IETF draft, and Let's Encrypt has said the challenge would reach its staging environment first and production later in 2026, so check your client's release notes before relying on it.

For a monitor the interesting part is what does not change. A certificate obtained through DNS-PERSIST-01 has the same lifetime and the same renewal window as any other, and Let's Encrypt still publishes that window through ACME Renewal Information. Whether the client renewed through HTTP-01, DNS-01 or a persistent record, the failure that reaches users is the same: a renewal that did not happen, or one that happened on disk while the server kept serving the old certificate.