DV (Domain Validated) is the entry-level SSL certificate. The Certificate Authority checks ONE thing: that you control the domain. No identity verification, no business validation, no paperwork. Issued in under a minute by automated systems.
How "control" is proven (the CA picks one):
- HTTP file challenge — place a specific file at
http://yourdomain.com/.well-known/acme-challenge/... - DNS challenge — add a specific TXT record to your DNS
- Email challenge — click a link sent to one of the WHOIS contact addresses (admin, hostmaster, postmaster, webmaster)
Free DV options:
- Let's Encrypt — the dominant free CA. ~280 million sites use it. 90-day certificates, auto-renewed by ACME clients.
- ZeroSSL — alternative free CA, similar feature set.
- Bundled with hosting — AWS Certificate Manager, Cloudflare Universal SSL, Hostinger, etc. all provide free DV SSL.
Paid DV options ($30-$80/year) exist mainly for compatibility with legacy systems that don't trust Let's Encrypt, or for higher warranty amounts. Most users have no reason to pay for DV in 2026.
What DV does NOT do: prove your business is real, your organization exists, or that the domain owner is who they claim to be. For that, you need OV or EV SSL.
Visual indicator: padlock icon in the address bar. Identical to OV and EV in modern browsers since 2019 (browsers removed the visual distinction).
