Guide · updated November 15, 2026
Email (admin@) domain validation ends March 15, 2028: what certificate buyers must change
If you approve each certificate by clicking a link sent to admin@ or webmaster@ your domain, that method ends on March 15, 2028 (In 486 days). After that date, earlier email validations can’t be reused either.[CA/Browser Forum]
What exactly ends
| Method (Baseline Requirements) | Change |
|---|---|
| 3.2.2.4.4 Email to admin@, administrator@, webmaster@, hostmaster@, postmaster@ your domain | “Should not” be used from March 15, 2026; not allowed from March 15, 2028 |
| 3.2.2.4.13 Email to the DNS CAA contact | Not allowed from March 15, 2028 |
| 3.2.2.4.14 Email to the DNS TXT contact | Not allowed from March 15, 2028 |
| 3.2.2.4.16 / 3.2.2.4.17 Phone contact via DNS TXT / CAA record | Not allowed from March 15, 2027 |
Source: CA/Browser Forum Baseline Requirements (Ballot SC-090 and related changes).[CA/Browser Forum]
Who is affected
Mainly people who buy certificates from a reseller (GoDaddy, Namecheap and others) and choose “email” as the validation method when ordering or reissuing. With shorter certificates you reissue more often, so this also becomes more frequent work. If your host or an ACME client issues your certificate, you’re not affected: ACME uses HTTP, DNS or TLS-ALPN challenges.[CA/Browser Forum]
What to switch to
- DNS validation: add the TXT or CNAME record your CA or reseller gives you (BR method 3.2.2.4.7 “DNS Change”). A newer method, 3.2.2.4.22 “DNS TXT Record with Persistent Value”, lets one DNS record stay in place across renewals.[CA/Browser Forum; Let's Encrypt]
- File / HTTP validation: place a file your CA gives you on your website (method 3.2.2.4.18).[CA/Browser Forum]
- Automatic issuance (ACME): your host or ACME client handles validation for you (ACME-specific methods include 3.2.2.4.19 and 3.2.2.4.20).[CA/Browser Forum] See automating on shared hosting.
Set this up at your next reissue, well before March 15, 2028, and you won’t be caught out by an approval email that no longer works.
Questions
When does email domain validation end?
Certificate authorities must not rely on email to admin@, administrator@, webmaster@, hostmaster@ or postmaster@ your domain (or to the DNS CAA/TXT email contact) from March 15, 2028. Since March 15, 2026 these methods “should not” be used.
Does this affect Let’s Encrypt users?
No. ACME clients prove control with HTTP, DNS or TLS challenges, not email.
What should I use instead?
DNS validation (adding a TXT or CNAME record your CA gives you) or file/HTTP validation (placing a file on your website). If you can, move to automatic issuance (ACME), which does this for you.
What about phone validation?
Phone validation through the DNS TXT or CAA phone contact ends on March 15, 2027.
Sources
- CA/Browser Forum — Baseline Requirements for TLS Server Certificates (v2.3.1, 4 Oct 2026) (CA/Browser Forum, accessed November 15, 2026)
- Let's Encrypt — DNS-PERSIST-01: A New Model for DNS-based Challenge Validation (Feb 18, 2026) (Let's Encrypt, accessed November 15, 2026)
Facts on this page last checked November 15, 2026.