One DNS record can let a CA keep issuing for your domain

Someone who gets into your DNS briefly can leave a record that lets them keep getting certificates for your domain after you lock them out. The record can stay valid until someone removes it or it expires.

The dns-persist-01 method (Ballot SC-088v3) lets a publicly trusted certificate authority (CA) check that you control a domain by reading a TXT record that stays in place. The record's name starts with _validation-persist. followed by the domain name. It names a CA and one account at that CA.

Here's a domain before and after someone adds one, using the example from the IETF draft:

Before:
_validation-persist.example.com.  (no TXT record)

After:
_validation-persist.example.com. IN TXT ("authority.example;"
" accounturi=https://ca.example/account-hash/"
"sha-256/5SQm7n6tPh2-PlLbCKGnViTXX5z19SCN4cPGQHSk-kw")

That makes the record worth watching after a DNS security incident. It also matters when you deliberately rely on a grant and need to know if it disappears.

How we watch the grant

Add a DNS monitor for example.com and pick DNS-PERSIST-01 as the record type. Most domains publish no such record, and we read that as healthy.

A new monitor ticks No persistent authorization. When a record appears, we record the change as "CA grant added or restored", and that assertion breaks. We alert only when an assertion you've ticked breaks or recovers.

A new monitor also ticks No wildcard authorization, which breaks when a grant adds policy=wildcard.

If you rely on a grant on purpose, untick No persistent authorization and tick Persistent authorization present. That assertion breaks once no live grant is left.

What the check sees

We read the record. We can't see which certificates a CA issued under it.

Each monitor watches one name. A record at _validation-persist.api.example.com lets a CA issue for api.example.com, and only a monitor for that name sees it.