AWS Certificate Manager
User Guide (Version 1.0)

Validate Domain Ownership


The information on this page applies only to certificates provided by ACM. ACM does not validate domain ownership for certificates that you import into ACM. If you have trouble validating an ACM Certificate, see Troubleshoot Certificate Validation Problems. If you are not receiving email, see Not Receiving Validation Email.

You can specify one domain name and multiple alternative names, up to your permitted limit, in your certificate request. For more information about limits, see Limits. Before the Amazon certificate authority (CA) can issue a certificate for your site, AWS Certificate Manager (ACM) must verify that you own or control all of the domains that you specified in the request. ACM does this by sending domain validation email to addresses that are registered to the domains. For each domain name that you include in your certificate request, email is sent to 3 contact addresses in WHOIS and 5 common system addresses for your domain. That is, up to 8 email messages will be sent for every domain name that you specify in your request. For example, if you specify only 1 domain name, you will receive up to 8 email messages. To validate, you must act on 1 of those 8 messages within 72 hours. If you specify 3 domain names, you will receive up to 24 messages. To validate, you must act on 3 of the email messages, 1 for each name that you specified, within 72 hours.

Email is sent to the following three registered contact addresses in WHOIS:

  • Domain registrant

  • Technical contact

  • Administrative contact


Some registrars allow you to hide your contact information in your WHOIS listing, and others allow you to substitute your real email address with a privacy (or proxy) address. To prevent problems with receiving the domain validation email from ACM, ensure that your contact information is visible in WHOIS. If your WHOIS listing shows a privacy email address, ensure that email sent to that address is forwarded to your real email address. Or simply list your real email address instead.

If you use the console to request a certificate, ACM performs an MX lookup to determine which servers accept email for your domain and sends mail to the following five common system addresses for first domain found. If you use the RequestCertificate API or the request-certificate AWS CLI command, ACM does not perform an MX lookup. Instead, it sends email to the domain name you specify in the DomainName parameter or in the optional ValidationDomain parameter. For more information, see MX Record.

  • administrator@your_domain_name

  • hostmaster@your_domain_name

  • postmaster@your_domain_name

  • webmaster@your_domain_name

  • admin@your_domain_name

For more information about how ACM determines the email addresses for your domains, see Configure Email for Your Domain.

The console shows where the validation email messages have been sent for the first domain name you specify in your request. The email is sent from

			Console showing where validation emails were sent.


There is an exception to the process described above. If you request an ACM Certificate for a domain name that begins with www or a wildcard asterisk (*), ACM removes the leading www or asterisk and sends email to the administrative addresses. These addresses are formed by prepending admin@, administrator@, hostmaster@, postmaster@, and webmaster@ to the remaining portion of the domain name. For example, if you request an ACM Certificate for, email is sent to rather than to Likewise, if you request an ACM Certificate for *, email is sent to The remaining common administrative addresses are similarly formed.


Ensure that email is sent to the administrative addresses for an apex domain, such as, rather than to the administrative addresses for a subdomain, such as To do that, specify the ValidationDomain option in the RequestCertificate API or the request-certificate AWS CLI command. This feature is not currently supported in the console.

The following example shows the validation email that is sent for every domain name that you specify in your certificate request.

			Validation letter with included validation number.

Choose the link that sends you to the Amazon Certificate Approvals website and then choose I Approve.

			Approve your request for an ACM Certificate.

After choosing I Approve, a website opens to indicate that your request was successful.

			Success website.

You can navigate back to the ACM console by clicking a link on the success page. The Status column in the console indicates that the ACM Certificate has been Issued.

			ACM shows that your request was successful.