Domain Authentication is Step 6 of the Extended Validation (EV) SSL certificate process at ASEOHosting. At this stage the Certificate Authority (CA) needs to confirm that the organisation applying for the certificate genuinely controls the exact domain name the certificate will be issued for. To complete it, fill in the Domain Authentication (EV) form supplied with your order and return it as instructed. This page explains what that step checks, why it exists, and how to get through it without delays.
What domain authentication actually proves
Earlier EV steps establish who your organisation is: the enrolment form, organisation and operational-existence checks, your registered physical address, and telephone verification. Domain authentication answers a different question, does this verified organisation have the right to secure this specific domain? A CA will not put a green EV certificate on a domain that the applicant cannot demonstrably control, because the whole point of EV is a high-assurance link between a real, vetted business and the website visitors see.
Your organisation already vetted Domain control Step 6 check EV certificate issued Do you control this domain?How the check is usually satisfied
The exact method depends on the CA, but domain authentication for EV normally relies on one of a small set of proofs of control. Common options include:
- Email to a domain-based address. The CA sends an approval link to a recognised administrative address at your domain, such as admin@, administrator@, hostmaster@, postmaster@ or webmaster@.
- WHOIS registrant contact. The CA emails the contact listed against the domain registration, which is why your registrant details need to be current before you start.
- DNS record. You add a specific TXT or CNAME record the CA asks for, proving you can change the zone.
- File on the server. You upload a small verification file to a set path over HTTP or HTTPS.
Whichever route your CA offers, the Domain Authentication (EV) form records how you intend to prove control and confirms the domain matches the organisation being validated. If you manage your zone with us, adding a DNS record is straightforward; see the dns-and-ip-management notes in our knowledge base if you need a refresher on TXT and CNAME entries.
Common reasons this step stalls
- Privacy-protected WHOIS. If domain privacy hides the registrant email, the CA cannot reach the listed contact. Temporarily disabling privacy, or choosing an approver-email method instead, avoids this.
- No mailbox at the approver address. The admin-style addresses above must actually receive mail. Create the mailbox first if it does not exist.
- Domain name mismatch. The domain on the form must match the certificate request exactly, including whether you are covering the bare domain, www, or both.
- Stale registration data. Outdated registrant contacts are the single most frequent cause of delay, so confirm them before submitting.
Keeping your registration accurate is good practice well beyond SSL; if you need to correct contact details you can do so through your domain registration management, and the ICANN registrant guidance explains why current WHOIS data matters.
How this fits the wider EV picture
Extended Validation is the most thorough tier of certificate. Domain Validated (DV) certificates check only domain control; Organisation Validated (OV) adds a business check; EV goes further still with the organisation, address, telephone and domain steps you are working through here. That extra scrutiny is why EV takes longer to issue than a DV certificate, but it also produces the strongest assurance of who is behind a site. For network and multi-site operators running many properties, choosing the right certificate tier per site keeps trust signals consistent without over-buying validation you do not need.
To review the full sequence or pick up an earlier stage, see the Extended Validation (EV) hub. When you are ready to order, renew, or ask which certificate type suits a particular site, our SSL certificates page lists the available options and how to get one issued against your dedicated IP.
