Recommended Free Tools
Build domain verification as a finite state machine: check the exact expected DNS TXT name, accept verification only when a returned record matches the current token, and retry transient outcomes only within a fixed attempt limit and deadline. While a check is pending, tell the customer what is being checked, show the expected record details, and provide a next-check estimate only when your polling schedule supports it.
What “pending” should mean
A pending status should describe the verifier’s current work, not imply that domain ownership has already been proved or that DNS propagation will finish within a universal time. A TXT lookup can succeed while still returning no matching token; verification succeeds only when the expected value is found at the exact validation name.
As an Amazon Associate I earn from qualifying purchases.
Keep the customer’s action distinct from the verifier’s progress. An application might use pending after a request is created, checking or processing while DNS checks run, and verified after a match. Use terminal outcomes for situations such as a confirmed mismatch, invalid configuration, permission failure, or exhausted timeout. These are application-level choices: ACME’s challenge states are pending, processing, valid, and invalid.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Check the exact TXT record and compare values correctly
For DNS-01 validation, the domain controller publishes a TXT value at a validation name, and the validator queries that name and compares the result. ACME conventionally forms the name by prepending _acme-challenge to the domain. Other domain-verification systems may use a different owner name, record type, token, or security rule; use the values issued by the system doing the verification. See RFC 8555 and Let’s Encrypt’s challenge types guide.
#1 Best Overall
In Node.js, dnsPromises.resolveTxt() returns an array of TXT records, with each record represented by an inner array of text chunks. Join the chunks within each record before comparing it with the expected token, but do not combine separate records into one value. A successful DNS response is not proof of control unless a record at the requested name matches the current expected value. Promise failures include DNS error codes; record the code so the application can classify and diagnose the result. The API behavior is documented in the Node.js DNS documentation.
Classify outcomes before retrying
Retry policy should follow the observed outcome, rather than treating every unsuccessful check as the same kind of pending state. In particular, distinguish a missing or not-yet-visible record from a returned value that does not match, and from a DNS lookup error. RFC 8555 recommends retrying an initial failed validation query after some time to allow for DNS or HTTP provisioning delays, but it does not prescribe a universal schedule. The classification of particular Node.js DNS errors as transient or terminal is an application policy, not a rule supplied by the API or the RFC.
Rank #2
- Expected value found: mark the domain verified.
- No TXT record returned: this may be a temporary provisioning or visibility issue. Retry only while the configured deadline and attempt budget remain.
- TXT record returned, but no value matches: report a mismatch with the expected name and value. Decide explicitly whether to retry during the allowed window or ask the customer to correct the record; do not call it verified.
- DNS lookup error: retain the DNS error code and classify it according to a documented policy. A transient resolver failure may merit another attempt; an error indicating invalid configuration or denied access may call for a different recovery path.
Bound polling by attempts and elapsed time
Set both a maximum number of attempts and an overall deadline. A count alone can permit a long wait if intervals grow; a deadline alone can produce excessive load if attempts run too frequently. Use a deliberate delay between checks rather than a tight loop. If many verifications may run concurrently, jitter the delays to reduce synchronized bursts. The appropriate interval, jitter, attempt count, and deadline depend on the deployed resolver path, measured behavior, and support expectations; the cited standards do not specify these values.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →For each attempt, retain structured diagnostics such as the requested hostname, timestamp, DNS outcome or error code, returned TXT records, match result, attempt number, and remaining time. Restrict access to those logs and avoid exposing verification tokens unnecessarily. A timeout means your application stopped checking within its configured budget; it does not establish that DNS propagation has finished or that the record is absent everywhere.
Rank #3
Show the reason for waiting and the next useful action
Useful pending text names what the verifier is waiting for, identifies the expected record, and gives the customer a way to act. For example: “We’re waiting for the TXT record at _acme-challenge.example.com to become visible. Confirm the record name and value below; we’ll check again in about 30 seconds.” Use a duration like this only if the implementation actually schedules its next check accordingly. Show the expected value somewhere the customer can copy, while considering whether the interface should mask or otherwise protect it.
When the deadline or attempt budget expires, stop presenting an indefinite pending state. Explain that verification could not be completed within the allotted time, state the observed reason where known, and offer an appropriate next step such as correcting the record or requesting another check. DNS providers may not tell customers how long propagation will take, so avoid promising a universal number of minutes or hours. Let’s Encrypt notes this limitation for DNS API propagation in its challenge types documentation.
Rank #4
How to choose a resolver and retry policy
The verifier should check DNS through a path that makes sense for the system that ultimately validates the domain. When comparing implementations, assess:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Whether checks use an authoritative or recursive resolver, and whether that is consistent with the verifier’s actual resolution path.
- How retry intervals, total deadline, and attempt limit balance customer wait time against resolver load.
- Whether outcomes distinguish missing records, mismatches, and DNS errors well enough to guide support and customer recovery.
- What status and corrective action the customer sees while waiting and after a timeout.
- Expected load and cost when many verifications run at once.
Validate resolver-specific choices in the infrastructure where verification runs; a response from one resolver does not by itself establish what another resolver or validation service will observe.
Why a provider’s timeout is not a DNS-wide promise
Amazon Web Services documents that AWS Certificate Manager attempts DNS validation for up to 72 hours before timing out. Its documented failure reasons include record mismatch, access denied, missing hosted zone, CAA error, and timeout. Those are ACM-specific behaviors and statuses, not a general DNS propagation guarantee or a schedule to copy blindly into another application. See AWS Certificate Manager’s ACME domain validation documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
