The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →To check a DNS TXT challenge in Node.js, call dnsPromises.resolveTxt() from node:dns/promises, join the chunks returned for each individual TXT record, and compare each complete record with the expected value. For ACME DNS-01, query _acme-challenge.<domain>. A match shows that the expected challenge value was visible through DNS for that validation name at the time of the lookup; it does not establish legal ownership or identify the person or organization controlling the domain.
Check a TXT record in Node.js
The promises API returns a two-dimensional array: each inner array contains the text chunks for one TXT record. Join chunks within each inner array before comparing it with the expected value. Do not join all returned strings together, because that could combine separate records.
As an Amazon Associate I earn from qualifying purchases.
import dns from 'node:dns/promises';
export async function hasTxtValue(hostname, expectedValue) {
const records = await dns.resolveTxt(hostname);
return records.some((chunks) => chunks.join('') === expectedValue);
}
const hostname = `_acme-challenge.${domain}`;
const verified = await hasTxtValue(hostname, expectedChallengeValue);This is an illustrative pattern, not a tested implementation. Define separately how your application handles timeouts, retries, cancellation, logging, and multiple matching or unrelated TXT records. The API was added in Node.js v10.6.0; the current documentation cited here is for Node.js v26.8.2. Node.js DNS documentation
What ACME DNS-01 verifies
ACME DNS-01 asks a client to publish a designated TXT value under a validation name formed by prepending _acme-challenge to the domain identifier. The challenge uses a random token with at least 128 bits of entropy; the client combines it with its account key to form a key authorization, computes a SHA-256 digest, and publishes the base64url-encoded digest as the TXT value. IETF RFC 8555
#1 Best Overall
In practical terms, a matching value demonstrates that the challenge response could be provisioned and observed through DNS for the relevant name. It is a test of control over that DNS validation path—not proof of legal title, organizational identity, or control of every service associated with the domain. Japan Registry Services describes DNS ownership/control checks as a challenge-response process: a service provider issues a one-time secret, the subscriber publishes it in authoritative DNS, and the provider queries DNS to verify it. Japan Registry Services, “Important Notes of Using Domain Name Ownership / Control Verification by DNS”
DNS-01 tests the ability to publish a DNS record. ACME’s HTTP-01 method instead tests whether a client can provision a file at a specified path on a server accessible under the domain. These are different control surfaces; DNS-01 is not universally preferable. RFC 8555
Rank #2
Separate a failed lookup from a failed match
Verification code should distinguish a DNS query error from a successful query that returns no matching record. With resolveTxt(), lookup failures reject the promise; a completed lookup returns the TXT records it found. Treat these as distinct outcomes:
Recommended Free Tools
- Lookup failed: DNS did not return a usable result to this query. Report or handle the error; do not call it a completed negative verification.
- Lookup succeeded, value absent: Records were returned, but none matched the expected complete challenge value.
- Lookup succeeded, value present: At least one complete TXT record matched the expected value.
In particular, Node.js documents that ENOTFOUND can arise from lookup failures other than a nonexistent name, including unavailable file descriptors. It is not conclusive evidence that the hostname does not exist. Node.js DNS documentation
Rank #3
DNS visibility can change as records are published and observed by resolvers. If your workflow expects a record to appear after provisioning, use bounded polling suited to your DNS provider and application. The cited standards do not prescribe a universal propagation delay or polling interval, so avoid reporting a fixed wait as a protocol requirement or declaring lack of control from one unsuccessful lookup.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Harden the issuance process around the TXT check
Use DNSSEC validation where appropriate
Japan Registry Services recommends that service providers enable DNSSEC validation on the full-service resolvers used for verification, and that subscribers deploy DNSSEC on authoritative DNS servers. These measures address the integrity of DNS data in the verification path; they do not change how Node.js represents TXT records. Japan Registry Services
Rank #4
Use CAA for certificate-issuance policy
CAA is separate from the challenge token. It lets a domain owner specify which certificate authorities may issue certificates for names in public DNS. Let’s Encrypt documents its CAA identifier as letsencrypt.org; its documentation notes that, by default, any public CA may issue if it validates control. The issue property governs ordinary and wildcard issuance unless a separate issuewild record changes wildcard handling. Let’s Encrypt CAA documentation
Let’s Encrypt also documents optional validationmethods and accounturi parameters. The former can restrict accepted validation methods, including http-01, dns-01, and tls-alpn-01; the latter can constrain issuance to an ACME account. CAA records with the same property type are additive: if any one allows issuance, it is allowed. CAA therefore governs issuance authorization; it neither supplies the TXT challenge value nor performs the Node.js TXT lookup. Let’s Encrypt CAA documentation
Quick Recap
Choose a validation method based on the available control surface
- DNS access: Can your process publish the required TXT record, manually or through a safe DNS-provider API?
- HTTP access: Can it serve the challenge file at the required path under the domain?
- TLS-ALPN access: Can the deployment configure the relevant TLS challenge method if the CA and client support it?
- Wildcard requirement: Confirm the current requirements of the certificate authority and ACME client you use before choosing a method.
- Operations and policy: Consider how you will observe and recover from DNS visibility or HTTP-serving failures, and whether CAA should limit the issuing CA, validation method, or ACME account.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
