AWS Certificate Manager Enables Seamless Switching from Email to DNS Domain Validation

In response to evolving industry standards, AWS ACM introduced 2026 support to change domain validation methods without reissue.

By Amelia Ross · Editorial pseudonym · 2026-08-13 · 1 min read

AI-ASSISTED REPORTING · RETROSPECTIVE ARCHIVE

Retrospective edition: 2026-08-13. Source published: 2026-08-13. Added to this archive: 2026-11-03. This briefing was prepared later from the linked announcement; it was not published on this website on the historical edition date.

Addressing the deprecation of email-based validation mandated by the CA/B Forum, AWS Certificate Manager allows existing public TLS certificates to switch from email to DNS validation. This change does not require certificate reissue or ARN modification, preserving integration continuity in deployments.

The process involves ACM providing CNAME DNS records to be added within 72 hours. Transitioning early to DNS validation facilitates full automation for future renewals and helps maintain compliance ahead of the 2027-2028 phase-out timeline for email validation across public certificates in AWS Regions globally.

Source & further reading

AWS Certificate Manager supports switching from e-mail to DNS validation ↗

Source published 2026-08-13. This report was prepared with AI assistance from the linked primary-source material. Claims and limitations should be checked against the original announcement or research.