This article explains why system-managed DCV TXT records, such as _dnsauth.example.com, cannot be manually modified or deleted in UltraDNS when they are created through the DigiCert CertCentral integration.
The restriction applies to records managed by the integration. The _dnsauth hostname alone does not establish whether a record was created manually or by the system.
When to Use This Article
- You are attempting to modify or delete a system-managed CertCentral validation TXT record in UltraDNS.
- The operation fails with
Only system user can create the required record type, including when using an administrator account. - You need to determine whether a validation record is managed by the CertCentral integration.
If no validation record has been created and the domain does not show automation in CertCentral, use the integration troubleshooting article. A missing record is a different symptom from a rejected deletion.
Why Manual Modification or Deletion Fails
Records created through the CertCentral integration are managed by a system-level process as part of domain validation. UltraDNS restricts manual modification and deletion of those system-managed records. These restrictions apply regardless of the user's administrative role or account privileges.
A system-managed record may look similar to a user-created DNS record in the portal. The absence of a read-only or system-controlled visual indicator does not establish that it can be edited manually.
Confirm Which Workflow Owns the Record
- Record the exact hostname, TXT value, attempted operation, error, and time, including the time zone.
- Review the domain's UltraDNS audit history for the record's creation and subsequent changes. Activity by
ultradns_systemidentifies integration-managed record operations. - Review the domain's automation and validation status in CertCentral.
- If the available history does not establish ownership, contact Support before modifying or deleting the record. Provide the audit date range and filters used.
Do not determine ownership from the _dnsauth name, the record's appearance in the portal, or the user's permissions alone.
How System-Managed Records Are Managed
The CertCentral integration manages creation, updates, and removal of its DCV TXT records as part of the validation workflow. Review the validation state and any required workflow action in CertCentral rather than attempting to edit those records directly in UltraDNS.
If validation is failing or a system-managed record appears stuck, contact Support to confirm the appropriate recovery action. Do not assume that restarting validation will remove or replace a particular record.
If the Record Was Created Manually
Manually created _dnsauth records are separate from records managed by the integration. The automation does not delete user-generated records, and such records can block automated validation.
Before removing a manually created record, confirm which validation workflow uses it and whether it is blocking the intended automation. If removal is confirmed as the corrective action, remove only the identified user-generated record. If its purpose or ownership is unclear, contact Support.
When to Contact Support
Contact Support when a system-managed record is not updating or being removed as expected, validation is failing in CertCentral, or record ownership cannot be established from the available information.
Provide the UltraDNS account name and ID, relevant CertCentral account and subaccount IDs, domain and validation hostname, TXT value, exact error, timestamps with time zone, relevant audit entries, and the current CertCentral validation status. Include certificate order IDs when applicable. Do not include API secrets or private keys.
Expected Outcome
The integration manages the lifecycle of its system-managed validation records. Manual deletion in UltraDNS is not permitted for those records. Confirm successful domain validation in CertCentral separately; a record's creation or removal alone does not establish the validation result.