ACM DNS Validation Stuck in PENDING_VALIDATION: CNAME Record and Renewal Risk

What Exactly Stops the Validation?

ACM stays in PENDING_VALIDATION until the exact CNAME name and value that it displays are resolvable from the authoritative public DNS zone for the domain. The boundary is therefore:

• The CNAME exists but is in a non‑authoritative zone (e.g., a private Route 53 zone or a test zone in a different account).
• The record is present in the authoritative zone but the name or value differs by even a single character (trailing dot, case, missing sub‑label).
• The zone that contains the record is no longer the one delegated at the parent level (NS records point elsewhere).
• A CAA record blocks the ACM validation domain.
• The certificate was requested in a region that does not match where the validation is performed (e.g., CloudFront requires us‑east‑1).

Confirming the Cause

1. Get the exact validation details from ACM. In the ACM console or CLI, view the certificate’s DomainValidationOptions to copy the ResourceRecord.Name and ResourceRecord.Value.
2. Query the authoritative nameservers directly. Replace example.com with your domain:

   dig +norecurse +noall +answer TXT  @ns-123.awsdns-45.com
   

   Check that the response contains the value exactly as listed by ACM. A missing response or a different value indicates a propagation or configuration issue.
3. Verify delegation. Use dig example.com NS to confirm the NS records at the parent zone point to the zone that holds the validation record.
4. Check CAA records. Run dig example.com CAA. If a CAA record allows only a different CA, ACM will never validate.
5. Confirm the certificate region. If you’re using CloudFront or an S3 static site, the certificate must be in us‑east‑1. A mismatch will keep the status stuck.
6. Ensure persistence. After issuance, the validation CNAME must remain in the zone. If the DNS provider changes or the record is deleted, future renewals will fail even though the current certificate is still valid.

Distinguishing Propagation vs. Permanent Error

• If the authoritative lookup shows the record with the correct value, the issue is not propagation—check the CAA, region, or delegation.
• If the record is absent from the authoritative zone, it is either missing, mistyped, or in the wrong zone. Correct the record and wait a few minutes for propagation.
• Use dig +trace to see the entire resolution path; any step that fails indicates a delegation problem.

What to Do If Renewal Might Fail

Once the certificate is issued, ACM will query the same CNAME during renewal. If you plan to migrate DNS or delete the record, copy the CNAME value to a temporary record that will survive the change, or request a new certificate after migration.

Missing Diagnostic Detail

Do you know which AWS region the certificate was requested in? If the region does not match the service that will use the certificate, ACM will never complete validation.