ACM DNS Validation Stuck in PENDING_VALIDATION: CNAME Record and Renewal Risk

ACM DNS Validation Stuck in PENDING_VALIDATION

An AWS Certificate Manager certificate requested with DNS validation remains in PENDING_VALIDATION until the exact CNAME name and value returned by ACM are present and resolvable in the authoritative public DNS zone. When the public hosted zone is managed by Amazon Route 53 in the same AWS account, ACM can create the validation record automatically; with external DNS providers, the record must be added manually. PENDING_VALIDATION itself is not an error, but a character-for-character mismatch between the ACM requirement and the live DNS record prevents issuance.

A separate uncertainty affects managed renewal. The validation CNAME must remain in DNS after issuance because ACM relies on it for automatic renewal; deleting the record can cause later renewals to fail even while the deployed certificate is still valid. Delegating the domain to a new DNS provider after issuance will also break renewal unless the validation CNAME is migrated. Private Route 53 hosted zones cannot be used for public certificate validation, and ACM Private CA uses a separate validation path.

Given these constraints, what is the precise failure boundary when the CNAME appears correct but validation does not proceed? How should operators confirm whether a stalled renewal is caused by a missing, migrated, or mistyped validation record? What diagnostic sequence distinguishes a transient DNS propagation delay from a permanent configuration error?