Amazon Web Services has laid out a multi-year timeline to eliminate one of the oldest and weakest methods of proving domain ownership for public TLS certificates: email-based validation. The phaseout, managed through AWS Certificate Manager (ACM), follows an industry-wide decision by the Certificate Authority and Browser (CA/B) Forum in November 2025 to retire the method entirely across the web’s public certificate ecosystem.

Why Email Validation Is Being Retired

Email validation works by sending a confirmation link to an address associated with a domain — historically an administrative contact pulled from WHOIS records or a small set of standard addresses like admin@ or webmaster@. It has long been considered the weakest of the standard domain-validation methods, and for good reason. The security community has flagged it as “brittle and vulnerable” on several fronts: mail exchange (MX) routing can be silently compromised or redirected, verification links can be intercepted in transit, and WHOIS administrative contact records frequently go stale, pointing to addresses nobody actually monitors anymore. Any of those failure points can let an attacker fraudulently prove control of a domain they don’t own — and walk away with a validly issued certificate for it.

DNS-based validation, by contrast, requires proving control over the domain’s actual DNS records — a far harder target to spoof or intercept, and the method AWS is steering customers toward as the replacement.

The Timeline

AWS has broken the transition into four stages, giving customers a long runway to migrate:

• January 1, 2027 — email validation becomes unavailable in any newly launched AWS Region.
• March 31, 2027 — email validation is prohibited for all new certificate requests, across every existing AWS Region.
• September 30, 2027 — automated renewals in ACM that rely on email validation stop working entirely.
• March 15, 2028 — the CA/B Forum’s global deadline, after which major browsers will stop trusting any certificate that was validated via email, regardless of which certificate authority issued it.

That last date is the one that matters industry-wide: it’s not an AWS-specific cutoff but a browser-enforced deadline that will affect certificates from any CA still relying on the method.

What AWS Customers Need to Do

The good news for ACM users is that the migration path is designed to be low-friction. AWS says the switch can be made using the UpdateCertificateOptions API call to change a certificate’s validation method from email to DNS — without needing to reissue the certificate, reconfigure load balancers, or update any certificate ARNs referenced elsewhere in an environment.

Practical steps for teams still relying on email validation include:

• Inventory all ACM certificates currently using email-based validation before the January 2027 cutoff for new Regions.
• Switch validation methods via UpdateCertificateOptions well ahead of the March 2027 deadline for new requests.
• Allow for the roughly 72-hour DNS propagation window AWS specifies when a validation CNAME record is added.
• Route 53 users can take advantage of one-click CNAME record insertion directly from the ACM console, simplifying the switch considerably.
• For CloudFront-fronted deployments, AWS notes that HTTP-based token validation is available as an alternative to DNS validation.

The Bigger Trend

This change is part of a broader, industry-wide tightening of certificate issuance standards driven by the CA/B Forum, the group that sets the baseline requirements certificate authorities and browser vendors agree to follow. Weak or legacy validation methods have been a recurring target of these reforms, precisely because they represent the easiest point for an attacker to fraudulently obtain a trusted certificate. Organizations relying on other cloud providers or third-party certificate authorities should expect similar phaseouts on comparable timelines, and would be well served auditing their own certificate issuance pipelines now rather than waiting for the 2028 browser-enforced deadline to force the issue.