Companies Using D-Trust

I run the crawler that reads DNS for every domain we visit. A domain counts here when a TXT record contains D-Trust, which in practice is a record of the form D-TRUST= followed by a 23-character code. Our October 2026 crawl puts that at 1,927 domains, 1,652 matched to a company, 7th in SSL/TLS Certificates. On 15 October 2026 I re-read the DNS of all 1,971 domains in our clean set and opened a TLS connection to each.

What the record proves

D-Trust's CSM PKI practice statement records that in 2019 it added the CA/Browser Forum's DNS method, among others, to its domain validation. Under the Baseline Requirements, the random value is valid for 30 days and a validation can be reused for at most 200 days. Owners keep the records long after: nearly all of the 1,971 domains still had one, and 612 had two or more.

The rule is a plain substring, so I checked what else it catches. Five domains matched without a D-TRUST= record: D-Trust's own d-trust.de, through its mail settings, and four unrelated sites whose text happens to contain the string, such as tech-and-trust.com. That's 0.25% of the count.

Sales signal: a D-TRUST= record means the organisation passed a German CA's validation at least once, which in this base usually means OV or EV.

Half the count is one banking group

968 of the 1,971 domains belong to Germany's Volksbanken and Raiffeisenbanken, identified by domain name, LinkedIn match or the bank named on the certificate. They are separate banks, not one subscriber: their certificates carry 549 different organisation names. They share a technology partner, Atruvia, which says on its site that about 650 Volksbanken and Raiffeisenbanken are its customers. That's why banking is 40.59% of the industry chart and 56.19% of matched companies were founded before 1960.

"Half of D-Trust's count is cooperative banks, and most of them now serve a DigiCert certificate. The D-Trust record is what they left behind." - David Thomson, CTO at TechnologyChecker.io

Sales signal: treat the banks as one buying centre with many logos. Certificate decisions here follow the group's platform, not each bank's IT team.

How much of it is current

1,959 domains answered. 638 (32.57%) served a D-Trust certificate, 358 of them EV. DigiCert's QuoVadis CA served 603, Let's Encrypt 386 and Sectigo 89. A random 50 gave 15 D-Trust certificates, close to the full rate. Among the cooperative banks, 398 of 967 answering homepages served D-Trust and 562 served DigiCert's QuoVadis CA; 950 of those bank domains also carry a QuoVadis= validation record. Outside the banks, 240 of 992 answering domains served D-Trust, 24.19%.

Sales signal: D-Trust's banking base is mid-move. The banks still on D-Trust are the ones a competing CA, or D-Trust itself, will fight for at renewal.

The federal cluster

The largest single subscriber outside the banks is the federal IT centre ITZBund: 92 domains serve D-Trust certificates issued to it, from bamf.de and rki.de to bmel.de and zoll.de. Dataport, a public-sector IT provider, holds 15, and the Bundesdruckerei itself 8. D-Trust has been 100% owned by the Bundesdruckerei since 2010, according to its about page, and the public sector buys accordingly.

Sales signal: public-sector certificates are bought through shared IT providers. Talk to ITZBund or Dataport before any single ministry.

Who else and where

Germany has 1,543 of the 1,619 matched companies. Beyond the banks, the list is German utilities and insurers (E.ON, RWE, Bayernwerk, Westnetz, Signal Iduna, Techniker Krankenkasse), testing groups (TÜV SÜD, TÜV Rheinland) and industrials (BASF, thyssenkrupp, Rheinmetall). Their stack is privacy-minded: OneTrust on 17.45%, Usercentrics on 10.5%, Google Analytics on only 9.08%.

Sales signal: lead with data protection and EU qualification; price comes second for this base.

No switching to report

We publish no migration table for D-Trust: 11 domains dropped the record since 16 March 2026, none still showing it on another hostname. The banks' move to QuoVadis didn't remove anything, because records are additive. 44 domains carry SwissSign records too and 59 carry TeleSec records, the CA of Deutsche Telekom.

"Records pile up in DNS. To see a bank change CA, you have to look at the certificate it serves." - David Thomson, CTO at TechnologyChecker.io

Sales signal: watch the issuer on the live certificate; the records only accumulate. A bank serving QuoVadis today with a D-TRUST= record still in DNS has been a D-Trust customer and may be again.

Where the certificates come from

The issuing CAs tell you what was bought. Of the 638 live D-Trust certificates, 358 came from D-TRUST EV CA 2-23-1 2023, the EV intermediate, and the rest from its BR (OV) intermediates, 2023 and 2020 generations. None came from a DV intermediate. On the cooperative banks, all 562 DigiCert certificates came from one intermediate, DigiCert QuoVadis 2G3 TLS RSA4096 SHA384 2023 CA1, which looks like one decision taken for the whole group. TeleSec, Deutsche Telekom's CA, served 19 of the answering domains, the only other German CA with a visible share.

Sales signal: EV is still bought here, by banks and insurers that want the organisation name in the certificate. Price conversations start from EV, not DV.

What it costs

D-Trust's TLS page lists DV, OV, EV, EV Qualified and PSD2 Qualified certificates and sends price questions to sales; there's no web shop. Larger customers run their certificates through its Certificate Service Manager.

Sales signal: quotes, framework contracts and managed PKI are how this market buys.

Key takeaways

1. 1,927 domains validated with D-Trust; 32.57% of those answering serve its certificate.

2. 968 domains, 49.1%, are cooperative banks, 562 of them now on DigiCert's QuoVadis CA.

3. ITZBund's federal sites are the largest single subscriber, with 92 domains.

4. 95.3% of matched companies are German.

5. The substring rule catches five non-D-Trust records, 0.25%.

How to use this list

Split the banks from the rest before you prospect. Our certificate authority market share report shows the issuance side. The full list of 1,927 domains, with 1,652 matched companies, is on TechnologyChecker.io.