Companies Using SwissSign

I run the crawler that reads the DNS of every domain we visit. A domain counts here when a TXT record contains SwissSign, in practice swisssign-check= followed by a random value. Our October 2026 crawl puts that at 10,230 domains, 8,781 matched to a company, 3rd in SSL/TLS Certificates. On 15 October 2026 I re-read the DNS of all 10,240 domains in our clean set and opened a TLS connection to a random 1,000 of them.

What the record proves

SwissSign described the method in a 2018 notice, when CA/Browser Forum rules moved domain validation to technical checks: a random value from SwissSign goes into a file on the web server or into a TXT entry of the domain's DNS zone. The Baseline Requirements keep the value valid for 30 days and cap reuse of a validation at 200 days. 10,115 of the 10,240 domains still carried the record and 2,308 had two or more. Repeated codes are what renewals leave behind: each revalidation adds a new value, and the old one usually stays in the zone, sometimes for years. Eight carry SwissSign's newer persistent format, which its blog says has been available since 17 August 2026.

The rule is a substring, so I checked what else it matches. Nine domains matched without a swisssign-check record, and every one was SwissSign-related: its own mail settings, malformed records, and notes such as 100%SwissSign@Schwarz on three Kaufland domains. Nothing unrelated.

Sales signal: a domain with several codes has validated with SwissSign repeatedly, which points to a Managed PKI account.

How much of it is current

Of the random 1,000, 981 answered. 77 (7.85%) served a SwissSign certificate, 42 OV, 22 DV and 13 EV. Let's Encrypt served 613 (62.49%), Sectigo 80, DigiCert 63 and Google 53. A random 50 gave 5 SwissSign certificates. For a CA with 10,230 domains in our table, that's a small live footprint, and the record count needs reading accordingly.

"Six in ten domains that once validated with SwissSign now serve Let's Encrypt on their website. Some of those accounts are still alive for e-mail, but few for the website." - David Thomson, CTO at TechnologyChecker.io

Sales signal: on the website, SwissSign is mostly a former supplier, so ask each account about e-mail certificates before assuming it has left.

E-mail certificates

SwissSign validates domains for S/MIME too. Its Managed PKI order form lists DV and OV SSL certificates next to S/MIME e-mail IDs, priced in francs per year with a CHF 300 minimum. 824 domains, 8.05%, send mail through SEPPmail's cloud, an e-mail encryption service whose documentation tells administrators to renew the SwissSign domain check with a TXT record. Of the 79 SEPPmail domains in my sample that answered, one served a SwissSign website certificate. Among the 7,027 QuoVadis domains, the same SEPPmail signal is on 27.

Sales signal: for SEPPmail users, the SwissSign relationship is e-mail encryption. Sell website certificates to them as a separate need.

Who and where

Germany has 4,321 matched companies, Switzerland 3,070, Austria 498 and Liechtenstein 164: 94.7% of our country table. 76.83% have 200 or fewer staff and 25.18% were founded before 1960. The live certificates name Swisscom, Coop, SIX Group and the German state of Hesse more than once, and among the 50 largest companies 10 served SwissSign: Swisscom, SBB, Coop, SWISS, Zürcher Kantonalbank, Baloise, Evonik, the cantons of Geneva and Vaud, and Sandvik Coromant.

By country the live rate barely differs: 24 of 274 answering .ch domains and 23 of 383 .de domains served SwissSign, while Let's Encrypt served 203 and 237. The difference is at the top. Among the 50 largest companies, eight of the ten still on SwissSign are Swiss, and the German ones mostly serve DigiCert, Sectigo or Let's Encrypt.

Sales signal: large Swiss institutions are SwissSign's remaining website core. Elsewhere the record marks a past or e-mail-only relationship.

Portfolios

Group domain sets are small next to the count. Lidl has 40 lidl.* domains, the next two groups 33 and 32, and Douglas and one other group 22 each. One validation code covers 21 domains, Douglas's Central and Eastern European shops among them, the only sizeable shared code: 42 codes are shared at all, across 107 domains. Two groups even left notes in DNS: 100%SwissSign@Schwarz on three Kaufland domains, and 100percentSwissSignAtRBS on three banking domains, rbs-services.com, coutts.com and adambank.com.

Sales signal: treat each group as one account; Lidl's 40 domains are one buyer.

No switching to report

We publish no migration table. 232 domains dropped the record since 16 March 2026, and 22 of the dropped domains in a recount still carry it on another hostname. Records accumulate instead: 414 SwissSign domains also carry a QuoVadis record, 404 GlobalSign, 88 TeleSec and 44 D-Trust.

"In Switzerland, QuoVadis and SwissSign records sit side by side on 414 domains. The website certificate settles which one is still being paid." - David Thomson, CTO at TechnologyChecker.io

Sales signal: dual records mean a buyer who has run a tender before. Expect a comparison, not a default renewal.

The stack around it

Across the 10,240 domains, WordPress runs on 31.75%, TYPO3 on 14.6%, Matomo on 13.05%, Google Analytics on 28.49% and Usercentrics on 8.84%. Swiss hosting shows through Hostpoint (3.91%).

The consent layer is telling: Usercentrics and Borlabs Cookie together reach 15.21%, while OneTrust is on 4.2%.

Sales signal: privacy-first German-language buyers. Swiss data residency is SwissSign's pitch, and competitors need an answer to it.

Key takeaways

1. 10,230 domains validated with SwissSign; 7.85% of a random sample serve its website certificate.

2. Let's Encrypt serves 62.49% of the same sample.

3. 824 domains use SEPPmail, where the validation is for e-mail certificates.

4. 94.7% of matched companies are in Germany, Switzerland, Austria or Liechtenstein.

5. SwissSign is owned by Swiss Post and says more than 10,000 organisations trust it.

How to use this list

Split website and e-mail use before you prospect: check the live certificate and the mail setup. Our certificate authority market share report covers the issuance side. The full list of 10,230 domains, with 8,781 matched companies, is on TechnologyChecker.io.