Companies Using TeleSec

I run the crawler that reads DNS for every domain we visit. A domain counts here when a TXT record contains TeleSec, which in practice is _telesec-domain-validation= followed by a code. Our October 2026 crawl puts that at 1,225 domains, 908 matched to a company, 13th in SSL/TLS Certificates. On 15 October 2026 I re-read the DNS of all 1,223 domains in our clean set and opened a TLS connection to each one.

What the record proves

Telekom Security's Server.ID practice statement describes the DNS method: a unique random value, valid for at most 30 days, inserted into the DNS of the domain, after which certificates can also cover its subdomains and wildcards. The Baseline Requirements now cap reuse of a validation at 200 days. 1,192 of the 1,223 domains still carried the record and 280 had two or more.

Because the rule is a substring, I checked what else it matches. Ten domains matched without a TeleSec record, 0.82%: six French télésecrétariat (remote secretarial) sites, a Mexican telesecundaria school portal, a hotel-booking domain whose name contains the string, and two mail records that mention Telekom hosts. Small enough to leave in, and worth knowing.

Sales signal: a TeleSec code marks an organisation that bought a validated certificate from Deutsche Telekom at least once.

The dates in the codes

Many TeleSec codes carry an order number and a date. 903 domains have a dated code; the newest is from 2026 on 425 of them, 2025 on 158 and 2024 on 96, with older ones back to 2019. That date predicts the live certificate. Of the domains whose newest code is from the 12 months before 15 October 2026, 240 of 482 answering serve Telekom Security; of those with only older codes, 32 of 413 do.

"A TeleSec code from this year means a TeleSec certificate on the site about half the time. A code from 2022 almost never does." - David Thomson, CTO at TechnologyChecker.io

Sales signal: filter on the code date: about half of recent codes belong to live accounts, and old ones mostly to former customers.

How much of it is current

1,212 domains answered. 300 (24.75%) served a Telekom Security certificate, most from its ServerID OV Class 2 CA (143) and the newer OV RSA CA 26A (106), with 13 from DV CAs. Let's Encrypt served 493 (40.68%), DigiCert 109, Sectigo 105 and Google 50. A random 50 gave 11 TeleSec certificates. The organisations named on the live certificates are telling: the federal economy ministry (27 domains), the research ministry, BMBF until May 2025 (25), the federal pension insurer (14), Signal Iduna (7) and the Rhineland's municipal IT association (7).

Sales signal: TeleSec's live base is the federal government, pension and social insurers, and public IT providers. That market buys through framework contracts.

Portfolios

Two groups stand out. TRUMPF has 15 domains with the record, from trumpf.com and trumpf.cn to its laser, power-tool and banking domains, though trumpf.com now serves a DigiCert certificate. Deutsche Telekom's own companies carry it on about 30 domains, including t-systems.com, open-telekom-cloud.com, telekom.hu, t-mobile.at, t-mobile.cz, t-mobile.pl and telekom.mk. Codes are rarely shared: 30 codes cover 72 domains, the largest SNIPES's country shops together with buffalo-boots.com and onygo.com.

"Deutsche Telekom validates its own domains with its own CA. No surprise there, but it means 30 domains in the count are the vendor itself." - David Thomson, CTO at TechnologyChecker.io

Sales signal: count organisations. TRUMPF's 15 domains are one account, and Telekom's 30 are the vendor itself.

Universities moved on

25 domains in the set, nearly all German universities and research institutes, from TU Dortmund and the University of Bremen to research institutes and a university computing centre, now serve certificates from HARICA, the Greek academic CA, while keeping their TeleSec records. Of the 17 university and college domains I could identify in the set, 16 served HARICA and one Let's Encrypt; none served a Telekom Security certificate. The records stay because nobody cleans DNS after a CA change, which is the same pattern I found on every page in this batch.

Sales signal: German universities left TeleSec for HARICA on their websites, so remove them before you prospect.

Who and where

Germany has 773 of the 878 matched companies. Utilities (9.89%) and Government Administration (9.27%) lead the industries, 18.6% of matched companies have more than 1,000 staff and 29.32% were founded before 1960. The stack fits: TYPO3 on 18.56%, Matomo on 17.74%, etracker on 9.32%.

Sales signal: utilities are the largest commercial segment. Stadtwerke München served a TeleSec certificate on the day, so a utility-sector reference is easy to find.

No switching to report

We publish no migration table. 49 domains dropped the record since 18 March 2026, one still showing it on another hostname. Records overlap instead: 88 TeleSec domains carry QuoVadis records too, 86 SwissSign, 60 D-Trust and 47 GlobalSign.

Sales signal: dual records mean tender buyers. Expect TeleSec to be one of several CAs on the shortlist.

What the certificates are

The live certificates are almost all organisation-validated: 287 of the 300 came from OV issuing CAs, the older ServerID OV Class 2 CA, the 2024 and 2026 OV RSA and ECC CAs, and TeleSec Business TLS-CA 2022, and 13 from DV CAs. I saw no EV issuing CA in the sample. That fits the buyers named on the certificates, ministries, insurers and utilities that want their organisation name in the certificate rather than the cheapest option.

Sales signal: pitch OV automation and lifecycle management; these buyers aren't shopping on DV price.

What it costs

Telekom Security's online shop lists Magenta Security Server.ID OV (Standard) at €105 per 198-day certificate, DV (Standard) at €47.60 and an OV wildcard at €370.29, with ACME subscriptions from €10.55 a month per OV certificate, all excluding VAT (read 28 October 2026). The shop lists no EV certificate.

Sales signal: list prices are modest, so the revenue sits in managed volumes for public bodies.

Key takeaways

1. 1,225 domains validated with TeleSec; 24.75% of answering domains serve its certificate.

2. Code dates predict use: 240 of 482 recent-code domains serve TeleSec, against 32 of 413 older ones.

3. Federal ministries, pension insurers and utilities are the live core.

4. Universities have moved to HARICA.

5. TRUMPF (15) and Deutsche Telekom (about 30) are the portfolios.

How to use this list

Filter on the code date, then drop universities and Telekom's own domains. Our certificate authority market share report covers the issuance side. The full list of 1,225 domains, with 908 matched companies, is on TechnologyChecker.io.