The dns-01 challenge is in staging and is ready for your client tests. The dns-01 challenge is an implementation of a DNS-only domain validation from the ACME spec. If you’ve ever added some bits to a domain’s DNS records for another CA’s domain validation, it works similarly. We had a previously b…

The DNS challenge test is working for ACMESharp client lib as well now. The verification was happening a little too quick after the challenge submission, so I needed to introduce a slight artificial delay during the testing routines as well, but otherwise, works great. Thanks!

Actually one peculiar thing I’ve found – ACMESharp currently supports handling dns-01 and http-01 challenge types. If I test Identifier validation with either DNS or HTTP challenge, the test is fine, but if I test with both challenge types against the same Identifier – whichever one I try to submit…

just a question: what will be put in the DNS? some random stuff or the account key? also does it affect subdomains? it would be great if I could just post my acc key to the root and tell them that this account is allowed to do LE certs for this domain and subs.

@mjphaynes , since this is not in the official client yet…what client are you using to test, and how are you specifying that its a DNS challenge to the staging server?

Hello @ezeeetm , I don’t know what client is using @mjphaynes but seems that letsencrypt.sh client implements dns challenge, just in case you would like to test it. Cheers, sahsanu

Using letsencrypt.sh and a small hook script I was able to use dns-01 without issue. One question I have is what DNS sever is let’s encrypt hitting to get the TXT record? I’d like to verify the record shows up on that server before proceeding with the challenge. In testing I had to update the TXT r…

Let’s Encrypt does authoritative lookups (i.e. starting from root servers). You can simulate that with dig example.com +trace. Maximum TTL is limited to a few minutes on their end.

@jmhodges and others in this thread who have working dns-01 tools: For those of us who want to write a simple dns-01 client (or modify an existing acme client) to use dns-01 challenges, where can we see documentation about what the boulder API specifically for dns-01 challenges? Based on how the …

Boulder is a server implementation of the ACME spec , which should describe what you’re looking for.

DNS challenge is in staging

Feature Requests

shred January 11, 2016, 10:37am 18

Tested and works with acme4j.

Topic		Replies	Views
DNS challenge failing: NXDOMAIN looking up TXT Issuance Tech	25	42892	August 15, 2016
Shouldn't verification via DNS record be a priority? Issuance Tech	61	40951	February 16, 2016
Letsencrypt doesn't verify dns-01 and leaves challenge in status: pending state Issuance Tech	16	6335	May 16, 2019
Error when requesting LE to validate DNS challenge Client dev	33	1990	November 2, 2020
[Suggestion] Let's Encrypt operated, TXT-only DNS Hosting for DNS challenges Feature Requests	18	8854	January 15, 2018

DNS challenge is in staging

Related topics