# Dns challenge OK even when I havnt got a txt record **URL:** \ **Category:** Help\ **Created:** [February 5, 2022, 7:04pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412 "2022-02-05T19:04:24Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 7:04pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/1 "2022-02-05T19:04:24Z")
Hi all, When testing dns challenge with let's encrypt using this website [https://letsdebug.net/](https://letsdebug.net/) It says my domain name is OK even tho my ddns provider let's encrypt I havnt got an txt record or an api for my acme client on my opnsense firewall Why is this please Thanks, Rob ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 7:08pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/2 "2022-02-05T19:08:39Z")
It just checks some conditions and common errors which might impede the `dns-01` challenge. It won't actually _perform_ one, as that would be impossible. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 7:35pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/3 "2022-02-05T19:35:03Z")
Thanks So I'm guessing I need to change to another ddns provider as I don't see noip on this list for it to challenge dns for the acme client > [@DNS providers who easily integrate with Let's Encrypt DNS validation](https://community.letsencrypt.org/t/dns-providers-who-easily-integrate-with-lets-encrypt-dns-validation/86438): > > Iโ€ฆ ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 8:08pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/4 "2022-02-05T20:08:46Z")
> [@robertkwild](#): > > So I'm guessing I need to change to another ddns provider as I don't see noip on this list for it to challenge dns for the acme client I don't know if noip lets you do that, but if possible you might be able to use a CNAME to redirect the challenge to a different DNS server, e.g. one you control. Using acme-dns comes to mind ๐Ÿ™‚ ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 8:17pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/5 "2022-02-05T20:17:49Z")
Mmm, so I can't use a free service like this for example, so I have my DDNS and acme client ie dns challenge all using the same provider > **[Dynu](https://www.dynu.com/)** > > Dynu Systems, Inc. provides free dynamic DNS service as well as other services such as domain registration, email and SSL services. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 8:20pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/6 "2022-02-05T20:20:58Z")
If you prefer to switch, that's of course your prerogative. I just gave you a (maybe) possible alternative ๐Ÿ™‚ Switching probably would be easier. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 8:38pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/7 "2022-02-05T20:38:51Z")
thanks @Osiris i just need to check what one to get for opnsense, ie what provider supports both DDNS and the acme client do you know of any? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 8:45pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/8 "2022-02-05T20:45:23Z")
I'm not a fan of it (poorly documented, not very sensible setup if you ask me and it defaults to ZeroSSL [and is bought by it], a different, commercial [but free using the ACME protocol] CA, although it can be configured to use Let's Encrypt), but the client called "acme.sh" has _a lot_ of DNS implementations. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 8:48pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/9 "2022-02-05T20:48:14Z")
so the acme.sh can do both for me ie DDNS and acme client, i suppose i install it on my opnsense firewall? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 8:52pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/10 "2022-02-05T20:52:13Z")
I don't know what the capabilities of "opnsense" are, but "acme.sh" is an ACME client written entirely in Bash with just a few dependencies (I think OpenSSL, stuff like that) and has a ton of DNS API scripts available. You can check the latter out here: [https://github.com/acmesh-official/acme.sh/tree/master/dnsapi](https://github.com/acmesh-official/acme.sh/tree/master/dnsapi) You might also find other dynamic DNS providers among the list. Don't ask me which one is better tho ๐Ÿ™„ ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 9:00pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/11 "2022-02-05T21:00:05Z")
ive got this on my opnsense FW, its a package/plugin that you install > > > \# Introduction > Sponsored by: \[markt.de\](http://www.markt.de/) > > This is the fiโ€ฆrst version of our acme plugin. It utilizes \[acme.sh\](https://github.com/Neilpang/acme.sh) and supports 14 DNS providers. Besides that, there's our integrated HTTP-01 validation which should makes it very easy to validate certificates (provided that the official IP address of the certificate hostname points to the OPNsense box). > > This is the \_initial\_ relase and is expected to contain bugs. Support for many DNS-01 providers is largely untested. Please don't use it in production just yet. :) > > \# Remarks > Initially I wanted to integrate \[acme-client\](https://github.com/kristapsdz/acme-client), but this would have meant additional efforts to integrate DNS-01 providers. That's why I decided to switch to acme.sh. > > Support for HTTP-01 validation is currently limited to the internal OPNsense provider. I plan to add support for more providers in the coming weeks. > > This version lacks support for deploy/restart actions. Thus it can't automatically restart a service if a certificate was renewed. This will be addressed in a future release very soon. > > > \# Quick start guide > > \### 1. Enable Let's Encrypt Plugin > > !\[001\](https://cloud.githubusercontent.com/assets/909706/22356317/b213379c-e430-11e6-84fc-2a5ccfb89686.png) > > \### 2. Add an account > > !\[002\](https://cloud.githubusercontent.com/assets/909706/22356326/c7ee82ce-e430-11e6-8e52-11e096c985b2.png) > > \### 3. Add a validation method > > \#### 3a. Example: HTTP-01 OPNsense port-forward magic > > !\[003\](https://cloud.githubusercontent.com/assets/909706/22356340/e3e27f4e-e430-11e6-8bc9-bd5e25258072.png) > > > \#### 3b. Example: DNS-01 nslookup > > !\[004a\](https://cloud.githubusercontent.com/assets/909706/22356364/024d49be-e431-11e6-88e1-d39f4b092db9.png) > !\[004b\](https://cloud.githubusercontent.com/assets/909706/22356367/0492cd84-e431-11e6-878c-5b52c8b8de19.png) > > \### 4. Configure certificate > > !\[005\](https://cloud.githubusercontent.com/assets/909706/22356370/160781fe-e431-11e6-8b40-00517bddecb8.png) > > \### 5. Issue certificate > > \#### 5a. Issue/Renew ALL certificates > > !\[006a\](https://cloud.githubusercontent.com/assets/909706/22356378/2ed77568-e431-11e6-95b1-e90f323b10b5.png) > > \#### 5b. Issue/Renew a specific certificate > > !\[006b\](https://cloud.githubusercontent.com/assets/909706/22356385/3d8886b0-e431-11e6-9c44-f3971eb3b548.png) just trying to figure out aswell as having a DDNS provider (which i do noip) whether i can have one provider that does both acme client and ddns or whether i can just have the acme client and that also does the DDNS for me sorry if that doesnt make sense ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 9:42pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/12 "2022-02-05T21:42:56Z")
> [@robertkwild](#): > > sorry if that doesnt make sense It actually indeed doesn't make much sense to me. It seems you're thinking a DDNS provider can also do some "ACME" stuff _or_ the other way around and have an ACME client do some "DDNS" stuff. While in reality, it's not one thing doing _both_ but always two things doing two separate things. It seems the PR you're quoting added `acme.sh` to opnsense, so it might be that any DDNS provider supported by acme.sh is also supported by opnsense. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 10:04pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/13 "2022-02-05T22:04:13Z")
OK il look for a provider that does both DDNS and ACME challenge ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 10:07pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/14 "2022-02-05T22:07:33Z")
I don't understand. What do you mean by "a provider that does [...] ACME challenge"? ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 10:17pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/15 "2022-02-05T22:17:36Z")
I don't know the correct terminolgy then Dns challenge ACME support ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 10:22pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/16 "2022-02-05T22:22:45Z")
The only thing a DDNS provider can do, is provide a well documented API. The rest all comes down to the ACME client. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 10:25pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/17 "2022-02-05T22:25:58Z")
Yeah so I need a DDNS provider that supports an api aswell that can talk to the acme client? ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [February 5, 2022, 10:27pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/18 "2022-02-05T22:27:56Z")
> [@robertkwild](#): > > so I need a DDNS provider that supports an api Yup. > [@robertkwild](#): > > aswell that can talk to the acme client No, the other way around: the ACME client will talk to the DNS providers API. ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 10:32pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/19 "2022-02-05T22:32:25Z")
Great perfect, so I just need to find a DDNS provider that provides api support to talk to the ACME client on my opnsense firewall ---
**Author:** ![robertkwild](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/robertkwild/32/38532_2.png) [@robertkwild](https://community.letsencrypt.org/u/robertkwild)\ **Post date:** [February 5, 2022, 10:37pm UTC](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412/20 "2022-02-05T22:37:47Z")
Sorry the client talks to the dns api [Next page](https://community.letsencrypt.org/t/dns-challenge-ok-even-when-i-havnt-got-a-txt-record/171412.md?page=2)