# Subdomains or SAN additions and DNS validation **URL:** \ **Category:** Help\ **Created:** [May 26, 2022, 2:33pm UTC](https://community.letsencrypt.org/t/subdomains-or-san-additions-and-dns-validation/178388 "2022-05-26T14:33:47Z")\ **Posts on this page:** 1\ **Showing post:** 4
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [May 26, 2022, 3:24pm UTC](https://community.letsencrypt.org/t/subdomains-or-san-additions-and-dns-validation/178388/4 "2022-05-26T15:24:19Z")
So is the problem that Bind doesn't let you have a credential for updating just the `_acme-challenge` records and requires a credential for updating anything in a zone? If so, and if your security policy (reasonably) doesn't want credentials that can update _anything_ on all your servers, then I think the usual approach would be to create just one separate zone that the credentials can modify, and have all the `_acme-challenge` records that you need be a CNAME into a corresponding record within that zone. I don't think certbot handles that kind of scenario, but some other clients do. (I happen to know [acme.sh does](https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mode), for instance, but I don't think it's the only one.) However, I could have sworn I've seen people here that used bind and had set up credentials that only gave access to the needed TXT records, without needing to set up other zones and delegations and such. Maybe I'm mixing it up with something else, though. Hopefully, someone else here has some experience with Bind/RFC2136 setups for you. You might also want to take a look at software like [acme-dns](https://github.com/joohoi/acme-dns) or [agnos](https://community.letsencrypt.org/t/release-agnos-an-api-less-provider-agnostic-dns-01-client/166770), which you could delegate your DNS records to and are designed for integrating DNS updates, if you can't figure out how to do it through Bind. --- _[View the full topic](https://community.letsencrypt.org/t/subdomains-or-san-additions-and-dns-validation/178388)._