Our DNS provider has no API. What now?

Delegate only the _acme-challenge records by CNAME to a separate zone at a provider with an API; the main zone stays where it is.

How long does propagation take?

Seconds to minutes depending on the provider. Since the authority queries the authoritative servers directly there is no need to wait for TTLs, but it should still be checked.

Is http-01 not easier?

For a single public server, yes. Wildcards, internal systems and central management need dns-01.

Guide

dns-01 validation: DNS APIs for wildcards and internal names

In enterprise environments a large share of certificates sit on systems that are not reachable from outside, or are wildcards. For both, dns-01 is the only way, which makes the DNS provider part of the certificate process.

6 September 2026 · 6 min read

How it works

Authorization01
The authority issues a token for the domain.
TXT record02
The client writes a digest of the token as a TXT record under _acme-challenge.domain, through the DNS provider's API.
Propagation03
The record must appear on the authoritative name servers the authority will query.
Query04
The authority verifies the record; the certificate is issued.
Cleanup05
The TXT record is removed.

Why it is needed

Wildcards: *.company.com can only be obtained with dns-01.
Internal systems: http-01 cannot work for a server that is not reachable from outside; dns-01 works as long as the name exists in public DNS.
One central place: Because validation happens in DNS rather than on the server, certificates for hundreds of systems can be obtained from one central system.

Split-horizon DNS and delegation

Internal names are usually defined in internal DNS, while the authority queries public DNS only. The solution is to delegate the _acme-challenge records to a separate, manageable zone.

In the public zone, a CNAME is created for _acme-challenge.app.company.com pointing to a separate zone used only for validation.
The client writes the TXT record into that separate zone; the API key of the main zone is never given to the client.
Internal names can exist in public DNS without exposing IP addresses; only the validation record is visible.

API permissions and security

Give the provider key the narrowest scope: only the relevant zone, only TXT records. Cloudflare, Route 53, Azure DNS and Google Cloud DNS support restricting the key to a single zone.
Keep the key in a vault; never in logs or configuration files as plain text.
Check propagation by querying the authoritative name servers directly, the ones the authority will see; do not rely on the internal resolver.
Remove TXT records after validation; leftovers clutter the zone.

Frequently asked questions

Our DNS provider has no API. What now?: Delegate only the _acme-challenge records by CNAME to a separate zone at a provider with an API; the main zone stays where it is.
How long does propagation take?: Seconds to minutes depending on the provider. Since the authority queries the authoritative servers directly there is no need to wait for TTLs, but it should still be checked.
Is http-01 not easier?: For a single public server, yes. Wildcards, internal systems and central management need dns-01.

Sources

Manage your certificates in one place

Inventory, expiry tracking, renewal through ACME and verified installation, on your own infrastructure.

Request a demo