[GH-ISSUE #391] Confusing output of the script during validation #222

New issue

Open

opened 2026-03-13 16:11:27 +03:00 by kerem · 0 comments

kerem commented

2026-03-13 16:11:27 +03:00

Owner

Originally created by @Linuxmaker on GitHub (Aug 12, 2025).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/391

The "acme-dns" script is installed on a Debian Bookworm along with Certbot 2.1.0 via APT. This command

~# certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.example.com -d example.com

returns this confusing message:

"Please add the following CNAME record to your main DNS zone:
_acme-challenge.example.com CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io."

If this line is entered exactly as it is in the corresponding zone file, DNS BIND will fail. The DNS server will think _acme-challenge.example.com.example.com is the correct resolution. But that's wrong.
My suggestion would be that the output when requesting to add the entry to the zone file should either include a trailing period

_acme-challenge.example.com. CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io.
or output this entry without a period:

_acme-challenge CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io.

Anyone who doesn't know how DNS servers work will fail at this point. It may be that this entry works for Internet service providers. In that case, this difference should be published in the instruction.

Best regards
Andreas Günther

Originally created by @Linuxmaker on GitHub (Aug 12, 2025). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/391 The "acme-dns" script is installed on a Debian Bookworm along with Certbot 2.1.0 via APT. This command `~# certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py --preferred-challenges dns --debug-challenges -d \*.example.com -d example.com` returns this confusing message: ``` "Please add the following CNAME record to your main DNS zone: _acme-challenge.example.com CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io." ``` If this line is entered exactly as it is in the corresponding zone file, DNS BIND will fail. The DNS server will think **_acme-challenge.example.com.example.com** is the correct resolution. But that's wrong. My suggestion would be that the output when requesting to add the entry to the zone file should either **include a trailing period** `_acme-challenge.example.com. CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io.` or output this entry **without a period**: `_acme-challenge CNAME 47eddf55-38fa-4d22-b85a-872b2375c9bb.auth.acme-dns.io.` Anyone who doesn't know how DNS servers work will fail at this point. It may be that this entry works for Internet service providers. In that case, this difference should be published in the instruction. Best regards Andreas Günther