1. Delegate a small zone to the machine that will run acme-dns (records in your real DNS):

   1 2	auth.example.com. NS acme.example.com. acme.example.com. A 203.0.113.10

2. acme-dns on that machine (/etc/acme-dns/config.cfg), DNS on 53 and the API on 443:

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

   [general] listen = "0.0.0.0:53" protocol = "both" domain = "auth.example.com" nsname = "acme.example.com" nsadmin = "hostmaster.example.com" records = [ "auth.example.com. A 203.0.113.10", "auth.example.com. NS acme.example.com.", ] [api] ip = "0.0.0.0" port = "443" tls = "letsencrypt" disable_registration = false

3. Register a client and create the CNAME:

   1 2 3

   curl -s -X POST https://acme.example.com/register -H 'Content-Type: application/json' \ -d '{"allowfrom": ["203.0.113.0/24"]}' # {"username":"eabcdb41-…","password":"pbAX…","fulldomain":"d420c923-….auth.example.com","subdomain":"d420c923-…","allowfrom":["203.0.113.0/24"]}

   1	_acme-challenge.example.com. CNAME d420c923-….auth.example.com.

4. certbot with the hook:

   1 2 3 4 5

   curl -fsSL -o /etc/letsencrypt/acme-dns-auth.py https://raw.githubusercontent.com/joohoi/acme-dns-certbot-joohoi/master/acme-dns-auth.py chmod +x /etc/letsencrypt/acme-dns-auth.py sed -i 's|^#!/usr/bin/env python$|#!/usr/bin/env python3|; s|^ACMEDNS_URL = .*|ACMEDNS_URL = "https://acme.example.com"|' /etc/letsencrypt/acme-dns-auth.py certbot certonly --manual --manual-auth-hook /etc/letsencrypt/acme-dns-auth.py \ --preferred-challenges dns --debug-challenges -d '*.example.com' -d example.com

   The first time, the hook registers itself, stores the credentials in /etc/letsencrypt/acmedns.json and pauses so you can create the CNAME it prints; Enter, and it validates. Renewals (certbot renew) never ask again.

Why

DNS-01 is the only challenge that gives wildcards and the only one that works for machines with no public port 80. The usual price is an API token from your DNS provider on every server that requests certificates; that token can typically change any record in the zone, and it sits in plain text under /etc/letsencrypt.

acme-dns turns that around: it is an authoritative DNS server for a zone of its own (auth.example.com) that only serves TXT records under random subdomains, with an API to update them. Since _acme-challenge.example.com is a CNAME to one of those subdomains, Let’s Encrypt follows the chain and validates the TXT there. Each client’s credentials only work for its subdomain; if stolen, the worst case is someone requesting a certificate for that name, not rewriting your zone.

cert-manager

The same scheme, with the credentials in a Secret:

1

kubectl -n cert-manager create secret generic acme-dns --from-file=acmedns.json=./acmedns.json

1
2
3
4
5
6
7
8
9

{
  "example.com": {
    "username": "eabcdb41-d89f-4580-826f-3e62e9755ef2",
    "password": "<password from the registration>",
    "fulldomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf.auth.example.com",
    "subdomain": "d420c923-bbd7-4056-ab64-c3ca54c9b3cf",
    "allowfrom": ["203.0.113.0/24"]
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-dns
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@example.com
    privateKeySecretRef:
      name: letsencrypt-dns-account-key
    solvers:
    - dns01:
        acmeDNS:
          host: https://acme.example.com
          accountSecretRef:
            name: acme-dns
            key: acmedns.json

The JSON key is the certificate’s domain; *.example.com and example.com share the same entry (the _acme-challenge.example.com CNAME covers both). Every distinct domain needs its own registration and CNAME.

Traps

• allowfrom with the IP acme-dns sees: the public egress IP of the server or the cluster, not the pod’s. If /update fails with 401, it is this or the password.
• CNAME TTL: keep it low (60–300 s) the first time; with a one-hour TTL, a mistake in the CNAME takes an hour to correct in Let’s Encrypt’s eyes. The TXT is served by acme-dns with TTL 1.
• A real port 53: acme-dns must be reachable over UDP and TCP from the Internet, and be the NS for auth.example.com in your parent zone. Without the NS record there is no delegation and validation returns NXDOMAIN.
• One registration per domain, not per server: if three servers request certificates for example.com, they share the same registration and the same acmedns.json, or each registers its own and the CNAME can only point to one. Share the credentials.
• --manual renews fine because the hook is stored in /etc/letsencrypt/renewal/<domain>.conf; what you cannot do is change the hook without running certonly again.
• Version: acme-dns 2.0.2 is from February 2025 and the project is still active; the certbot hook has not changed in years and works with Python 3 after fixing the shebang.

References: acme-dns, acme-dns-certbot-joohoi and ACMEDNS in cert-manager.

See also

• cert-manager: the HTTP-01 challenge returns 308 — when HTTP-01 is enough, and when it is not.
• HAProxy on pfSense with ACME and Cloudflare — DNS-01 with the provider’s token, the case acme-dns avoids.
• 2048-bit DKIM in a split TXT — another DNS record that breaks over details.

1
2

PUB=$(openssl rsa -in dkim.key -pubout -outform DER 2>/dev/null | base64 | tr -d '\n')
echo "v=DKIM1; k=rsa; p=$PUB" | fold -w 255 | sed 's/.*/"&"/' | paste -sd' ' -

That prints the value ready to paste into the DNS provider, two quoted strings separated by a space:

1

"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvs7EROOYh35C/1s7M//pIaRvu1XWXzdexgBR2dO7eq1oDw+X08BNJUVUEte3z7os5CNeP7YfZrAqyDJvA59wMK1qul6oHyy7z5P1aB4zNczvO7SZ20HogWjHjzYJ0qwmSUUtjlKvECQzoTCbS/F0gB9rdUZN02MJopDs8YWcohy8oqNLnrflHdxWm6jAb3sSa" "EQReu6iRKKPiXTGUISSetY+iXLo2j/2c5g5ppiIYkUTq58asamMNiCzB7BeF4WNkjz2P+9IJmmtkkJ0M/U4oThUMvBBtQ/XUV4i2N4PGB359G5d/PIMiCj4go2axA4p8ul7Qafbtv0fyPwOIGSojwIDAQAB"

Both go into the same TXT record. Whoever verifies DKIM concatenates them with no spaces. If Google Workspace or Microsoft 365 handed you the text and you do not have the private key, it is the same without the openssl: echo "<value>" | fold -w 255 | sed 's/.*/"&"/' | paste -sd' ' -.

The problem

A TXT record is made of one or more character-strings, and each one is capped at 255 bytes (RFC 1035). The whole record can be much longer; what it cannot have is a single 410-character string.

Google Workspace and Microsoft 365 generate 2048-bit keys by default, and rightly so: 1024 has been discouraged since RFC 8301. So almost any new DKIM setup today runs into this, and each provider reacts differently:

RFC 6376 (§3.6.2.2) requires verifiers to concatenate the strings before using them, so splitting the key is not a trick: it is the intended format.

Per provider

BIND / zone file

1
2

selector._domainkey  300  IN  TXT  ( "v=DKIM1; k=rsa; p=MIIBIjANBgkq...first part"
                                     "second part...IDAQAB" )

Route 53

In the console, paste both quoted strings into Value separated by a space or a line break. From the CLI the value is a single string with escaped quotes:

1
2
3
4
5

aws route53 change-resource-record-sets --hosted-zone-id Z0123456789EXAMPLE --change-batch '{
  "Changes": [{"Action": "UPSERT", "ResourceRecordSet": {
    "Name": "selector._domainkey.example.com", "Type": "TXT", "TTL": 300,
    "ResourceRecords": [{"Value": "\"v=DKIM1; k=rsa; p=...first part\" \"second part...\""}]
  }}]}'

Google Cloud DNS

In the console, same format in the data field. With gcloud:

1
2
3

gcloud dns record-sets create selector._domainkey.example.com. --zone=example-zone \
  --type=TXT --ttl=300 \
  --rrdatas='"v=DKIM1; k=rsa; p=...first part" "second part..."'

With Terraform (google_dns_record_set), a single rrdatas element with escaped quotes:

1

rrdatas = ["\"v=DKIM1; k=rsa; p=...first part\" \"second part...\""]

Cloudflare

Paste the full value into Content; the dashboard splits it on save. When you query it with dig you will see two strings even though you entered one: that is normal.

Verifying

1

dig +short TXT selector._domainkey.example.com

Expected: "v=DKIM1; k=rsa; p=MIIB..." "...IDAQAB", two strings, one record. Then check that the key decodes to 2048 bits, which confirms no character was lost at the cut:

1
2
3
4

dig +short TXT selector._domainkey.example.com \
  | tr -d '" \n' | sed -E 's/.*p=([A-Za-z0-9+/=]+).*/\1/' \
  | base64 -d | openssl pkey -pubin -inform DER -noout -text | head -1
# Public-Key: (2048 bit)

If base64 complains, a space slipped inside the key or characters are missing. Finish with a test email and Authentication-Results: ... dkim=pass in the headers; for a closer look, dmarcian’s DKIM Inspector.

Traps

• The cut can go anywhere, even mid-base64, but never put spaces inside the key. The space between the two strings separates strings; it is not data.
• Do not double the quotes. If the panel adds them for you and you paste "...", dig returns "\"v=DKIM1...\"" and the verifier fails.
• One record, not two. Two separate TXT records with the same name are two independent values, and neither is a valid key.
• 2048 is the sweet spot. 4096 means three strings and a DNS answer close to the UDP limit; it works, but gains nothing for DKIM.
• Rotation: publish the new key under a new selector, switch the signer, and delete the old selector after the TTL. Never edit the selector in use.
• SPF has the same limit, but an SPF that does not fit in 255 is usually a sign of too many include:; there the fix is shortening it, not splitting it.

References: Google Workspace — troubleshoot DKIM issues, AWS re:Post — CharacterStringTooLong, and the Mailhardener DNS record splitter if you would rather not use fold.