Dns | inetshell

acme-dns: DNS-01 without handing over the key to the whole zone (CNAME delegation of _acme-challenge) with certbot and cert-manager

NS auth.example.com → acme-dns; POST /register → username, password, fulldomain; CNAME _acme-challenge.example.com → . certbot certonly –manual –manual-auth-hook /etc/letsencrypt/acme-dns-auth.py –preferred-challenges dns -d ‘*.example.com’ -d example.com. On Kubernetes, the dns01.acmeDNS solver with accountSecretRef. acme-dns 2.0.2 (February 2025) is still active.

Google-managed certificate that never gets issued: CAA (pki.goog, letsencrypt.org), FAILED_NOT_VISIBLE and the right order

CAA with issue pki.goog and issue letsencrypt.org (or no CAA at all), A/AAAA pointing only to the load balancer IP, certificate attached to the target proxy, and up to 60 minutes. gcloud compute ssl-certificates describe shows the domainStatus that tells which of the three is failing.

2048-bit DKIM: the key does not fit in a 255-character TXT

The 255 limit is per string, not per record. fold -w 255 + quotes, all in the same TXT; the verifier concatenates them. Route 53 and Cloud DNS require it; Cloudflare does it for you.

pfSense and OPNsense: the port forward does not work from the LAN itself (NAT reflection and split DNS)

LAN → public IP traffic never leaves through the WAN, it dies at the firewall. Split DNS (host override → internal IP) is the clean way; Pure NAT + automatic outbound NAT for reflection when the DNS is not yours.