acme-dns: DNS-01 without handing over the key to the whole zone (CNAME delegation of _acme-challenge) with certbot and cert-manager
NS auth.example.com → acme-dns; POST /register → username, password, fulldomain; CNAME _acme-challenge.example.com → . certbot certonly –manual –manual-auth-hook /etc/letsencrypt/acme-dns-auth.py –preferred-challenges dns -d ‘*.example.com’ -d example.com. On Kubernetes, the dns01.acmeDNS solver with accountSecretRef. acme-dns 2.0.2 (February 2025) is still active.