acme.sh

dns_infomaniak: log zones response and fail early in _get_zone

The sed in _get_zone passed the raw JSON through when the response
contained no [{"fqdn":", so an API error turned the zone into "{" and
the failure only surfaced later as POST /2/zones/{/records
"method_not_found". Log the response at debug2, error out on
non-success results, and parse fqdn position-independently.

https://github.com/acmesh-official/acme.sh/issues/6851

neil

2026-07-13 08:30:43 +08:00

020123d812

dns_knot: add KNOT_ZONE for delegated subdomain zones

The zone cannot be derived from the record name when the Knot server
is only authoritative for a delegated subdomain; let the user name it
explicitly, like NSUPDATE_ZONE.

fixes https://github.com/acmesh-official/acme.sh/issues/2881

neil

2026-07-12 19:22:03 +08:00

5e33e9f5f1

dns_dynu: use mutable conf storage so newly exported credentials win

Same stale-account.conf override as dns_dnsimple: the sourced plain
copy shadowed newly exported Dynu_ClientId/Dynu_Secret.

https://github.com/acmesh-official/acme.sh/issues/3216

neil

2026-07-12 19:21:56 +08:00

3fddea2962

dns_dnsimple: use mutable conf storage so a newly exported token wins

The legacy plain _saveaccountconf copy in account.conf is sourced at
startup and silently overrides a newly exported DNSimple_OAUTH_TOKEN,
so rotated tokens never took effect.

fixes https://github.com/acmesh-official/acme.sh/issues/3422

neil

2026-07-12 19:21:48 +08:00

a6766d4186

dns_ali: convert IDN domains to punycode

The Aliyun API only accepts punycode domain names, and a raw UTF-8
domain also breaks the request signature. Same _idn pattern as
dns_namecom.

https://github.com/acmesh-official/acme.sh/issues/4733

neil

2026-07-12 17:21:19 +08:00

447dc3c7e7

fix: dnsexit api rejects a TTL of zero, changed to 1 (minute) (#7107 )

Kat Crichton-Seager

2026-07-12 16:37:21 +08:00

5a8c685fd3

dns_ovh specific permission for record removal (#6386 )

Co-authored-by: amk <amk@medlin.mikus.sk>

amk1969andamk

2026-07-12 16:21:00 +08:00

dd6540ce46

Matthiasvpfr patch 1 (#7108 )

* Add files via upload

* New Banner

Updated README to include responsive images for dark and light modes.

* Add files via upload

Remove usage of jq and curl
should be compliant with acme.sh api dev guide

* Add files via upload

* Add files via upload

change CR LF to LF

* Add files via upload

missing CR

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct auth

* Add files via upload

better manage group_id

* Add files via upload

manage wrong / missing domain

* Add files via upload

strip domain to manage subdomain requests

* Add files via upload

fix wrong id selection in get root

* Add files via upload

fix parsing of IDs

* Add files via upload

correct get_root to better handle unexisting domaines (acmetest)

* Add files via upload

correct token incorrect in auth

* Add files via upload

manage case web api reply is empty

* Add files via upload

try to resolve error when adding unexisting subdmain txt entry

* Add files via upload

correct domain parsing

* Add files via upload

revert changes when adding record (name)
change rm to better handle complex urls

* Add files via upload

correct rm function to better manage records deletion

* Add files via upload

ensure auth variable arent lost during calls

* Add files via upload

try to keep autj variables accross executions

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

fix stripping subdomains

* Add files via upload

* Add files via upload

keep auth token instead of requesting it each time

* Add files via upload

debug

* Add files via upload

* Add files via upload

* Add files via upload

better manage record deletion to avoid orphans
added some debug and checks

* Add files via upload

paginated api support for rm function

* Add files via upload

* Add files via upload

delay to manage api 404

* Add files via upload

enhance parsing of records in rm

* Add files via upload

fix incorrect record detection in rm

* Add files via upload

better manage filters on api to limit errors

* Add files via upload

try to handle 404 when requesting API too frequently

* Add files via upload

* Add files via upload

sleep during auth

* Add files via upload

manage 404 errors in get_root

* Add files via upload

correct variable overide
translate comments
prefix all variables

* Add files via upload

correct variable

* Add files via upload

typo

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct variable naming (_comlaude prefix missing)
correct rm return code when non existing record
typo

* Add files via upload

log an info instead of an error if no dns record found in RM function.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: Matthiasvpfr <matthias.dupont@vetpartners.fr>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

2026-07-12 16:13:42 +08:00

e828b285ad

dns_dynu: include the server response in the authentication error

Same as the dns_cloudns change: a bare "Authentication failed" hides
the actual API error and makes reports undiagnosable.

neil

2026-07-12 12:45:10 +08:00

2c51ac1c27

dns_knot: KNOT_KEY takes the TSIG key data, not a file path

The knsupdate "key" statement wants "[alg:]name secret"; the info block
wrongly described the option as a file path.

https://github.com/acmesh-official/acme.sh/issues/6293

neil

2026-07-12 12:22:28 +08:00

099d88e6a9

dns_pdns: probe zones with the server-side name filter in _get_root

The unfiltered GET /zones lists every zone on the server; with large
installations (100k zones) root-zone detection took minutes per domain.
Probe each walk-up candidate with ?zone=<name> instead (exact match per
the PowerDNS API docs); servers that ignore the parameter return the
full list, which the existing check still handles.

https://github.com/acmesh-official/acme.sh/issues/6382

neil

2026-07-12 11:20:53 +08:00

e94631de44

dns_zonomi: make the API endpoint configurable via ZM_Api

RimuHosting (which owns zonomi) exposes the identical API at
https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
both providers with one hook. The default stays zonomi.com and is not
written to the account conf.

https://github.com/acmesh-official/acme.sh/issues/6475

neil

2026-07-12 10:26:40 +08:00

7d0283ca2c

dns_cpanel: quote inner expansion in suffix strip (SC2295)

neil

2026-07-12 09:35:22 +08:00

76811857a0

dns_cloudns: include the server response in the login error

https://github.com/acmesh-official/acme.sh/issues/6520

neil

2026-07-12 09:34:59 +08:00

22a5ae3ceb

dns_cpanel: resolve the most specific zone in _get_root

With both domain.tld and sub.domain.tld zones on the account, the first
endswith hit could pick the parent zone while cPanel stores the record
in the most specific one, so the cleanup never found the record and
left an orphaned _acme-challenge TXT entry. Pick the longest matching
zone with an exact literal suffix match (_endswith treats the needle as
a regex, letting xdomain.tld wrongly match zone domain.tld).

https://github.com/acmesh-official/acme.sh/issues/6807

neil

2026-07-11 11:42:32 +08:00

9366c2e065

Microwavenby dns hostinger (#6843 )

* [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com

* [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled

* [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?

* [Microwavenby-dns-hostinger] Responding to comments from Neil

* [dns-hostinger] SHfmt and Shellcheck

* [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

Sasha Reid

2026-07-11 10:04:49 +08:00

2e4acba105

Fix name.com DNS API for processing IDNs (#4381 )

Mike Lei

2026-07-10 21:56:54 +08:00

fef90e15e1

dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999 )

Getting client_id failed due to incorrect extraction!

At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
{"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

CV

2026-07-10 20:55:23 +08:00

ebde8345ae

dns_njalla.sh: accept string record ids when removing records

The Njalla API returns record ids as JSON strings now; the numeric-only
pattern matched nothing, so the removal never found the record id.
Match both quoted and bare ids.

from https://github.com/acmesh-official/acme.sh/pull/5121

neil

2026-07-10 20:47:31 +08:00

58cd667d65

2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171 )

Andrew V.

2026-07-10 20:36:42 +08:00

98c30912fb

dns_pleskxml.sh: use grep -F when matching interpolated values

fulldomain/txtvalue/root_domain_name were interpolated into grep
regex patterns; match them as fixed strings instead.

from https://github.com/acmesh-official/acme.sh/pull/7031

neil

2026-07-10 12:05:28 +08:00

fa763db105

dns_me.sh: use LC_ALL=C so the request date header is always English

LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
alone still produced localized day/month names on non-English systems
and DNS Made Easy rejected the request date header. An LC_ALL=C
command prefix beats every locale variable (same pattern as
dns_oci.sh).

Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

neil

2026-07-10 11:20:08 +08:00

534a1714dc

dns_freedns.sh: use grep -E, BRE \| alternation is a GNU extension

OpenBSD grep treats \| in a BRE as a literal | character, so
_freedns_domain_id never matched any row and every domain lookup
failed with "Domain not found". Switch to ERE with -E, keeping the
parens escaped so the (.*) suffix branch still requires literal
parentheses and does not widen the match (e.g. searching example.com
must not match example.company).

Reported-by: @katiekloss @boretom
Ref: https://github.com/acmesh-official/acme.sh/issues/2305

neil

2026-07-10 10:23:59 +08:00

bed15ba844

Add creoline API as DNS provider (#7100 )

* New Banner

Updated README to include responsive images for dark and light modes.

* acme-sh-creoline-as-dns-provider

* acme-sh-creoline-as-dns-provider - Review changes implemented according code review

* acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron

* acme-sh-creoline-as-dns-provider - Remove debug code

* acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>

2026-07-10 10:07:12 +08:00

cf3eab95ee

Merge pull request #7026 from Marvo2011/dev

Update SelfHost DNS provider

Marvo2011

2026-07-06 21:30:13 +08:00

b1b539695f

Add LaoDC DNS API (dns_laodc) (#6974 )

* Added LaoDC API Module

* Cleaned up debug and info
revised get subdomain to filter by TXT records.

* Added commet to _get_root

* Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.

Revised rm() function to do explicit record matching.

* Revised _get_root() to handle different scenarios.

Fixed _laodc_api() function to check if query failed to run.
added basic json sanitation to handle \ and " in $value
unset _H2 _H3 after call as per request from copilot.

* fixed indentation of case statement block

* fixed condition checking.

_get_root should start at 1 so full fqdn can be tested
$? was being reference after export command failing response checks
removed export txtvalue
fixed docs link and issues link

* Verify key for both add and rm

* fixed dns alias condition check
validate key returns 1 if failed.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: LaoDC <git@laodc.com>

2026-07-05 23:30:26 +08:00

8f3c1701f3

dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973 )

neil

2026-07-05 18:02:34 +08:00

d3af3315da

migrate the legacy ACMEDNS_UPDATE_URL from the account conf (#3899 )

neil

2026-07-05 17:48:33 +08:00

7b6d96387c

dns_regru: require a dot boundary in root zone matching

_get_root matched a registered domain anywhere as a substring of the
challenge domain, so with both "test.com.ru" and "subtest.com.ru" in the
account, issuing for subtest.com.ru wrongly picked test.com.ru as the
root (it is a substring of "sub-test.com.ru"). Anchor the match to a '.'
boundary so a shorter domain no longer matches a longer subdomain label.

Fixes the issue reported in #5036 (thanks @koledas)
Closes #5036

neil

2026-07-05 16:57:59 +08:00

7def43481a

dnsapi/dns_namecom: probe the root zone with GetDomain instead of listing all domains

The domain list is paginated at 1000 entries per page and only the
first page was fetched, so accounts with more than 1000 domains never
found the root zone.

fix https://github.com/acmesh-official/acme.sh/issues/5051

neil

2026-07-05 16:53:14 +08:00

defd64022d

dnsapi/dns_autodns: escape XML special characters in credentials (#5317 )

neil

2026-07-05 16:29:58 +08:00

504540e67c

Add dns_muumuu: muumuu-domain.com DNS API (#7012 )

* Add dns_muumuu: muumuu-domain.com DNS API

* Fix: remove local keyword for POSIX sh compatibility

* Fix: lowercase fulldomain for API compatibility

* Style: use echo instead of printf for lower_case (consistent with other plugins)

* Fix: prefix rest vars, clear _H4/_H5, guard record_id, update Issues URL

laineus

2026-07-05 16:05:33 +08:00

24895a15c8

Add WEDOS WAPI DNS API (dns_wedos) (#7072 )

* Add WEDOS WAPI DNS API (dns_wedos)

* dns_wedos: fix response parsing on systems without egrep -o

* dns_wedos: report WAPI auth errors, UTC fallback for hosts ignoring TZ

Jan Forman

2026-07-05 12:44:07 +08:00

524d96a3a8

dns_desec: fix advertised token variable name (#7081 )

This must've been a copy-paste error from `dns_ddnss`.

Fixes: 6b7b5caf54 ("DNS provider API: structured description")

Foster Snowhill

2026-07-05 12:03:48 +08:00

0eb5cc8384

dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804

neil

2026-07-04 21:58:57 +08:00

9764f67619

add application/json to acmedns (#5066 )

Ramon

2026-07-04 21:07:18 +08:00

b92516f79e

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

dns_da: document that special characters in DA_Api credentials must be percent-encoded

https://github.com/acmesh-official/acme.sh/issues/3468

neil

2026-07-04 18:19:45 +08:00

6df2d9e451

Add Calrissia.be API (#6811 )

Co-authored-by: Ward <ward.hus@calrissia.com>

wardhusandWard

2026-07-04 16:54:05 +08:00

8f2a476d21

fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895

neil

2026-07-04 11:44:32 +08:00

7653eaab31

dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272

neil

2026-07-03 23:44:22 +08:00

780f2ad5dc

dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487

neil

2026-07-03 23:34:27 +08:00

ac5624536b

dev_mythic_beasts: Fix header name: Accepts => Accept (#6428 )

szakharchenko

2026-07-03 23:25:38 +08:00

0ce8c24736

dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491

neil

2026-07-03 23:02:35 +08:00

20254cbaf0

dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517

neil

2026-07-03 22:49:40 +08:00

f4d2db64ef

fix https://github.com/acmesh-official/acme.sh/issues/6914

neil

2026-07-03 20:07:42 +08:00

92bd80c07d

fix https://github.com/acmesh-official/acme.sh/issues/6963

neil

2026-07-03 19:38:42 +08:00

eabd23a551

fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077 )

_normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
any positional argument. dns_czechia_add() called it as
`_normalizeJson "$_res"`, so the response was discarded and the inner
sed blocked reading from stdin.

When issuing for a single domain, or for a record that already exists,
the "already exists" branch returns early and never reaches this call,
which is why the bug stayed hidden. With multiple domains, the first
record often short-circuits on "already exists" while the next,
freshly-added record reaches the broken call and hangs on interactive
runs (or consumes unrelated stdin non-interactively).

Pipe the response into _normalizeJson via stdin, matching
dns_czechia_rm() and every other dnsapi plugin.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CZECHIA-COMandClaude Opus 4.8

2026-07-03 18:12:25 +08:00

f038958192

feat: Add Volcano Engine DNS API (#7069 )

* feat: add volcengine dns api

* fix(volcengine): address review findings and fix record matching

Code review fixes:
- fix format string usage in signature computation (use printf %b / %s)
- clear _H1.._H5 header state at start of request to avoid leaking
  conditionally-set headers into subsequent requests
- check ListZones return status in _get_root
- document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
- fix Docs and Issues sections
- remove and update some code comments

Functional fixes:
- stop matching ListRecords results by FQDN string: Volcengine lowercases
  the Host/FQDN in responses, so a case-sensitive compare against
  $fulldomain failed for mixed-case names, making rm silently skip
  deletion and add lose idempotency. ListRecords is already filtered by
  ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
  result instead.
- reset _record_id at the start of add/rm to avoid stale state leaking
  across calls within the same process
- tag created records with Remark "acme.sh" for easier identification
- adjust debug levels: hide Authorization header behind _debug2, surface
  response at _debug

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: wenxuan70 <t736660416@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 10:09:32 +00:00

fdf528c26c