acme.sh

dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804

neil

2026-07-04 21:58:57 +08:00

9764f67619

add application/json to acmedns (#5066 )

Ramon

2026-07-04 21:07:18 +08:00

b92516f79e

dns_inwx: fix _get_root false zone match for single-letter subdomains

_get_root matched the candidate zone with _contains (grep), which treats
the domain as a regex. For "-d g.<zone>" the candidate "g.<zone>" matched
"<string>...<zone>" because '.' matches the '>' after "string" and the 'g'
comes from the "<string>" tag, so "g.<zone>" was wrongly taken as the root
zone (sub=_acme-challenge instead of _acme-challenge.g). Anchor the match
to <string>$h</string> and escape dots so the zone is compared literally.

Fixes #5129

neil

2026-07-04 20:28:56 +08:00

fbf3b41c54

dns_huaweicloud: add optional HUAWEICLOUD_Region (default ap-southeast-1)

The DNS endpoint and IAM token scope project were hardcoded to
ap-southeast-1, which fails for accounts without that region enabled.

fix https://github.com/acmesh-official/acme.sh/issues/5302

neil

2026-07-04 19:06:46 +08:00

917bebd460

dns_da: document that special characters in DA_Api credentials must be percent-encoded

https://github.com/acmesh-official/acme.sh/issues/3468

neil

2026-07-04 18:19:45 +08:00

6df2d9e451

Add Calrissia.be API (#6811 )

Co-authored-by: Ward <ward.hus@calrissia.com>

wardhusandWard

2026-07-04 16:54:05 +08:00

8f2a476d21

fix https://github.com/acmesh-official/acme.sh/issues/4879#issuecomment-2942728895

neil

2026-07-04 11:44:32 +08:00

7653eaab31

dns_ali: do not rely on "_url_encode upper-hex" so the signature works with older bundled libraries (e.g. Proxmox VE) https://github.com/acmesh-official/acme.sh/issues/6272

neil

2026-07-03 23:44:22 +08:00

780f2ad5dc

dns_gd: fix root zone detection for API-restricted accounts https://github.com/acmesh-official/acme.sh/issues/4487

neil

2026-07-03 23:34:27 +08:00

ac5624536b

dev_mythic_beasts: Fix header name: Accepts => Accept (#6428 )

szakharchenko

2026-07-03 23:25:38 +08:00

0ce8c24736

dns_dnsimple: support user tokens (dnsimple_u_*) https://github.com/acmesh-official/acme.sh/issues/6491

neil

2026-07-03 23:02:35 +08:00

20254cbaf0

dns_gd: skip readback check when GoDaddy API returns UNKNOWN_DOMAIN https://github.com/acmesh-official/acme.sh/issues/6517

neil

2026-07-03 22:49:40 +08:00

f4d2db64ef

fix https://github.com/acmesh-official/acme.sh/issues/6914

neil

2026-07-03 20:07:42 +08:00

92bd80c07d

fix https://github.com/acmesh-official/acme.sh/issues/6963

neil

2026-07-03 19:38:42 +08:00

eabd23a551

fix(dns_czechia): read _normalizeJson input from stdin, not as an argument (#7077 )

_normalizeJson reads its JSON from stdin (sed | sed | tr) and ignores
any positional argument. dns_czechia_add() called it as
`_normalizeJson "$_res"`, so the response was discarded and the inner
sed blocked reading from stdin.

When issuing for a single domain, or for a record that already exists,
the "already exists" branch returns early and never reaches this call,
which is why the bug stayed hidden. With multiple domains, the first
record often short-circuits on "already exists" while the next,
freshly-added record reaches the broken call and hangs on interactive
runs (or consumes unrelated stdin non-interactively).

Pipe the response into _normalizeJson via stdin, matching
dns_czechia_rm() and every other dnsapi plugin.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CZECHIA-COMandClaude Opus 4.8

2026-07-03 18:12:25 +08:00

f038958192

feat: Add Volcano Engine DNS API (#7069 )

* feat: add volcengine dns api

* fix(volcengine): address review findings and fix record matching

Code review fixes:
- fix format string usage in signature computation (use printf %b / %s)
- clear _H1.._H5 header state at start of request to avoid leaking
  conditionally-set headers into subsequent requests
- check ListZones return status in _get_root
- document Volcengine_SESSION_TOKEN option and fix duplicate "and" typo
- fix Docs and Issues sections
- remove and update some code comments

Functional fixes:
- stop matching ListRecords results by FQDN string: Volcengine lowercases
  the Host/FQDN in responses, so a case-sensitive compare against
  $fulldomain failed for mixed-case names, making rm silently skip
  deletion and add lose idempotency. ListRecords is already filtered by
  ZID+Host+Value+SearchMode:exact, so just extract RecordID from the
  result instead.
- reset _record_id at the start of add/rm to avoid stale state leaking
  across calls within the same process
- tag created records with Remark "acme.sh" for easier identification
- adjust debug levels: hide Authorization header behind _debug2, surface
  response at _debug

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: wenxuan70 <t736660416@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-03 10:09:32 +00:00

fdf528c26c

fix https://github.com/acmesh-official/acme.sh/issues/6851

neil

2026-07-02 23:18:26 +08:00

42e13fa797

DNS_IONOS double sending content type & case sensitive mismatch (#7028 )

* double sending content type results in error from ionos

* Normalize fulldomain to lowercase in the _ionos_get_record function.

MarFri

2026-07-02 23:08:59 +08:00

a50fad865f

Add Glesys dnsapi provider (#7059 )

* Add Glesys dnsapi provider

* Fix typo in error message for dns_glesys_add

* Use API to get record id in Glesys provider

* Use listrecords API endpoint to find root domain

* Remove record id parsin from add function

Toni Karppi

2026-07-02 13:10:29 +08:00

5433ea86c8

fix https://github.com/acmesh-official/acme.sh/issues/7062

neil

2026-07-02 13:09:59 +08:00

e52d75d762

Implemented support for Aruba Business DNS API (#7042 )

* Add support for arubabusiness api

* Fix formatting

* record names are always converted to lowercase

* Docs

* remove leftover unconditional authentication call
lowercase
urlencoded body + x-www-form-urlencoded content-type
cleanup header variables
cleanup typos
grammar

* Strengthen _ab_rest failure checks
Properly process parallel lists in _ab_dns_record_id
Remove hard fails when a txt record already exists

* fix json parsing

* Fix formatting

---------

Co-authored-by: Manwe-Sulimo <blarghonaut@gmail.com>

Manwe SulimoandManwe-Sulimo

2026-07-02 13:06:41 +08:00

cb40b47a4e

fix(dns_baidu): prefer new Baidu DNS API with legacy BCD fallback (#6992 )

* fix(acme): prefer new Baidu DNS API with legacy BCD fallback

Keep the existing BCD implementation and add fallback support for the newer Baidu DNS record API. Prefer the new API by default, then fall back to the legacy BCD API to reduce compatibility risk.

* fix(dns_baidu): route through _get/_post + restore legacy BCD auth headers

Per review: _baidu_dns_call now uses _get/_post with _H1.._H5 (no raw curl, no __HTTP_STATUS__ parsing); _baidu_bcd_post restores _H1.._H5 so the legacy BCD path sends the Authorization signature again (fixes 401).

---------

Co-authored-by: neil <github@neilpang.com>

pxMan79andneil

2026-07-02 13:02:30 +08:00

b039ff3087

dns_inwx: fix IDN zone detection without python dependency (#7056 )

* dns_inwx: fix IDN zone detection without python dependency

INWX returns zone names in Unicode form (e.g. lünenschloß.de) even when
the domain was registered as an IDN. When acme.sh passes the SAN in
punycode (xn--lnenschlo-o1a42a.de), _contains never matches and
_get_root falls through to the TLD, placing the TXT record in the wrong
zone.

Previous fix used python3 which is not available in all environments
(BusyBox, BSD, minimal containers). Replace with _idn()-based approach:
extract <string> values from the nameserver.list XML response, encode
each via _idn(), and compare to $h. When a match is found, use the
original Unicode zone name for createRecord.

Fixes #7038

* dns_inwx: fix shebang, use _egrep_o, shfmt cleanup

- Revert shebang to #!/usr/bin/env sh (POSIX sh, fixes ShellCheck)
- Replace grep -o with _egrep_o for portability
- shfmt -i 2: drop backslash continuation after pipe, fix indentation

Requested by @neilpang

* fix: drop closing </string> from _egrep_o pattern to avoid sed delimiter collision

---------

Co-authored-by: bluenenschloss <bernd.luenenschloss@7p-group.com>

bluenenschlossandbluenenschloss

2026-07-02 13:00:49 +08:00

c83eed4994

fix https://github.com/acmesh-official/acme.sh/issues/6498

neil

2026-07-01 21:59:41 +08:00

81100db2f3

fix(dns_infomaniak): correctly detect API errors (#7048 )

The add/rm success check never rejected anything: for any non-empty API
response it always reported "Record added"/"Record deleted" and returned
0, so the _err branch was dead code. A valid key looked fine only because
the API call genuinely created the record; an invalid key returning
{"result":"error"} produced the same "Record added" output even though
nothing was created.

Root cause, in:
  if [ -n "$response" ]; then
    if [ ! "$(echo "$response" | _contains '"result":"success"')" ]; then

  - _contains() ignores stdin (it reads only $1 and $2), so the piped
    "$response" was discarded.
  - The pattern '"result":"success"' was passed as $1 (the haystack),
    leaving $2 (the needle) empty, so it ran:
      echo '"result":"success"' | grep -- "" >/dev/null 2>&1
    grep with an empty pattern always matches.
  - That grep output is redirected to /dev/null, so the command
    substitution always captured "", making [ ! "" ] always true.

Fix: call _contains "$response" '"result":"success"' directly and branch
on its exit code, so error responses now correctly fail (return 1).

Co-authored-by: neil <github@neilpang.com>

Jonas Zürcherandneil

2026-07-01 21:05:07 +08:00

ae8ef74c4b

Update dns_hostup.sh to v2 API (#7014 )

* Update dns_hostup.sh

Update to v2 api support; developer.hostup.se

* Update dns_hostup.sh

hostup

2026-07-01 20:44:21 +08:00

0d53d29f7e

fix(dns_desec): fix rate limit and compatibility issues (#7027 )

* fix(dns_desec): sleep after DNS record change to prevent rate limit issues

Also: make sure the subname is lowercase to fix tests where
the acmetestXyzRandomName subdomain is used.

* fix: make regexes POSIX-compatible (for OpenBSD)

* chore: use _sleep instead of sleep to follow acme.sh standards

Alexander Stehlik

2026-07-01 18:54:24 +08:00

2998106bd1

Implement support for DNS Level27 (#7043 )

* Add Level27 DNS API support

Implements dns_level27_add and dns_level27_rm for the Level27 (level27.eu) DNS API, used for ACME dns-01 challenges.

- Authenticates with a persistent API key via the Authorization header.
- Resolves the registered zone with domains?filter and exact fullname match (supports DNS alias mode).
- Removes the challenge record by its exact TXT value, leaving other records intact (wildcard-safe).
- Optional LEVEL27_API override for non-default/staging endpoints.

* A little better documentation

---------

Co-authored-by: Jeroen Moors <jeroen.moors@level27.be>

Jeroen MoorsandJeroen Moors

2026-06-29 01:27:41 +08:00

b3579ff18d

Fix dns_namesilo_rm failing to remove TXT record (#6969 )

* Fixes #6907

regisvidal-bitmapz

2026-06-19 14:24:20 +02:00

365d2d10f3

Updated AWS Route53 service endpoint to the dual-stack endpoint (#6994 )

* Update to dual-stack service endpoint

Bill

2026-06-05 22:06:49 +02:00

d98fa53f62

Add CDMON Api (#6984 )

* Added CDMon DNS API

aitor422

2026-06-05 22:02:14 +02:00

9b597b3f1b

dns_1984hosting: cleanup, memoize zone id (#6978 )

* dns_1984hosting: cleanup, memoize zone id, optional OTP

Adrian Fedoreanu

2026-06-05 19:28:08 +02:00

a2f046306e

remove dns_hetzner.sh

https://github.com/acmesh-official/acme.sh/issues/6990#issuecomment-4576551997

neil

2026-05-30 11:48:06 +02:00

5713c1d39d

Add Poweradmin DNS API plugin (dns_poweradmin) (#6943 )

* Add Poweradmin DNS API plugin (dns_poweradmin)

Jakob Næss

2026-05-24 22:34:56 +02:00

206f4494ac

[dnsapi] add IP-Projects dns hook (#6959 )

Markus Ebner

2026-05-24 22:24:00 +02:00

ce07759ced

Improve Simply.com API (#6933 )

Improve Simply.com API (#6933)

Tom Sommer

2026-05-24 22:20:40 +02:00

010bd1111a

Add EuroDNS DNS API plugin (dns_eurodns) (#6903 )

Co-authored-by: Nicolas Santorelli <nsantorelli@eurodns.com>

nsantorelliandNicolas Santorelli

2026-05-02 10:56:13 +02:00

96f87844cd

Add dns_firestorm.sh plugin for Firestorm.ch DNS API (#6829 )

Firestorm.ch is a Swiss hosting provider with managed DNS (PowerDNS).
This plugin allows customers to automate Let's Encrypt DNS-01 challenges
via the Firestorm DNS API.

firestormisp

2026-05-02 10:56:13 +02:00

10e7e458af

Add dns_cpanel_uapi DNS API plugin (#6878 )

* Add dns_cpanel_uapi.sh

Adam Bodnar

2026-04-26 14:29:40 +02:00

fd6ff7b173

Add Gname.com dnsapi support (#6808 )

* add gname dns acme.sh

GNDevProd

2026-04-14 20:57:22 +08:00

454cec6e43

add dnsapi for baidu cloud dns (#6844 )

wangzhizhou

2026-04-14 20:44:30 +08:00

afba1455b8

[dnsapi] add SiteHost DNS API hook (#6891 )

Co-authored-by: Jordan Russell <jordan.russell@sitehost.co.nz>

Jordan RussellandJordan Russell

2026-04-08 22:07:30 +08:00

618735d11e

dns_world4you: Adapt to latest record id changes (#6897 )

Lorenz Stechauner

2026-04-08 22:00:42 +08:00

08b2186afe

Add bHosted.nl DNS API (#6864 )

Add bHosted.nl DNS API (#6864)

Stefan Bottelier

2026-04-08 21:59:09 +08:00

3509f6404f

[dnsapi] add subreg.cz dns hook (#6848 )

* Add DNS hook for subreg.cz

Tomáš Pavlič

2026-03-22 11:40:44 +08:00

3c8c735362

Add BEST-HOSTING DNS API (#6859 )

* Add BEST-HOSTING DNS API

heximcz

2026-03-22 11:36:29 +08:00

c397bd6573

Add dns_czechia DNS API plugin (#6764 )

* Create dns_czechia.sh

This PR adds a DNS API plugin for CZECHIA.COM / RegZone (ZONER a.s.).

CZECHIA-COM

2026-03-16 20:17:18 +08:00

8aea731bd4

dnsapi/dns_me: ignore "already exists" error for multi-domain support (#6830 )

Ludwig

2026-03-08 18:37:29 +08:00

03860a4978

shfmt edit

Travis

2026-03-03 05:31:51 -08:00

f0146bd90e

Merge branch 'dev' into add_technitium_expiry_ttl

Tra5is

2026-03-03 04:59:54 -08:00

20722ea030