acme.sh

Add Opteamax DNS API (#7244 )

Adds dns_opteamax.sh, solving dns-01 challenges through the Opteamax
customer API (api.opteam.ax). Authentication is a Bearer token created in
the customer panel; the zone is detected by walking the name up against the
account's zone list, so subzones and DNS alias mode both work, and rm only
removes the value it was given so a wildcard's two TXT records survive each
other.

Jens Ott

2026-09-11 11:49:47 +08:00

2074493c7c

Add Optidata Cloud DNS API (dns_optidata) (#7243 )

* Add Optidata Cloud DNS API (dns_optidata)

* dns_optidata: portable TXT match, drop undocumented "internal" case

Review feedback on #7243:

1. grep -F is not portable: Solaris /usr/bin/grep has neither -F nor --.
   The DNS test only passed there because the CI job prepends
   /usr/gnu/bin to PATH. txtvalue is base64url ([A-Za-z0-9_-]), so it
   needs no JSON escaping and a case pattern matches it with a shell
   builtin, without depending on any grep extension.

2. Dropped the undocumented "internal" exception from the zone status
   notice in _get_root. It only silenced an _info message, and a dns-01
   challenge has to resolve publicly anyway, so an internal zone can
   never validate through this hook.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Eduardo LangnerandClaude Opus 5

2026-09-11 11:48:31 +08:00

cb0ef1c30c

Fix dns_hw: prevent record-set lookup from hanging (#7236 )

Mashiro

2026-09-10 21:41:00 +08:00

75afdcc1fb

Update netcup DNS API to support new API (#7214 )

* dns_netcup: add support for the new netcup REST API

Domains managed by the new DNS backend can be handled through the new
REST API at api.netcup.com. The API is selected by the length of
NC_Apikey: new REST API keys are 64 characters long, legacy CCP API
keys are 50.

With a REST API key the domain is looked up via GET /v1/domain and the
challenge record is managed through the dedicated ACME challenge
endpoints. After adding a record, the script waits 20 seconds and then
polls until the record reports the deployed status.

Domains whose DNS cannot be managed via the REST API yet fall back to
the legacy CCP API when NC_Apikey_Legacy, NC_Apipw and NC_CID are
configured.

* dns_netcup: treat non-challenge records as a no-op on the REST API

The REST API can only manage _acme-challenge records, records with
other names cannot exist behind it. The DNS-API-Test adds and removes
a TXT record outside _acme-challenge and expects both calls to
succeed, so treat such records as a successful no-op with an info
message instead of failing.

* dns_netcup: address review feedback for the REST API support

- Only skip the synthetic DNS-API-Test record: real records without
  the _acme-challenge prefix (e.g. a challenge alias in the "=" form)
  now fail loudly, or use the legacy CCP API when legacy credentials
  are configured. The zone walk starts at the full name for them, so
  an apex alias is found.
- Blank _H2..._H5 for REST API calls and clear all header slots before
  legacy CCP API calls so no auth headers leak between endpoints or
  dns hooks.
- Stop walking the zone lookup when the API reports success:false and
  surface the response instead of a misleading "no zone found".
- Split the response before extracting id/isDnsManaged so the egrep
  and sed implementations of _egrep_o cannot pick different matches.
- Fall back to the legacy CCP API only on a literal isDnsManaged
  false; error distinctly on an unparsable value.
- Poll the deploy status right away and sleep between retries instead
  of an unconditional 20 second sleep.
- Use ${#NC_Apikey} for the key length and rename internal state to
  _nc_apikey/_nc_endrest.

* dns_netcup: walk on when the REST API reports resourceDoesNotExist

Querying /domain?fqdn= for a name that is not a domain of the account
does not return an empty result: the API answers with success:false
and the error code resourceDoesNotExist. Treat exactly that as "not
found" during the zone walk and keep failing hard on everything else,
e.g. an invalid API key.

jduss

2026-09-10 21:37:03 +08:00

162fbde328

fix: dynv6 record parsing (#7197 )

MBWhitestone

2026-09-04 14:51:30 +08:00

fa8dc180aa

Merge pull request #7220 from moezx/dev

Add AK & SK based Huawei Cloud DNS API

Mashiro

2026-09-04 14:49:50 +08:00

195cbd5d09

dns_azure: never read or persist AZUREDNS_BEARERTOKEN from account.conf

Versions up to 3.0.9 cached the internally-acquired access token as
SAVED_AZUREDNS_BEARERTOKEN. 3.1.0 repurposed that variable for
user-supplied bearer tokens, so after an upgrade the stale cached token
was read back as if user-supplied, skipped the refresh path, and failed
renewals with 401 forever once expired.

A bearer token is short-lived, so persisting it is never useful: take it
from the environment only, and clear any stale saved value on the next
run.

fix https://github.com/acmesh-official/acme.sh/issues/7218

neil

2026-08-30 15:42:27 +08:00

6e1deacac0

dns_jd: upgrade to JD Cloud v2 API (#7207 )

skysaint

2026-08-30 15:33:32 +08:00

c6cd844986

dns_easydns: match the TXT record by its rdata when removing (#7199 )

dns_easydns_rm() picked the first id in the search response and ignored
$txtvalue. When two challenge records exist under the same host - for
example when example.com and *.example.com are issued as separate
certificates - a concurrent run's record could be deleted instead of
our own.

Select the record by its rdata instead, following the dns_cf.sh
convention of matching name + value. tr '{' '\n' puts one record per
line, so both _egrep_o branches - egrep -o and the BRE sed fallback -
return the same single id. Without it the sed fallback would return
only the last match, since .* is greedy.

An empty record_id is now treated as "nothing to remove" and returns 0,
rather than being reported as an error.

Also add the credential check that _rm was missing. It deliberately
does not call _saveaccountconf_mutable, as _add already does that.

Co-authored-by: wurzelpanzer <wurzelpanzer@maximolider.net>

wurzelpanzerandwurzelpanzer

2026-08-22 10:15:52 +08:00

ef7b2d3c2e

Merge pull request #5194 from flesniak/myloc

Add dnsapi script for myloc.de/webtropia.com

Fabian Lesniak

2026-08-22 10:13:58 +08:00

b481ffb81b

Remove deprecated Linode API v3 DNS plugin (#7054 )

Signed-off-by: Zhiwei Liang <zhiwei.liang@zliang.me>

Zhiwei Liang

2026-08-12 22:47:58 +08:00

2e2782f0d8

Fix dns_netcup reporting a bogus 4013 instead of the real zone error

The zone lookup walked the challenge name from the right and ended up
asking netcup for the full "_acme-challenge.<domain>" as a zone name.
That can never be a zone, so netcup answered 4013 "Validation Error",
which replaced the real 5028 "The zone <domain> could not be found" as
the error shown to the user.

Stop one label short of the full name, and fail explicitly when no zone
matched, reporting the last API response plus what to check. Before, a
run where every candidate returned 5028 fell through to logout and
returned success.

neil

2026-08-10 10:00:26 +08:00

4a3bc2c919

feat: added nexdns dnsapi (#7170 )

* feat: added nexdns dnsapi

Adds a DNS-01 hook for NexDNS, an authoritative DNS service with a REST API.

dns_nexdns_add walks the label list to find the zone that owns the challenge
name and creates the TXT record in it. dns_nexdns_rm lists the TXT records at
that name, picks the one carrying exactly this challenge value and deletes it
by id, so a wildcard and its base domain do not remove each other's record.

A 429 is waited out and the request retried, in the shape dns_hetznercloud.sh
and dns_bunny.sh already use.

* dns_nexdns: cap the rate-limit wait, judge success by status, add the tracking issue

Alexey Morozov

2026-08-07 09:22:28 +08:00

f1cbba05f6

Fix dns_namecheap ignoring IsOurDNS when matching the root zone

_get_root_by_getList() matched the candidate suffix as an unanchored
substring of the whole domains.getList response and never looked at the
IsOurDNS attribute. A domain parked on Namecheap's webhosting DNS is
listed with IsOurDNS="false", yet it was still accepted as the root zone,
so _get_root() returned success and the domains.dns.getHosts probe that
would have found the real zone never ran. Every following getHosts call
was then refused with error 2030288 "not using proper DNS servers" and
the challenge failed with "invalid tld".

Match the exact <Domain Name="..."> entry instead and require
IsOurDNS="true", so a subdomain delegated to Namecheap BasicDNS/FreeDNS
under a parent that is not on Namecheap DNS now resolves to its own zone.
Matching the entry exactly also drops the old substring/regex match, in
which the dots of a domain matched any character.

Fixes #7178

neil

2026-08-06 19:36:26 +08:00

f67be78ff4

Fix dns_cyon cleanup failing on FreeBSD

_cyon_delete_txt relied on `printf "%b"` to convert a sed-injected literal
`\n` into a real newline, but `%b` also processes the `\"` escapes that the
JSON response is full of. glibc/bash/dash keep the backslash of such an
undefined escape, FreeBSD's printf (sh builtin and /usr/bin/printf alike)
drops it -- so `data-hash=\"..\"` became `data-hash=".."`, the extraction
regex matched nothing, _dns_entries stayed empty and no TXT record was ever
deleted.

Drop the newline injection and use _egrep_o, which already yields one match
per line, then parse each line with sed.

Also feed the read loop a newline-terminated list: `printf "%s"` left the
last line unterminated, so `read` returned non-zero at EOF and the loop
skipped the final entry on every platform.

Verified identical output on FreeBSD 14.3, Linux/bash and Linux/dash.

Fixes #7169

neil

2026-08-02 21:55:52 +08:00

b4925052dd

Refactor dns_freemyip.sh for enhanced compatibility (#7166 )

* Refactor dns_freemyip.sh for clarity and compatibility

Updated dns_freemyip.sh for better readability and compatibility with ASUSWRT-Merlin. Improved error handling and response logging.

* Update author information in dns_freemyip.sh

* replace both loops with POSIX shell counters

replace both loops with POSIX shell counters

* Typo

Typo

* Fix error message for freemyip API request failure

Remove existing token leak. Not my regression.

* Refactor retry logic and improve error handling

* Remove unnecessary blank lines in dns_freemyip.sh

* Clean up dns_freemyip.sh by removing blank lines

Removed unnecessary blank lines in the script to improve readability.

Joel Samson

2026-08-02 21:34:41 +08:00

bf90b845b2

dns_yc: fix TXT record removal failing with "Unknown key file format" (#7150 )

* dns_yc: restore YC_SA_Key_File in dns_yc_rm before signing the JWT

dns_yc_rm() never rebuilt YC_SA_Key_File from YC_SA_Key_File_PEM_b64 /
YC_SA_Key_File_Path like dns_yc_add() does. Per the DNS API dev guide,
add()/rm() run in separate subshells, so rm() must repeat add()'s setup
steps rather than rely on variables set during add().

Without it, when _yc_login() needs a fresh JWT during removal (the IAM
token from the add phase isn't available), it signs with an empty/unset
key path, and openssl fails with "Unknown key file format". The
resulting auth failure then surfaces misleadingly as "invalid domain" in
_get_root, and the TXT record is never deleted.

Verified against a real Yandex Cloud account/zone with --staging: before
the fix, removal failed with the same errors reported in the issue;
after adding the missing key-restoration block, add + remove both
succeed and the TXT record is actually deleted.

* dns_yc: preserve other TXT values when removing one at the same name

dns_yc_rm previously sent the full current data array (all existing
TXT values at the name) to the deletions API, wiping out the whole
rrset instead of only the value being removed. This breaks wildcard +
base domain issuance, where both share the same _acme-challenge name
with two different values: removing the first one deleted both,
leaving nothing for the second removal to find.

* dns_yc: read persisted config from domain conf before account conf

YC_Zone_ID, YC_Folder_ID, YC_SA_ID, YC_SA_Key_ID (zone-ID mode) and
YC_SA_Key_File_PEM_b64/Path were always saved via _savedomainconf
(domain.conf), but only ever read back via _readaccountconf_mutable
(account.conf). Once the env vars were unset, none of these could be
recovered from the saved config, so dns_yc_add/dns_yc_rm failed with
"You didn't specify a YC_SA_ID or YC_SA_Key_ID or YC_SA_Key_File."
even though the values had been persisted correctly on the prior run.

* dns_yc: replace grep -Fxv/sed with a portable loop in dns_yc_rm

Solaris's /usr/bin/grep supports neither -F nor -x, so
_remaining_txtvalue was always empty there and the preserve-other-
values logic silently fell back to deleting the whole rrset (with a
grep usage error on stderr on every rm). The sed trailing-comma strip
had a matching issue on Solaris, whose sed drops an unterminated last
line. CI didn't catch this because the fallback path also returns
"done: true". Use a plain for-loop with word splitting instead.

* dns_yc: use upsertRecordSets.deletions to remove a single TXT value

updateRecordSets has no "merges" field (only deletions/additions), so
the previous preserve-other-values logic silently did nothing -- the
TXT record was never actually removed, a regression from before that
change (which at least deleted the whole rrset). CI didn't catch it
because _clearupdns runs dns_yc_rm in a subshell and ignores its exit
code.

upsertRecordSets.deletions removes only the specified value from the
rrset directly, so the getRecordSet read and the remaining-value
recomputation are no longer needed at all.

Verified against a real zone (base + wildcard domain sharing one
_acme-challenge name): adding both values then removing one leaves
the other in place, and removing the second cleans up fully.

* dns_yc: don't delete the user's own key file in YC_SA_Key_File_Path mode

_yc_login unconditionally rm'd $YC_SA_Key_File after signing. That's
fine for the PEM_b64 path, where it's a decoded temp file, but in
YC_SA_Key_File_Path mode it's the user's own persistent key file --
the first successful login permanently deleted it, so every
subsequent dns_yc_rm/renewal hit "Unknown key file format" (the exact
symptom this PR is about, just from a different cause). Track whether
the key file is our own temp copy and only delete it in that case.

Verified with a stubbed _yc_login: a temp-mode key gets removed after
login, a path-mode key survives.

* dns_yc: clear both domain and account conf on invalid config

The failure branch in dns_yc_add only ever called _clearaccountconf,
but YC_Zone_ID/YC_Folder_ID/YC_SA_Key_File_PEM_b64/Path are persisted
via _savedomainconf, and YC_SA_ID/YC_SA_Key_ID may have been saved via
_saveaccountconf_mutable (Folder_ID mode, which stores under a
SAVED_ prefix read back by _readaccountconf_mutable). Clearing only
one store left stale values behind in whichever one wasn't touched.

Verified by seeding both domain.conf and account.conf with leftover
values, then triggering this branch and confirming both config files
end up empty.

Goncharenko Alexander

2026-07-28 10:04:20 +08:00

0565443622

fix: grep -A is not portable, breaks ARI on Solaris

Solaris /usr/bin/grep has no -A ("illegal option -- A"), so _getAKI
printed an error to stderr on every cron renewal and returned empty.
The empty AKI silently corrupts the RFC 9773 ARI certID, so ARI is
never available and renewal falls back to the fixed schedule.

Split the pipeline into a testable stdin filter _extractAKI and select
the value line with a portable sed range instead.

Same fix for the two hooks that still used grep -A: dns_world4you.sh
(also replaces the GNU-only "\s" in the same expression) and
deploy/keyhelp.sh (the -A 2 window could truncate the div range that
follows it, so it is just dropped).

https://github.com/acmesh-official/acme.sh/issues/7159

neil

2026-07-25 16:00:03 +08:00

7c12deb7ef

fix dns_yc: avoid empty-matchable _egrep_o pattern that hangs OmniOS

OmniOS native egrep -o infinite-loops emitting empty lines when the
pattern can match the empty string, so `_egrep_o "[^:]*$"` never lets
the pipeline finish and dns_yc hangs until the CI timeout. Require at
least one character instead. `+` is not usable because the sed fallback
in _egrep_o parses BRE.

neil

2026-07-25 13:34:06 +08:00

830782fd1d

feat: added realtoxmedia dnsapi (#7156 )

Alec Höfler

2026-07-24 13:55:17 +08:00

749fa2487e

Merge pull request #7140 from radumalica/dns_hestiacp

feat: add dnsapi for HestiaCP

Radu

2026-07-23 11:50:20 +08:00

24d573b6d3

fix bug for solaris.

dnsapi/deploy: remove POSIX character classes from sed/grep patterns

Solaris /usr/bin/sed and /usr/bin/grep parse [[:space:]] etc. as a
literal bracket set and silently mis-match. Replace with [ ]* for
JSON matching, a printf-tab bracket for user-input trimming, and
[0-9] for digits; also drop GNU-only sed -r/-E in rage4, selfhost
and selectel, and reuse _strip_blank_lines in byteplus_alb.

neil

2026-07-17 12:38:14 +08:00

59a97d7f8b

fix(dns_oci): read ~/.oci/config before cached account.conf values (#7124 )

The OCI DNS plugin cached the tenancy, user, region and signing key into
acme.sh's account.conf at issuance and then, on subsequent runs, read those
cached values before consulting ~/.oci/config. A value cached at issuance
therefore permanently shadowed the config file, so editing ~/.oci/config
afterwards (most visibly rotating the API signing key) had no effect and
renewals kept using stale credentials, failing authentication.

Resolve each field in the order: explicit environment variable, then
~/.oci/config when it exists, then the cached account.conf value as a
fallback for env-only installs that have no config file. The signing key
likewise prefers the key_file resolved from the environment or ~/.oci/config
over any cached key.

Signed-off-by: Avi Miller <me@dje.li>

Avi Miller

2026-07-14 20:58:47 +08:00

2499ee1ab9

dns_infomaniak: log zones response and fail early in _get_zone

The sed in _get_zone passed the raw JSON through when the response
contained no [{"fqdn":", so an API error turned the zone into "{" and
the failure only surfaced later as POST /2/zones/{/records
"method_not_found". Log the response at debug2, error out on
non-success results, and parse fqdn position-independently.

https://github.com/acmesh-official/acme.sh/issues/6851

neil

2026-07-13 08:30:43 +08:00

020123d812

dns_knot: add KNOT_ZONE for delegated subdomain zones

The zone cannot be derived from the record name when the Knot server
is only authoritative for a delegated subdomain; let the user name it
explicitly, like NSUPDATE_ZONE.

fixes https://github.com/acmesh-official/acme.sh/issues/2881

neil

2026-07-12 19:22:03 +08:00

5e33e9f5f1

dns_dynu: use mutable conf storage so newly exported credentials win

Same stale-account.conf override as dns_dnsimple: the sourced plain
copy shadowed newly exported Dynu_ClientId/Dynu_Secret.

https://github.com/acmesh-official/acme.sh/issues/3216

neil

2026-07-12 19:21:56 +08:00

3fddea2962

dns_dnsimple: use mutable conf storage so a newly exported token wins

The legacy plain _saveaccountconf copy in account.conf is sourced at
startup and silently overrides a newly exported DNSimple_OAUTH_TOKEN,
so rotated tokens never took effect.

fixes https://github.com/acmesh-official/acme.sh/issues/3422

neil

2026-07-12 19:21:48 +08:00

a6766d4186

dns_ali: convert IDN domains to punycode

The Aliyun API only accepts punycode domain names, and a raw UTF-8
domain also breaks the request signature. Same _idn pattern as
dns_namecom.

https://github.com/acmesh-official/acme.sh/issues/4733

neil

2026-07-12 17:21:19 +08:00

447dc3c7e7

fix: dnsexit api rejects a TTL of zero, changed to 1 (minute) (#7107 )

Kat Crichton-Seager

2026-07-12 16:37:21 +08:00

5a8c685fd3

dns_ovh specific permission for record removal (#6386 )

Co-authored-by: amk <amk@medlin.mikus.sk>

amk1969andamk

2026-07-12 16:21:00 +08:00

dd6540ce46

Matthiasvpfr patch 1 (#7108 )

* Add files via upload

* New Banner

Updated README to include responsive images for dark and light modes.

* Add files via upload

Remove usage of jq and curl
should be compliant with acme.sh api dev guide

* Add files via upload

* Add files via upload

change CR LF to LF

* Add files via upload

missing CR

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct auth

* Add files via upload

better manage group_id

* Add files via upload

manage wrong / missing domain

* Add files via upload

strip domain to manage subdomain requests

* Add files via upload

fix wrong id selection in get root

* Add files via upload

fix parsing of IDs

* Add files via upload

correct get_root to better handle unexisting domaines (acmetest)

* Add files via upload

correct token incorrect in auth

* Add files via upload

manage case web api reply is empty

* Add files via upload

try to resolve error when adding unexisting subdmain txt entry

* Add files via upload

correct domain parsing

* Add files via upload

revert changes when adding record (name)
change rm to better handle complex urls

* Add files via upload

correct rm function to better manage records deletion

* Add files via upload

ensure auth variable arent lost during calls

* Add files via upload

try to keep autj variables accross executions

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

fix stripping subdomains

* Add files via upload

* Add files via upload

keep auth token instead of requesting it each time

* Add files via upload

debug

* Add files via upload

* Add files via upload

* Add files via upload

better manage record deletion to avoid orphans
added some debug and checks

* Add files via upload

paginated api support for rm function

* Add files via upload

* Add files via upload

delay to manage api 404

* Add files via upload

enhance parsing of records in rm

* Add files via upload

fix incorrect record detection in rm

* Add files via upload

better manage filters on api to limit errors

* Add files via upload

try to handle 404 when requesting API too frequently

* Add files via upload

* Add files via upload

sleep during auth

* Add files via upload

manage 404 errors in get_root

* Add files via upload

correct variable overide
translate comments
prefix all variables

* Add files via upload

correct variable

* Add files via upload

typo

* Add files via upload

* Add files via upload

* Add files via upload

* Add files via upload

correct variable naming (_comlaude prefix missing)
correct rm return code when non existing record
typo

* Add files via upload

log an info instead of an error if no dns record found in RM function.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: Matthiasvpfr <matthias.dupont@vetpartners.fr>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>

2026-07-12 16:13:42 +08:00

e828b285ad

dns_dynu: include the server response in the authentication error

Same as the dns_cloudns change: a bare "Authentication failed" hides
the actual API error and makes reports undiagnosable.

neil

2026-07-12 12:45:10 +08:00

2c51ac1c27

dns_knot: KNOT_KEY takes the TSIG key data, not a file path

The knsupdate "key" statement wants "[alg:]name secret"; the info block
wrongly described the option as a file path.

https://github.com/acmesh-official/acme.sh/issues/6293

neil

2026-07-12 12:22:28 +08:00

099d88e6a9

dns_pdns: probe zones with the server-side name filter in _get_root

The unfiltered GET /zones lists every zone on the server; with large
installations (100k zones) root-zone detection took minutes per domain.
Probe each walk-up candidate with ?zone=<name> instead (exact match per
the PowerDNS API docs); servers that ignore the parameter return the
full list, which the existing check still handles.

https://github.com/acmesh-official/acme.sh/issues/6382

neil

2026-07-12 11:20:53 +08:00

e94631de44

dns_zonomi: make the API endpoint configurable via ZM_Api

RimuHosting (which owns zonomi) exposes the identical API at
https://rimuhosting.com/dns/dyndns.jsp; an overridable endpoint serves
both providers with one hook. The default stays zonomi.com and is not
written to the account conf.

https://github.com/acmesh-official/acme.sh/issues/6475

neil

2026-07-12 10:26:40 +08:00

7d0283ca2c

dns_cpanel: quote inner expansion in suffix strip (SC2295)

neil

2026-07-12 09:35:22 +08:00

76811857a0

dns_cloudns: include the server response in the login error

https://github.com/acmesh-official/acme.sh/issues/6520

neil

2026-07-12 09:34:59 +08:00

22a5ae3ceb

dns_cpanel: resolve the most specific zone in _get_root

With both domain.tld and sub.domain.tld zones on the account, the first
endswith hit could pick the parent zone while cPanel stores the record
in the most specific one, so the cleanup never found the record and
left an orphaned _acme-challenge TXT entry. Pick the longest matching
zone with an exact literal suffix match (_endswith treats the needle as
a regex, letting xdomain.tld wrongly match zone domain.tld).

https://github.com/acmesh-official/acme.sh/issues/6807

neil

2026-07-11 11:42:32 +08:00

9366c2e065

Microwavenby dns hostinger (#6843 )

* [Microwavenby--dns_hostinger] Adding initial dns support for Hostinger.com

* [Microwavenby--dns_hostinger] Creating a commit now that workflows are enabled

* [Microwavenby--dns_hostinger] Correcting shellcheck. Why is this not automatic?

* [Microwavenby-dns-hostinger] Responding to comments from Neil

* [dns-hostinger] SHfmt and Shellcheck

* [dns-hostinger] Writing non-greedy-ish regexes. correcting copypasta

Sasha Reid

2026-07-11 10:04:49 +08:00

2e4acba105

Fix name.com DNS API for processing IDNs (#4381 )

Mike Lei

2026-07-10 21:56:54 +08:00

fef90e15e1

dns_ispconfig.sh client_id not numeric at ispconfig v 3.2.7p1 (#4999 )

Getting client_id failed due to incorrect extraction!

At least in version 3.2.7p1 and probably later the plugin is not working any more properly. The result of ```curResult="$(_post "${curData}" "${ISPC_Api}?client_get_id")"``` is something like this ```Result of _ISPC_ClientGetID: '[Tue Jan 23 11:44:57 CET 2024] Retrying post 
{"code":"ok","message":"","response":3}[Tue Jan 23 11:44:57 CET 2024] _hcode 0'```. The parsing code does not work properly and leaves a non numeric value such as ```Client ID: '3[Tue Jan 23 11'```.

CV

2026-07-10 20:55:23 +08:00

ebde8345ae

dns_njalla.sh: accept string record ids when removing records

The Njalla API returns record ids as JSON strings now; the numeric-only
pattern matched nothing, so the removal never found the record id.
Match both quoted and bare ids.

from https://github.com/acmesh-official/acme.sh/pull/5121

neil

2026-07-10 20:47:31 +08:00

58cd667d65

2024-12-24 - Ensure that $PDNS_Url has no trailing slash ('/'). (#6171 )

Andrew V.

2026-07-10 20:36:42 +08:00

98c30912fb

dns_pleskxml.sh: use grep -F when matching interpolated values

fulldomain/txtvalue/root_domain_name were interpolated into grep
regex patterns; match them as fixed strings instead.

from https://github.com/acmesh-official/acme.sh/pull/7031

neil

2026-07-10 12:05:28 +08:00

fa763db105

dns_me.sh: use LC_ALL=C so the request date header is always English

LC_ALL in the environment overrides both LC_TIME and LANG, so LANG=C
alone still produced localized day/month names on non-English systems
and DNS Made Easy rejected the request date header. An LC_ALL=C
command prefix beats every locale variable (same pattern as
dns_oci.sh).

Fixes #4272. Closes #4271. Thanks to @Nickinthebox.

neil

2026-07-10 11:20:08 +08:00

534a1714dc

dns_freedns.sh: use grep -E, BRE \| alternation is a GNU extension

OpenBSD grep treats \| in a BRE as a literal | character, so
_freedns_domain_id never matched any row and every domain lookup
failed with "Domain not found". Switch to ERE with -E, keeping the
parens escaped so the (.*) suffix branch still requires literal
parentheses and does not widen the match (e.g. searching example.com
must not match example.company).

Reported-by: @katiekloss @boretom
Ref: https://github.com/acmesh-official/acme.sh/issues/2305

neil

2026-07-10 10:23:59 +08:00

bed15ba844

Add creoline API as DNS provider (#7100 )

* New Banner

Updated README to include responsive images for dark and light modes.

* acme-sh-creoline-as-dns-provider

* acme-sh-creoline-as-dns-provider - Review changes implemented according code review

* acme-sh-creoline-as-dns-provider - Review changes implemented according second code review, minding --cron

* acme-sh-creoline-as-dns-provider - Remove debug code

* acme-sh-creoline-as-dns-provider - shfmt formatting according Code of conduct

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: ZeroSSL-Andreas <andreas.schuster@hidglobal.com>
Co-authored-by: Steven Kauschke <s.kauschke@creoline.com>

2026-07-10 10:07:12 +08:00

cf3eab95ee

Merge pull request #7026 from Marvo2011/dev

Update SelfHost DNS provider

Marvo2011

2026-07-06 21:30:13 +08:00

b1b539695f

Add LaoDC DNS API (dns_laodc) (#6974 )

* Added LaoDC API Module

* Cleaned up debug and info
revised get subdomain to filter by TXT records.

* Added commet to _get_root

* Removed PATCH logic of updating acme records as this doesn't work for wildcard DNS.

Revised rm() function to do explicit record matching.

* Revised _get_root() to handle different scenarios.

Fixed _laodc_api() function to check if query failed to run.
added basic json sanitation to handle \ and " in $value
unset _H2 _H3 after call as per request from copilot.

* fixed indentation of case statement block

* fixed condition checking.

_get_root should start at 1 so full fqdn can be tested
$? was being reference after export command failing response checks
removed export txtvalue
fixed docs link and issues link

* Verify key for both add and rm

* fixed dns alias condition check
validate key returns 1 if failed.

---------

Co-authored-by: neil <github@neilpang.com>
Co-authored-by: LaoDC <git@laodc.com>

2026-07-05 23:30:26 +08:00

8f3c1701f3

dnsapi/dns_edgedns: use the system clock for the request timestamp (#3973 )

neil

2026-07-05 18:02:34 +08:00

d3af3315da