DNS-01 is an ACME challenge that proves control of a DNS name by using a TXT record. The certificate authority does not need to connect to the web server. This makes DNS-01 suitable for servers in private networks and for wildcard certificates.

For every name in a certificate request, the ACME client creates a temporary TXT record below _acme-challenge. The certificate authority looks up the record in public DNS. If the value is correct, the name is validated and the certificate can be issued.

For example, a challenge for app.example.com uses:

dig TXT _acme-challenge.app.example.com

The exact value is generated by the ACME client. Do not reuse a value from an earlier order.

Most ACME clients support DNS provider modules. The client uses an API credential to create the TXT record, waits for DNS propagation, completes the challenge and removes the record again. The same client can repeat this process during renewal.

Every DNS provider has its own API, authentication method and record-management rules. Select the module for your provider in the documentation of the ACME client. The External ACME clients page contains a provider-neutral setup example.

Use a credential that can change only the required DNS zone. Do not use the main account password when the provider offers a restricted token.

If your DNS provider has no suitable API, delegate only the ACME challenge name to a DNS service that can be automated. Depending on the provider, this uses a CNAME or NS record for _acme-challenge.

This keeps the main DNS zone at the existing provider while the ACME client updates a separate challenge zone. Follow the delegation instructions of both DNS providers and verify the result with dig before requesting a certificate.

A manual challenge displays the TXT name and value. You add the record at the DNS provider, wait for propagation and then continue the certificate request.

Manual DNS-01 is useful for an initial test or for a rarely renewed certificate. It is not suitable for unattended renewal because every renewal creates a new value and requires another DNS change.

Before using DNS-01, check the following:

• The domain is publicly delegated and authoritative DNS servers answer for it.
• The DNS provider allows TXT records at the required name.
• CAA records allow the selected certificate authority when CAA is used.
• DNS changes become visible within the time allowed by the ACME client.
• API credentials are stored outside public scripts and configuration examples.

Note: A public DNS name is required for public certificate validation. The web server can still resolve to a private address through split DNS and can remain unreachable from the Internet.

Private HTTPS explains the split-DNS pattern. DNS-PERSIST-01 beta describes a separate experimental approach that can avoid repeated DNS changes when the selected ACME client and staging CA support it.

Useful standards and provider references are available in the Let's Encrypt challenge documentation, the ACME specification and the acme.sh DNS API list.