Skip to content

Delegated DNS-01 (dashboard)

Let CertIntel answer the ACME dns-01 challenge for a hostname you control, without giving your ACME client write access to your real DNS zone. You create a record, add one CNAME, and point your ACME client's update credential at it - CertIntel's authoritative DNS service answers the challenge from then on.

This page covers creating and managing a delegation record from the dashboard. For using it in a native CertIntel Windows Agent workflow, see Delegated DNS-01 in the Windows Agent. Other ACME clients can use the native API (PUT /api/v1/dns-delegations/{id}/txt) or the built-in acme-dns-compatible shim; the DNS setup below is the same. The current Windows Agent does not expose its provider as a general-purpose validation script hook.

Creating a record

On Delegated DNS-01 → New delegation record, enter the domain name you want validated (e.g. shop.example.com) and pick a child organization. CertIntel generates a random subdomain under its own zone and a one-time update secret, then shows you the exact DNS record to add:

_acme-challenge.shop.example.com.  CNAME  <random-subdomain>.acme.certin.tel.

Copy buttons are provided for both the record name and the value, so you can paste them straight into your DNS provider without retyping.

One record covers both the base domain and its wildcard - shop.example.com and *.shop.example.com both resolve the ACME challenge from the same _acme-challenge.shop.example.com name, so you never need a second CNAME for the wildcard.

Cloudflare users

Set this record to DNS only (grey cloud), not proxied. A proxied (orange cloud) record answers Cloudflare's own IP, not the CNAME target, and the ACME challenge will never resolve.

Pointing your ACME client at it

CertIntel speaks the acme-dns protocol, so most ACME clients with an acme-dns plugin (cert-manager, lego, acme.sh, certbot-dns-acmedns, and others) work directly:

Setting Value
server / base URL your deployment's DNS update base URL
username the delegation record's id
password the update secret (shown once at creation)
subdomain the generated subdomain
fulldomain the full CNAME target shown above

Or use the native API directly:

curl -X PUT https://<update-base>/api/v1/dns-delegations/<id>/txt \
  -H "X-Api-Key: <secret>" \
  -H "Content-Type: application/json" \
  -d '{"values": ["<acme-challenge-value>"]}'

Up to two TXT values are kept live at once on the same name, so an apex + wildcard pair validating in the same run doesn't clobber either value.

Managing a record

  • Rotate secret issues a new update secret; the old one stops working immediately. The record's id, subdomain, and CNAME target don't change, so you don't need to touch DNS again.
  • Revoke stops the record answering (and stops accepting new TXT updates) without deleting it; Reactivate brings it back.
  • Delete removes the record permanently.

Native Windows Agent workflows store the delegation's scoped update secret in the local protected secret store. Use Manage workflow → DNS delegations to test or replace it after a dashboard rotation.

Rotating or revoking the update secret never affects the CNAME your DNS zone already publishes - only the credential used to update the TXT value changes.