Delegated DNS-01 (dashboard)¶
Let CertIntel answer the ACME dns-01 challenge for a hostname you control,
without giving your ACME client write access to your real DNS zone. You create a
record, add one CNAME, and point your ACME client's update credential at it -
CertIntel's authoritative DNS service answers the challenge from then on.
This page covers creating and managing a delegation record from the dashboard. For
using it in a native CertIntel Windows Agent workflow, see
Delegated DNS-01 in the Windows Agent. Other ACME clients can
use the native API (PUT /api/v1/dns-delegations/{id}/txt) or the built-in
acme-dns-compatible shim; the DNS setup below is the same. The current Windows
Agent does not expose its provider as a general-purpose validation script hook.
Creating a record¶
On Delegated DNS-01 → New delegation record, enter the domain name you
want validated (e.g. shop.example.com) and pick a child organization. CertIntel
generates a random subdomain under its own zone and a one-time update secret, then
shows you the exact DNS record to add:
Copy buttons are provided for both the record name and the value, so you can paste them straight into your DNS provider without retyping.
One record covers both the base domain and its wildcard - shop.example.com
and *.shop.example.com both resolve the ACME challenge from the same
_acme-challenge.shop.example.com name, so you never need a second CNAME for the
wildcard.
Cloudflare users
Set this record to DNS only (grey cloud), not proxied. A proxied (orange cloud) record answers Cloudflare's own IP, not the CNAME target, and the ACME challenge will never resolve.
Pointing your ACME client at it¶
CertIntel speaks the acme-dns protocol, so most ACME clients with an acme-dns
plugin (cert-manager, lego, acme.sh, certbot-dns-acmedns, and others) work directly:
| Setting | Value |
|---|---|
| server / base URL | your deployment's DNS update base URL |
| username | the delegation record's id |
| password | the update secret (shown once at creation) |
| subdomain | the generated subdomain |
| fulldomain | the full CNAME target shown above |
Or use the native API directly:
curl -X PUT https://<update-base>/api/v1/dns-delegations/<id>/txt \
-H "X-Api-Key: <secret>" \
-H "Content-Type: application/json" \
-d '{"values": ["<acme-challenge-value>"]}'
Up to two TXT values are kept live at once on the same name, so an apex + wildcard pair validating in the same run doesn't clobber either value.
Managing a record¶
- Rotate secret issues a new update secret; the old one stops working immediately. The record's id, subdomain, and CNAME target don't change, so you don't need to touch DNS again.
- Revoke stops the record answering (and stops accepting new TXT updates) without deleting it; Reactivate brings it back.
- Delete removes the record permanently.
Native Windows Agent workflows store the delegation's scoped update secret in the local protected secret store. Use Manage workflow → DNS delegations to test or replace it after a dashboard rotation.
Rotating or revoking the update secret never affects the CNAME your DNS zone already publishes - only the credential used to update the TXT value changes.