Oct 11, 2026, 6:41 PM@thedarktangent @brnrd @adamshostack @xabean For this problem space, I've personally CNAME'd the _acme-challenge FQDNs to a consolidated zone, running on a standalone PowerDNS server, and the ACME hook scripts create/delete the TXT records in that database. This supports wildcard certificates, too, FWIW.
Anecdotally, that ACME-validation-only DNS server doesn't even need an IPv4 address.
Oct 11, 2026, 6:48 PM(footnote for anyone wondering why not needing an IPv4 address is a good thing: public-facing DNS servers generally need their own public IP, and IPv4 addresses are a scarce resource, so not needing one for a niche, infrequently-needed utility service is beneficial)
Oct 11, 2026, 8:01 PM@jima @thedarktangent @adamshostack @xabean I know about this ACME feature but haven't had to use it yet.
Using CNAMEs allows for very granular permissions for users if you sub-divide the CNAME targets into sub-domains that a specific user gets to add the TXT records to
Oct 11, 2026, 8:08 PM@brnrd @thedarktangent @adamshostack @xabean Oooh I hadn't even THOUGHT ABOUT the RBAC potential of this! 🫢