DNS-01 Providers

Supported providersCopy Anchor Link

Generated from the bundled provider registry with shadowtree gen-autocert-providers.

pseudo is internal and is not offered in the picker. Only the bundled DNS providers above are supported; lego's full catalogue includes providers that GoDoxy does not bundle.

Configure a providerCopy Anchor Link

Choose a provider ID from the table above. AWS Route 53 (route53) is not bundled, and googledomains was removed in lego v5. rfc2136 is an alias for dnsupdate.

Set the account email and certificate domains alongside the provider and its options in config/config.yml. Option keys match the selected lego provider's Config fields in snake_case, not its environment variable names. For example, Spaceship's APIKey field is api_key, not SPACESHIP_API_KEY.

In the WebUI, the main and extra certificates use the same schema-generated provider picker. Selecting any bundled DNS provider shows its concrete option fields, including nested sections and lists. These fields come from the provider's config type in the lego version bundled with GoDoxy. Use the configuration references above to find the credentials your provider requires, then use the matching Config field names for YAML options.

Options can be strings, booleans, numbers, arrays (such as acmedns allow_list), or nested objects (such as OVH oauth2_config). Duration fields use Go duration strings, for example 30s or 1m30s. Named maps are supported only where the provider defines them, such as Azure's environment.services, whose entries have audience and endpoint fields. HTTP transports and SDK credential objects are excluded from editable options. Option values are redacted when GoDoxy serializes configuration to JSON or YAML; protect the original configuration file containing your credentials.

CloudflareCopy Anchor Link

autocert:
  provider: cloudflare
  options:
    auth_token:

auth_token your zone API token

Follow this guide from LEGO to create a new token with required permissions

CloudDNSCopy Anchor Link

autocert:
  provider: clouddns
  options:
    client_id:
    email:
    password:

deSECCopy Anchor Link

autocert:
  provider: desec
  options:
    token:

token is your deSEC API token. See LEGO deSEC DNS documentation.

DuckDNSCopy Anchor Link

autocert:
  provider: duckdns
  options:
    token:

Tested by earvingad

OVHCloudCopy Anchor Link

autocert:
  provider: ovh
  options:
    api_endpoint:
    application_key:
    application_secret:
    consumer_key:
    ttl: 120
    propagation_timeout: 1m30s

Alternatively, configure OAuth2 credentials as a nested object:

autocert:
  provider: ovh
  options:
    api_endpoint:
    oauth2_config:
      client_id:
      client_secret:

Note, application_key and oauth2_config CANNOT be used together

• api_endpoint: Endpoint URL, or one of
  • ovh-eu,
  • ovh-ca,
  • ovh-us,
  • kimsufi-eu,
  • kimsufi-ca,
  • soyoustart-eu,
  • soyoustart-ca
• application_secret
• application_key
• consumer_key
• oauth2_config: Client ID and Client Secret
  • client_id
  • client_secret

PorkbunCopy Anchor Link

autocert:
  provider: porkbun
  options:
    api_key:
    secret_api_key:

SpaceshipCopy Anchor Link

Set SPACESHIP_API_KEY and SPACESHIP_API_SECRET in GoDoxy's environment and reference them in the provider options. This keeps the credential values out of the YAML file.

autocert:
  provider: spaceship
  email: admin@example.com
  domains:
    - example.com
    - "*.example.com"
  options:
    api_key: ${SPACESHIP_API_KEY}
    api_secret: ${SPACESHIP_API_SECRET}

See Lego's Spaceship DNS documentation for the provider's credentials and settings.

Custom ACME CACopy Anchor Link

See Autocert with a Custom Internal CA for more details.

Other bundled providersCopy Anchor Link

Use the table above as the supported list. Lego's full catalogue also contains providers that GoDoxy does not bundle. If a bundled provider fails with the matching configuration fields and credentials, submit an issue with the provider ID and error, without credentials.

Provider credentials and optionsCopy Anchor Link

Options depend on the provider. GoDoxy uses the provider's default config when options is omitted; supply the fields it needs otherwise. YAML values can reference GoDoxy environment variables with ${VAR}. The CloudDNS example below shows credentials set in .env and referenced from YAML options.

CloudDNS as an example (from LEGO DNS documentation)

Option 1Copy Anchor Link

Set these in .env

CLOUDDNS_CLIENT_ID=bLsdFAks23429841238feb177a572aX
CLOUDDNS_EMAIL=you@example.com
CLOUDDNS_PASSWORD=b9841238feb177a84330f

Reference them from config.yml:

autocert:
  ...
  provider: clouddns
  options:
    client_id: ${CLOUDDNS_CLIENT_ID}
    email: ${CLOUDDNS_EMAIL}
    password: ${CLOUDDNS_PASSWORD}

Option 2Copy Anchor Link

Set these in config.yml autocert.options section

Turn them into:

autocert:
  provider: clouddns
  email: admin@example.com
  domains:
    - example.com
  options:
    client_id: your-client-id
    email: your-dns-account@example.com
    password: your-dns-password