DNS automation
Automate DNS-01 validation without hand-copying TXT records.
DNS-01 is a TXT record at _acme-challenge. Manual mode always returns the name and value on the order. Cloudflare automation can create that record, wait for ACME, and delete only what it created.
What the REST API accepts
POST /api/v1/integrations/dns allows provider manual or cloudflare. That is the customer-ready enum. Cloudflare uses the encrypted API token you store. The service looks up the zone by name, POSTs a TXT (TTL 120), marks the challenge presented, and later DELETEs TXT records at that name.
Wildcards
Required. wildcard_requires_dns if you try HTTP-01. Publish at _acme-challenge for the wildcard’s registrable domain. A leftover TXT next to a delegation CNAME is a leading renewal failure for SaaS hostnames.
Propagation and cleanup
Configured deadline default is 30 minutes. Public resolvers used in lookups include 1.1.1.1 and 8.8.8.8. Cleanup is scoped to the challenge record name. We do not host DNS and we do not rewrite MX.
Other vendors
Route 53, Azure DNS, Cloud DNS, Hetzner and DigitalOcean appear in the integrations directory. Do not POST those strings to /integrations/dns. Until they join the enum, they are connectable integrations with their own setup — not the Cloudflare present/cleanup path.
Related Solutions and Integrations
Solutions this product surface is built for:
Customer-facing integrations to open next:
Questions people actually ask
Which DNS provider is automated on the REST API?
Cloudflare, plus manual. POST /api/v1/integrations/dns only accepts those two provider values today.
Do you create and delete TXT records?
Yes for Cloudflare: upsert the ACME TXT, mark the challenge presented, and later delete TXT records at that name. Cleanup is scoped to records the platform created for the challenge.
How do wildcards work?
They require DNS-01. Publish TXT at _acme-challenge for the wildcard’s apex. HTTP-01 is rejected.
Do you host DNS?
No. You bring a token for a zone you already operate.
What about Route 53 or Azure DNS?
They appear in the integrations directory. They are not in the REST provider enum. Do not write clients that POST provider=route53 to /integrations/dns.
How long do you wait for propagation?
Configured deadline default is 30 minutes, with public resolvers 1.1.1.1 and 8.8.8.8. Manual operators should still check authoritative nameservers.
Can leftover TXT break renewal?
Yes. Conflicting _acme-challenge records are a leading custom-hostname failure. Cleanup after validation exists so the next order does not inherit garbage — when Cloudflare automation ran.
Stop pasting TXT records every <?php echo e($renewBeforeDays); ?> days.
Store a scoped Cloudflare token or keep manual mode and show the order’s record_name / record_value in your UI.