Hosting & Infrastructure
DNS-01 automation without giving away your DNS account: least-privilege patterns
A token that can rewrite MX is the wrong token for ACME. Scope the write to the challenge name.
sslcertificates.io Editorial · Published 2026-09-21 · Fact-checked 2026-09-21 · Topic window 2026-09-08
DNS-01 needs a TXT at _acme-challenge. It does not need a token that can delete the zone.
Patterns that stay honest:
- Cloudflare: a token limited to Zone.DNS:Edit on one zone.
- Route 53: IAM that can ChangeResourceRecordSets on the hosted zone, not AdministratorAccess.
- Azure DNS: DNS Zone Contributor on one zone, not Owner on the subscription.
- Google Cloud DNS: dns.resourceRecordSets.update on one project.
Cleanup must delete only the record the platform created. Wildcards use the same TXT name as the wildcard’s registrable parent.
On this platform the REST DNS provider enum is manual | cloudflare. Other DNS products may appear in the directory as connect-your-account workflows. That is not the same as a live-verified Route 53 integration in this environment.
Sources
Related
Automate the lifecycle this article describes
Inventory, renewals and verified deployment are product surfaces — not adjectives.