Connect your DNS provider

NeverLapse proves you own a domain by adding a temporary TXT record to its DNS. It needs permission to do that, once per DNS provider account.

Which provider do I have?

It's whoever hosts your domain's DNS, which isn't always where you bought the domain. Look up its name servers:

nslookup -type=NS example.com
  • *.ns.cloudflare.com: Cloudflare
  • ns*.domaincontrol.com: GoDaddy
  • *.azure-dns.com / .net / .org / .info: Azure DNS
  • ns-*.awsdns-*: Amazon Route 53
  • ns-cloud-*.googledomains.com: Google Cloud DNS
  • dns*.registrar-servers.com: Namecheap
  • ns*.ui-dns.*: IONOS
  • ns*.digitalocean.com: DigitalOcean
  • ns*.dnsmadeeasy.com: DNS Made Easy
  • ns*.dnsimple.com / dnsimple-edge.*: DNSimple
  • ns*.name.com: Name.com
  • Your hosting company's name servers, and you manage DNS in cPanel: cPanel
  • Your own servers: BIND (Linux) or Windows DNS (usually your domain controllers; NeverLapse on Windows only)
  • Anything else, or a DNS host you can't give NeverLapse access to: NeverLapse DNS, included with your license (one record, added once; renewals need nobody), your own acme-dns server, or Manual DNS

How validation works

  1. NeverLapse adds a TXT record at _acme-challenge.<your domain>.
  2. It asks your domain's own authoritative name servers until the record is really there (no fixed waiting and hoping).
  3. It asks the certificate authority to check, gets the certificate, and removes the record again.

Because it uses DNS, this works for wildcard certificates and for servers that aren't reachable from the internet. Nothing needs to be open on port 80.

Cloudflare

  1. In Cloudflare, open My Profile > API Tokens and click Create Token.
  2. Use the Edit zone DNS template. Under Zone Resources, pick your domain (or all zones).
  3. Create it and copy the token. Cloudflare shows it only once.
  4. In NeverLapse, paste it in Get started, or when adding a certificate choose Cloudflare and Add new Cloudflare account.

You enter the zone by name (example.com); NeverLapse looks up Cloudflare's internal zone ID itself.

GoDaddy

Want to see the whole thing? The GoDaddy walkthrough goes from the token to an issued Let's Encrypt certificate, with screenshots.

  1. Sign in to GoDaddy's developer site with the account that owns the domain and open the Personal Access Token page.
  2. Click Generate Token. Give it a name, an expiration date, and the scopes domains.dns:update and domains.domain:read (or the whole Domains & DNS group).
  3. Copy the token (shown only once) and paste it into NeverLapse.
GoDaddy tokens expire. Put the date in your calendar: before it, make a new token and update it under Credentials (Edit, paste the new token). Every certificate using that account picks it up.

Azure DNS, Route 53, Google Cloud DNS and the other API providers

They all work the same way. Pick the provider in Get started (or on a certificate's Edit page), follow the Where do I get these? steps under it, enter the keys, and click Test connection: NeverLapse adds and removes a test record called _neverlapse-check, exactly the way it will for every certificate. Everything you enter is stored encrypted on your NeverLapse server; secrets are never shown again. A saved account can be used by any number of certificates: pick it from the list, and fill in a box only to change it.

Give each key the least it needs (the one zone, DNS records only). Rather not give NeverLapse a key to your DNS at all? Use NeverLapse DNS.

Azure DNS

  1. In the Azure portal, open Microsoft Entra ID > App registrations > New registration. Name it (e.g. NeverLapse) and register it. Copy the Application (client) ID and Directory (tenant) ID.
  2. In the app, open Certificates & secrets > New client secret. Copy the secret's Value right away (not the Secret ID; it's shown once).
  3. Open your DNS zone > Access control (IAM) > Add role assignment: role DNS Zone Contributor, member = the app. That gives it this one zone only.
  4. Copy the Subscription ID from the zone's Overview page.
  5. In NeverLapse choose Azure DNS and enter the four values. The resource group is optional: NeverLapse finds the zone itself.

Client secrets expire (at most 2 years): make a new one before then and enter it on a certificate that uses the account. Public zones only.

Amazon Route 53

  1. In the AWS console, open IAM > Users > Create user (no console access).
  2. Attach a policy like the one below, with your hosted zone ID in it.
  3. Open the user's Security credentials > Create access key (use case: Application running outside AWS) and copy both values.
  4. In NeverLapse choose Amazon Route 53 and enter the access key ID and secret access key. The hosted zone ID is optional: NeverLapse finds the public hosted zone by name.
{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": ["route53:ListHostedZonesByName", "route53:GetChange"], "Resource": "*" },
    { "Effect": "Allow", "Action": ["route53:ListResourceRecordSets", "route53:ChangeResourceRecordSets"],
      "Resource": "arn:aws:route53:::hostedzone/YOUR_HOSTED_ZONE_ID" }
  ]
}

After each change NeverLapse waits until Route 53 reports it's on all of its name servers.

Google Cloud DNS

  1. In the Google Cloud console, open IAM & Admin > Service accounts > Create service account.
  2. Give it the role DNS Administrator on the project that holds your zone.
  3. Open it, then Keys > Add key > Create new key > JSON.
  4. In NeverLapse choose Google Cloud DNS and paste the whole downloaded file. The project ID comes from the file. Delete the downloaded file afterwards.

Namecheap

  1. In Namecheap, open Profile > Tools > Namecheap API Access and switch it on (Namecheap only allows this for accounts with some history or balance). Copy the API key.
  2. Under Whitelisted IPs, add the public IP address your NeverLapse server uses to reach the internet.
  3. In NeverLapse choose Namecheap and enter your Namecheap username, the API key and that same IP address.

The domain must use Namecheap's own DNS. Namecheap's API has no "add one record": every change rewrites the domain's whole record list. NeverLapse reads every record first and writes them all back with only its own record added or removed (MX priorities, TTLs and the email setting kept); if the domain has a record type the API can't write back, it leaves the domain alone and says so.

IONOS

  1. Sign in at developer.hosting.ionos.com with your IONOS account and open API Keys.
  2. Create a key. IONOS shows a public prefix and a secret.
  3. In NeverLapse choose IONOS and enter them as one value with a dot in between: prefix.secret.

cPanel

  1. Sign in to cPanel and open Security > Manage API Tokens > Create. Copy the token.
  2. In NeverLapse choose cPanel and enter the address you sign in to cPanel at (e.g. https://server.example.com:2083), your cPanel username and the token.

The address must use https with a valid certificate. Check the domain's name servers really are your hosting company's: if your DNS moved elsewhere (for example to Cloudflare), use that provider instead.

DigitalOcean

  1. In the DigitalOcean control panel, open API > Tokens > Generate New Token.
  2. Pick Custom Scopes, tick domain (create, read, update, delete) and copy the token.
  3. In NeverLapse choose DigitalOcean and paste it. The domain must be under Networking > Domains.

DNS Made Easy

  1. In DNS Made Easy, open Account Information (or Config > Account Settings) > API Credentials.
  2. Copy the API key and the secret key, and enter both in NeverLapse.

Requests are signed with the current time, so the NeverLapse server's clock must be right.

DNSimple

  1. In DNSimple, open your account's Account > Access Tokens > New access token (an account token) and copy it.
  2. In NeverLapse choose DNSimple and paste it. The account ID is optional.

Name.com

  1. In Name.com, open Account > Settings > Security > API Token Management.
  2. Create a production token and copy it. With two-step verification on, also allow API access there.
  3. In NeverLapse choose Name.com and enter your username and the token.

Name.com's shortest record lifetime is 5 minutes, so validation there can take a few minutes longer.

BIND

BIND has no web API, so NeverLapse sends standard signed DNS updates (RFC 2136, the same thing nsupdate does). One-time setup on the BIND server:

  1. Create a TSIG key: 
    tsig-keygen -a hmac-sha256 neverlapse
    Add the printed key "neverlapse" { ... }; block to named.conf.
  2. Let that key change the zone, ideally only TXT records: 
    zone "example.com" {
    ...
    update-policy { grant neverlapse zonesub TXT; };
};
    (or allow-update { key neverlapse; };). Reload BIND.
  3. In NeverLapse enter the BIND server, the key name, the algorithm (must match the key, hmac-sha256 by default) and the base64 secret from the key block.

The NeverLapse server needs to reach the BIND server on port 53.

Windows DNS

Windows DNS needs NeverLapse running on a Windows server. On a Linux or Docker server it isn't offered: use another provider or Manual DNS.

NeverLapse changes the zone on a Microsoft DNS server (usually a domain controller) over WMI. Enter the DNS server's name or IP and the zone, then choose how to connect:

  • NeverLapse's own service account: works when the NeverLapse service runs as a domain account that can manage DNS (for example a member of DnsAdmins). See the service account choice in the installer.
  • This Windows account: a username and password that may change the zone (DnsAdmins, or permissions on that zone). Stored encrypted.

The NeverLapse server needs TCP 135 and the dynamic RPC ports open to the DNS server.

NeverLapse DNS (any DNS host, one record, added once)

Works with any DNS host and needs no access to your DNS: you add one record at your DNS host, one time, and every certificate and renewal for the domain runs on its own. Included with NeverLapse Cert. Step by step: NeverLapse DNS.

acme-dns (your own acme-dns server, one CNAME per domain)

For a DNS host you can't or don't want to give NeverLapse access to. You run an acme-dns server (or two), add one CNAME record per domain at your DNS host, once (domain + wildcard share it; each extra named host needs its own), and NeverLapse answers every challenge on the acme-dns server from then on, renewals included. Your DNS host isn't touched again.

  1. On the certificate's Edit page (or in Get started), pick DNS provider acme-dns (my own acme-dns server) and enter the server's API address. Running more than one? Enter one address per line; every challenge goes to all of them and one answering is enough.
  2. Accounts: if the server has /register switched on, NeverLapse makes the account(s) itself. Otherwise paste the account(s) /register (or your server's account tool) gave you.
  3. Save (or Save and issue). The window shows the CNAME record(s) to add, with copy buttons, for example _acme-challenge.www.example.com CNAME <subdomain>.acme.example.net. example.com and *.example.com share one record; every other name gets its own. The names of one certificate may be in different zones. The Edit page counts the records as you type and offers to switch to example.com + *.example.com (1.6.1 or newer).
  4. Add them at your DNS host. If that name already has a TXT record (from Manual DNS), delete it first: a name can't have a CNAME and other records.
  5. Click I've added it. NeverLapse checks for the record and issues by itself.

Issue now and every renewal check the CNAMEs first. If one is missing or points elsewhere, NeverLapse asks the certificate authority nothing and the certificate shows Waiting for you; Add DNS records shows the record. In Get started, Test connection and save sends a test value to the server(s) and looks it up.

Manual DNS (any DNS host, by hand)

For a DNS host NeverLapse can't connect to: no API, a registrar panel only, or a DNS team that won't hand out keys. You add the record yourself; NeverLapse tells you exactly what to add and checks it before the certificate authority does.

  1. On the certificate's Edit page, pick DNS provider Manual (I add the DNS record myself). Set the zone if the domain is under a two-part ending like .co.uk.
  2. Click Issue now. A window opens: NeverLapse gets the TXT record(s) from the certificate authority and shows them, a name such as _acme-challenge.vpn (full name _acme-challenge.vpn.example.com) and a value, with Copy buttons and Copy as a message for whoever manages your DNS.
  3. At your DNS host, add a TXT record with that name and value, TTL as low as allowed. A wildcard together with its bare name (*.example.com + example.com) shares one name with two values: add two TXT records with that name, one per value.
  4. Click I've added them. NeverLapse looks them up on your domain's own name servers every few seconds and asks the certificate authority only once they all show, so a typo or a slow DNS host costs nothing.
  5. It issues the certificate. Then you can delete the _acme-challenge TXT records (each renewal needs new ones).

The order stays open for about a week; Get new records (bottom left of the window) starts over with new values. Renewals need you too: about 30 days before the certificate expires, the nightly check opens a new order and the certificate shows Waiting for you; click Add DNS records for the new values; with certificate notifications set, you also get an email, repeated nightly until it's done. If the new records are already in place by then, the renewal finishes on its own.

Manual DNS is the fallback. If your DNS host is one of the providers above (Windows DNS only from a NeverLapse server on Windows), use that provider instead, or NeverLapse DNS for any other host: renewals then need nobody.

The connection test

In Get started, Test connection and save has the NeverLapse service add a TXT record named _neverlapse-check to your zone and remove it again, exactly the way issuing does. If it fails, the message says why (wrong token, no permission, zone not found, server unreachable). Save without testing skips the test.

Saved accounts

A token or login you enter is saved once as a named account, encrypted on your server, and offered in a dropdown for every other certificate on the same provider. To change a token later, open Credentials, click Edit next to the account and paste the new one; leaving the field blank keeps the old one. For the API providers above, an account holds several values (for example tenant ID, client ID and secret). Pick a saved account and leave a box empty to keep it, or fill it in to change it for every certificate that uses the account. API DNS accounts can also be added and edited on the Credentials page, with all their fields (NeverLapse Cert 1.8.4 or newer). More in Credentials.

The zone field

The zone is the domain as registered at the DNS provider, such as example.com. It's optional when adding a certificate: blank uses the last two parts of the name. Set it yourself for names like example.co.uk, where the last two parts aren't the zone.

Previous Your license NextNeverLapse DNS (any DNS host)