NeverLapse DNS

NeverLapse DNS lets NeverLapse get certificates for your domain no matter who runs your DNS, without ever signing in to it. You add one record at your DNS host, one time. After that, every certificate and every renewal for the domain runs on its own. It comes with NeverLapse Cert (1.6.0 or newer; the setup window described below is in 1.8.0). In the DNS provider list it's under Other. New certificates start on the DNS provider you set up in Get started; if you haven't set one up, on NeverLapse DNS.

What you do (one time, about 5 minutes)

In NeverLapse, add a certificate and pick NeverLapse DNS as the DNS provider. Best: make it for example.com with *.example.com as the other name (your domain instead of example.com). That one certificate covers www, mail, vpn and every other name in the domain, and needs only one record. Click Save and issue.

A window opens with the record to add:

Type	`CNAME` (some DNS hosts call it "Alias")
Name / Host	`_acme-challenge` (for www.example.com: `_acme-challenge.www`)
Value / Points to / Target	a long name ending in `.acme.neverlapse.live`; copy it from the page
TTL	leave the default

Each value has a copy button. If someone else (your IT provider, web designer) manages your DNS, click Copy as a message and send it to them.

Sign in to your DNS host (the company that runs your domain's DNS, usually where you bought the domain) and add the record. Instructions for the common ones are below.
Back in NeverLapse, click I've added it in the window. NeverLapse checks for it and issues the certificate as soon as it shows. A new record can take a few minutes to show (now and then up to an hour). Closed the window? Click Add DNS records on the certificate to open it again.
That's it. Leave the record in place: renewals use it every couple of months, and any later certificate for the same domain uses it too.

Why a record? Before a certificate authority (like Let's Encrypt) issues a certificate, it checks that you control the domain by looking for a special DNS entry. The record you add says "for these checks, ask NeverLapse DNS". NeverLapse then answers every check by itself, and nothing else about your DNS, website or email changes.

Adding the record at common DNS hosts

Menus move around from time to time; look for DNS, Manage DNS, Advanced DNS or DNS records. Most DNS hosts add your domain to the name by themselves, so type only _acme-challenge in the Name box.

GoDaddy: My Products > your domain > DNS > Add New Record. Type CNAME, Name _acme-challenge, Value = the value from NeverLapse, TTL default. Save.
Cloudflare: your domain > DNS > Records > Add record. Type CNAME, Name _acme-challenge, Target = the value from NeverLapse. Set Proxy status to DNS only (grey cloud). Save.
Namecheap: Domain List > Manage > Advanced DNS > Add new record. Type CNAME Record, Host _acme-challenge, Value = the value from NeverLapse. Click the check mark to save.
Microsoft Azure DNS: your DNS zone > + Record set. Name _acme-challenge, Type CNAME, Alias = the value from NeverLapse. OK.
Windows DNS server (your own): DNS Manager > Forward Lookup Zones > your domain > right-click > New Alias (CNAME). Alias name _acme-challenge, "Fully qualified domain name for target host" = the value from NeverLapse. OK. If you have both internal and public DNS for the domain, add it to the public one.
Anyone else (Network Solutions, IONOS, Squarespace, your IT provider, ...): same idea, a CNAME record with the Name and Value from NeverLapse. Not sure? Send them the text from Copy as a message.

If the DNS check doesn't find it

You just added it: give it a few minutes (now and then up to an hour) and check again.
"your DNS host added example.com a second time": you typed the full name and the DNS host added the domain again (it became _acme-challenge.example.com.example.com). Edit the record and put only _acme-challenge in the Name box.
"its value is ... instead of ...": the record is there but points somewhere else (a typo, or an old record). Edit it and paste the value again with the copy button.
"has a TXT record, not the CNAME": an older TXT record with the same name is in the way (for example from Manual DNS). Delete that TXT record, then add the CNAME.
Added at the wrong place: the record must go where your domain's DNS actually lives. If your DNS moved to another company (for example to Cloudflare), add it there, not where you bought the domain.

How many records do I need?

One per domain, if the certificate is for the domain and its wildcard (example.com + *.example.com). That's the easy way, and it covers every name one level under the domain. A certificate that lists names one by one needs one record per name:

Names on the certificate	Records to add
`example.com`, `*.example.com`	1
`example.com`, `www.example.com`	2
`www.example.com`, `mail.example.com`, `vpn.example.com`	3
`example.com`, `.example.com`, `.app.example.com`	2 (a wildcard covers one level only)

The certificate page counts the records as you type the names and, when names could be folded into the wildcard, offers a one-click Use example.com + *.example.com (NeverLapse Cert 1.6.1 or newer). Once the record is in place, every later certificate for the same domain needs nothing new at your DNS host.

For IT staff: the details

How it works

To prove you own www.example.com, the certificate authority looks up _acme-challenge.www.example.com. With NeverLapse DNS that name is a CNAME pointing into acme.neverlapse.live, where NeverLapse puts the challenge value. The certificate authority follows the CNAME and finds it. Your own DNS isn't touched again.

One CNAME per _acme-challenge name. example.com and *.example.com share one record (_acme-challenge.example.com); www.example.com would need its own, which is why a whole-domain certificate is the easy way (see above). The names of one certificate may be in different zones.
Two independent name servers. Every challenge goes to both; one is enough, so one being down doesn't stop an issue or renewal.
Included with your license. NeverLapse gets the account(s) from the license server with your license key. It works while your license works.
The challenge values live in NeverLapse DNS and are replaced on the next challenge by themselves; there is nothing to clean up at your DNS host.

Setting it up

Enter your license key (Settings > License).
Add a certificate and pick DNS provider NeverLapse DNS. Best: name it example.com with *.example.com as the other name (one CNAME for the whole domain). Save.
The certificate shows the CNAME record(s) to add, with copy buttons; as a zone-file line:
```
_acme-challenge.www.example.com.   CNAME   3294b4d9-8fb1-40db-aadb-b4ad4ffa63b9.acme.neverlapse.live.
```
Add them at your DNS host. If that name already has a TXT record (from Manual DNS), delete it first: a name can't have a CNAME and other records.
Click I've added it in the window; NeverLapse checks for it and issues. Renewals run on their own from here. Keep the CNAME in place; renewals use it.

Want to try it first? On Get started, pick NeverLapse DNS and click Test connection and save: NeverLapse sends a test value to both name servers, looks it up, and shows the CNAME for your domain.

Renewals and changes

Renewals need nothing from you as long as the CNAME stays. If it disappears, the renewal stops before asking the certificate authority and the certificate shows Waiting for you; Add DNS records shows the record to add back.
Several certificates with the same name share that name's account and CNAME.
Removing a name from a certificate, or the certificate itself, frees its account; you can then delete the CNAME.
If the license ends, existing names keep working for the 30 days renewals keep working; new names can't be added.

What the NeverLapse server must reach

Outgoing HTTPS (TCP 443) to dns1.neverlapse.live and dns2.neverlapse.live (the challenge updates) and to neverlapse.live (the license server). The record check uses DNS (port 53) like every other provider.

Your own acme-dns instead

Prefer to run it yourself? Pick DNS provider acme-dns (my own acme-dns server); see acme-dns. The rest is the same: one CNAME per domain (domain + wildcard), then I've added it and NeverLapse issues. LiveIT can give you the server package NeverLapse DNS itself runs on; ask support.

Troubleshooting

"CNAME record needed": the CNAME isn't there yet, points elsewhere, or a TXT record sits at that name. The window says which, in plain words. A new record can take a few minutes to show.
"NeverLapse DNS comes with your license": enter the license key under Settings > License.
The CNAME is there but NeverLapse doesn't see it: if the NeverLapse server can't reach your DNS host's name servers on port 53, set public resolvers under Settings > DNS propagation servers.