Feature request: Add deSEC DNS provider support

[Itstommy10]

Feature Request: deSEC DNS Provider

Description

Please add support for deSEC (desec.io) as a DNS-01 provider for autocert.

deSEC is a free, open-source DNS hosting service that is widely used in the self-hosting community,
especially for dynamic DNS domains like *.dedyn.io.

Why

deSEC is supported by LEGO (https://go-acme.github.io/lego/dns/desec/) so the implementation
should be straightforward, similar to other providers already included in internal/dnsproviders/providers.go.

Expected configuration

autocert:
  provider: desec
  email: your@email.com
  domains:
    - "*.yourdomain.dedyn.io"
    - "yourdomain.dedyn.io"
  options:
    auth_token: your-desec-token

References

• LEGO deSEC provider: https://go-acme.github.io/lego/dns/desec/
• deSEC website: https://desec.io

[yusing]

Added, the key should be token

// Environment variables names.
const (
	envNamespace = "DESEC_"

	EnvToken = envNamespace + "TOKEN"

	EnvTTL                = envNamespace + "TTL"
	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
	EnvHTTPTimeout        = envNamespace + "HTTP_TIMEOUT"
)

// https://github.com/desec-io/desec-stack/issues/216
// https://desec.readthedocs.io/_/downloads/en/latest/pdf/
const defaultTTL int = 3600

var _ challenge.ProviderTimeout = (*DNSProvider)(nil)

// Config is used to configure the creation of the DNSProvider.
type Config struct {
	Token              string // <- here
	PropagationTimeout time.Duration
	PollingInterval    time.Duration
	TTL                int
	HTTPClient         *http.Client
}

[yusing]

Let me know if it works, thanks.

[Itstommy10]

ciao @yusing con questa configurazione
autocert: provider: desec email: myemail domains: - *.desec domain - desec domain options: token: token

ottengo
2026-06-08 16:04:37 [INFO] [ desec domain] acme: Cleaning DNS-01 challenge
2026-06-08 16:04:37 ??? [DEBUG] GET https://desec.io/api/v1/domains/?owns_qname=_acme-challenge. desec domain
2026-06-08 16:04:37 ??? [DEBUG] GET https://desec.io/api/v1/domains/tomlab.dedyn.io/rrsets/_acme-challenge/TXT/
2026-06-08 16:04:37 ??? [DEBUG] PATCH https://desec.io/api/v1/domains/tomlab.dedyn.io/rrsets/_acme-challenge/TXT/
2026-06-08 16:04:37 [WARN] [ desec domain] acme: cleaning up failed: desec: failed to update records: domainName= desec domain, recordName=_acme-challenge: 400: body: subname="["Can only be written on create."]"
sto sbagliando qualcosa?

[Itstommy10]

inoltre vedo che quando torno nel config dalla UI nello yaml sparisce opgni volta la voce option con token....

[Itstommy10]

però il rinnovo sembra aver funzionato (la data si è aggiornata)

[yusing]

English please. Also I don't implement the acme registration. This issue should be reported to Lego.

[Itstommy10]

sorry mate,

I'm using the following configuration with deSEC:

autocert:
  provider: desec
  email: myemail
  domains:
    - "*.desec-domain"
    - "desec-domain"
  options:
    token: my_token

However, during the DNS-01 challenge cleanup, I get this error:

2026-06-08 16:04:37 [INFO] [desec-domain] acme: Cleaning DNS-01 challenge
2026-06-08 16:04:37 [DEBUG] GET https://desec.io/api/v1/domains/?owns_qname=_acme-challenge.desec-domain
2026-06-08 16:04:37 [DEBUG] GET https://desec.io/api/v1/domains/tomlab.dedyn.io/rrsets/_acme-challenge/TXT/
2026-06-08 16:04:37 [DEBUG] PATCH https://desec.io/api/v1/domains/tomlab.dedyn.io/rrsets/_acme-challenge/TXT/
2026-06-08 16:04:37 [WARN] [desec-domain] acme: cleaning up failed: desec: failed to update records: domainName=desec-domain, recordName=_acme-challenge: 400: body: subname="["Can only be written on create."]"

Additional observations

1. Every time I go back to the configuration from the UI, the options section (including the token) gets removed from the YAML automatically.

2. Despite the error, the certificate renewal seems to work correctly (the expiration date is updated).

Questions

• Am I misconfiguring something in the deSEC provider?
• Is the cleanup error expected or a known issue with deSEC API handling?
• Is the UI supposed to remove the options.token, or is this a bug?

Thanks!

[yusing]

I think it should be a bug. The WebUI has not been updated yet for this provider and will be updated soon.

[Itstommy10]

thank you

[yusing]

Updated the webui, see if it still removes your autocert config.

[Itstommy10]

Hi, I tried. The new changes work perfectly. Thank you very much for everything and for your availability

[Itstommy10]

Hi @yusing, reopening this because deSEC renewals started failing after upgrading. Working on the image from June, failing on v0.31.0.

Error

dns01: error presenting token (*.tomlab.dedyn.io): desec: failed to update records: domainName=tomlab.dedyn.io, recordName=_acme-challenge: 400: body: {"subname":["Can only be written on create."]}

Same error on cleanup. With two domains sharing _acme-challenge (apex + wildcard) the second Present is a PATCH, so the cert can never be issued.

Root cause

• go.mod in v0.30.0+ pins github.com/nrdcg/desec v0.11.2 // indirect. Tags ≤ v0.29.0 inherited v0.11.1 from lego (lego v4.35.2 and v5.3.1 both still pin v0.11.1).
• In nrdcg/desec v0.11.2 records.go the RRSet struct changed from
  SubName string \json:"subname,omitempty"(v0.11.1) toSubName string json:"subname"`` (v0.11.2).
• lego's desec provider calls Records.Update(..., desec.RRSet{Records: records}) without SubName, so v0.11.2 serializes "subname":"" in the PATCH body and the deSEC API rejects it (subname is create-only).

Fix
Pin github.com/nrdcg/desec v0.11.1 in go.mod (or wait for an upstream fix in nrdcg/desec restoring omitempty).

Config used

yaml

autocert:
  provider: desec
  email: <email>
  domains:
    - "*.tomlab.dedyn.io"
    - tomlab.dedyn.io
  options:
    token: <token>

Thanks!