DNS providers - TigerTrust

TigerTrust connects to 12 DNS providers so it can create and remove the TXT records required to complete ACME DNS-01 challenges. DNS-01 is the recommended challenge type for wildcard certificates, hosts without a public HTTP endpoint, and air-gapped environments. The same DNS integration is used for CNAME automation and record drift detection.

Supported providers

Provider	Required credentials
Cloudflare	API token (scoped) or API key + email
AWS Route 53	Access key ID and secret access key
Azure DNS	Subscription ID, tenant ID, client ID, client secret, resource group
Google Cloud DNS	Project ID and service account JSON key
DigitalOcean	API token
Linode	API token
Vultr	API key
Hetzner DNS	API token
DNSimple	Account ID and access token
GoDaddy	API key and secret
Namecheap	API user, API key, and whitelisted client IP
NS1	API key

Credential setup

Create an API token at My Profile > API Tokens > Create Token using the “Edit zone DNS” template. Scope it to the specific zones you want TigerTrust to manage. Prefer scoped API tokens over the global API key.

Create an IAM user with this policy (you can reuse the credentials from the AWS integration):

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "route53:ListHostedZones",
      "route53:GetHostedZone",
      "route53:ListResourceRecordSets",
      "route53:ChangeResourceRecordSets"
    ],
    "Resource": "*"
  }]
}

Create a service principal (see Azure integration), then grant DNS Zone Contributor on the target zone or resource group:

az role assignment create \
  --assignee $APP_ID \
  --role "DNS Zone Contributor" \
  --scope "/subscriptions/$SUB_ID/resourceGroups/$RG"

Use the same service account as your GCP integration, adding the DNS admin role:

gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:$SA" \
  --role="roles/dns.admin"

Namecheap requires API access enabled on your account and the TigerTrust server IP whitelisted at ap.www.namecheap.com/settings/tools/apiaccess. Set clientIp to the server’s public IP when configuring the integration.

Add a provider

Go to Integrations > DNS Providers > Add. Select the provider type, enter a name for the integration, and fill in the credentials for your provider. TigerTrust immediately tests the connection and confirms that zone listing succeeds before saving.

How DNS-01 challenges work

When TigerTrust issues a certificate via ACME and selects the DNS-01 challenge:

Receive the challenge token

The ACME server returns a DNS-01 challenge token for each domain in the certificate request.

Find the authoritative zone

TigerTrust queries the configured DNS provider for the zone that contains the domain. For sub.example.com, it finds example.com.

Create the TXT record

TigerTrust creates _acme-challenge.sub.example.com as a TXT record containing the base64url-encoded SHA-256 of the key authorization.

Wait for propagation

TigerTrust waits up to 5 minutes for DNS propagation, then notifies the ACME server to validate the challenge.

Clean up

After validation succeeds or fails, TigerTrust deletes the TXT record. Orphaned _acme-challenge records are swept on a nightly schedule.

A single certificate request containing multiple domain names (SANs) will create one TXT record per domain. All challenges are created before validation begins, so propagation happens in parallel.

ACME issuance

Configure ACME accounts and select DNS-01 as the challenge type.

Certificate templates

Pin domain rules and challenge types per template.

AWS integration

Reuse Route 53 credentials for ACM discovery.

Cloud discovery

Find existing DNS-validated certificates across your accounts.

​Supported providers

​Credential setup

​Add a provider

​How DNS-01 challenges work

​Related

ACME issuance

Certificate templates

AWS integration

Cloud discovery

Supported providers

Credential setup

Add a provider

How DNS-01 challenges work

Related