Let's Encrypt without a DNS-provider API: one CNAME is enough

Not every DNS account offers a usable API, and not every ACME client supports every provider. You should not need to move a working website and mail zone just to automate a certificate challenge. SimpleACME lets you keep that zone and delegate the changing validation record instead.

The distinction matters: you still need permission to make one DNS change. You do not need continuing API access to the rest of the zone. After setup, your ACME client sends the TXT authorization value to SimpleACME's authenticated HTTPS endpoint.

What stays with your provider

Your website A or AAAA records, mail routing and ordinary subdomains remain where they are. You are not changing authoritative nameservers for your own domain. The delegated name is the challenge record used for validation, such as _acme-challenge.app.example.com for app.example.com.

The account shows the exact target. Do not invent a target or copy another account's UUID. A record like YOUR_SUBDOMAIN.simpleacme.com in a guide is a placeholder, not a usable shared endpoint.

Set up the delegation

1. Create a SimpleACME account and choose the hostname you intend to validate.
2. Choose paid single-domain or wildcard coverage, or prepare one single-domain demo.
3. Add the supplied CNAME in the DNS zone that controls the challenge name.
4. Check the CNAME from the account and configure your ACME client with the issued credentials.
5. Enable paid access before trying TXT updates and run a staging validation.

A paid registration is created after accepted payment. The demo creates setup credentials but deliberately rejects updates. This makes it possible to review the DNS work before activating service, without confusing a prepared domain with a working renewal.

Use existing credentials in the client

SimpleACME does not expose anonymous registration. A client that assumes it can call an open /register endpoint must instead be configured with the registration from your account. For Traefik's ACME-DNS provider, that means populating its account storage. A custom hook uses X-Api-User, X-Api-Key, and the assigned subdomain when posting the challenge value.

Keep those credentials private. They are narrower than a full-zone token, but they still authorize changes to a certificate-validation record. Protect their files and limit who can run the renewal job.

One setup, repeated renewals

The CNAME remains in place when the TXT value changes. Your renewal job must continue running, and the public DNS chain must stay valid. SimpleACME removes provider-specific update work; it does not remove the need to monitor renewal and deployment.

If your provider already has an excellent scoped API and supported client, its native workflow remains an option. If that integration is the obstacle, [SimpleACME's delegated workflow](/) is designed to make the same DNS-01 validation easier.