POWERDNS/pdns and ACME/Mailcow

MeZmeriZe1

Hello Folks,

I’m pretty new to mailcow and lets encrypt so I’m still learning the overall structure but as I understand it, mailcow/acme is compatible with my PowerDNS auth server and I thought it was working as SSL was working fine till the 1st of sept and then I started getting errors. I’ve since realised that it’s likely I did it manually the first time in June when I setup mailcow and the default age is 3 months hence the failure.

I am currently running 2026-07b
in mailcow.conf
ACME_DNS_CHALLENGE=y
ACME_DNS_PROVIDER=dns_pdns
ACME_ACCOUNT_EMAIL=franki@gmail.com
PDNS_API_URL=http://192.168.1.149:8081/api/v1/servers/localhost
PDNS_API_KEY=Thisismyapipasswordbutnotreal

(I changed the email address because I don’t want web scrapers getting my email as that one gets too much spam already)
obviously the URL is the internal address of the server API but its accessible to the acme-mailcow I just added the last two as I thought initially that it was picked up via ENV vars
Powerdns is setup and working and the API is enabled and has it’s key set to the same as PDNS_API_KEY above.

Is that all there is too it or am I missing something? my account with letsencrypt was paused from errors but I’ve unpaused it no problem.

The SSL cert is still showing up as follows:
Common Name (CN) YR1
Organisation (O) Let’s Encrypt
Expires On Tuesday, 1 September 2026 at 18:06:06

In the log, all I am seeing is this:
02/09/2026, 09:56:50 mail.littlehosting.com - Failed to obtain certificate /var/lib/acme/autodiscover.littlehosting.com/cert.pem for domains ‘autodiscover.littlehosting.com autoconfig.littlehosting.com’ via DNS challenge

But no explanation as to why it is failing.

if I access the PDNS API with curl setting the header to the API key… it seems to respond fine.
curl -H ‘X-API-Key: Thisismyapipasswordbutnotreal’ http://localhost:8081/api/v1/servers/localhost
{“autoprimaries_url”: “/api/v1/servers/localhost/autoprimaries{/autoprimary}”, “config_url”: “/api/v1/servers/localhost/config{/config_setting}”, “daemon_type”: “authoritative”, “id”: “localhost”, “type”: “Server”, “url”: “/api/v1/servers/localhost”, “version”: “5.0.7”, “zones_url”: “/api/v1/servers/localhost/zones{/zone}”}

Does anyone please have any suggestions to or pointers?

kindest regards

Frank

UPDATE:

went straight to the container log and found this:

acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Loading DNS-01 configuration from /etc/acme/dns-01.conf
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - ACME_DNS_CHALLENGE is enabled, DNS provider secrets loaded
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Using Let’s Encrypt production servers
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Certificate /var/lib/acme/autodiscover.littlehosting.com/cert.pem missing or changed domains ‘autodiscover.littlehosting.com autoconfig.littlehosting.com’ - start obtaining
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Checking resolver…
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Resolver OK
acme-mailcow-1 | Wed Sep 2 11:19:08 AWST 2026 - Registering acme.sh account for franki@gmail.com
acme-mailcow-1 | Wed Sep 2 11:19:11 AWST 2026 - Using command /opt/acme.sh/acme.sh –home /var/lib/acme/acme-sh –config-home /var/lib/acme/acme-sh –cert-home /var/lib/acme/acme-sh –server letsencrypt –issue –dns dns_pdns –key-file /var/lib/acme/autodiscover.littlehosting.com/key.pem –cert-file /tmp/acme-cert.LCHhAL –fullchain-file /tmp/acme-fullchain.HCJOBL –force -d autodiscover.littlehosting.com -d autoconfig.littlehosting.com
acme-mailcow-1 | Wed Sep 2 11:19:11 AWST 2026 - DNS provider: dns_pdns
acme-mailcow-1 | [Wed Sep 2 11:19:12 AWST 2026] Using CA: https://acme-v02.api.letsencrypt.org/directory
acme-mailcow-1 | [Wed Sep 2 11:19:12 AWST 2026] Multi domain=‘DNS:autodiscover.littlehosting.com,DNS:autoconfig.littlehosting.com’
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Getting webroot for domain=‘autodiscover.littlehosting.com’
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Getting webroot for domain=‘autoconfig.littlehosting.com’
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Adding TXT value: vxF_wIe7LIeIZViIS0nvaU4BJQhDHUg2XbTrk_yJHmo for domain: _acme-challenge.autodiscover.littlehosting.com
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] You don’t specify PowerDNS address.
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Please set PDNS_Url and try again.
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Error adding TXT record to domain: _acme-challenge.autodiscover.littlehosting.com
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] Please add ‘–debug’ or ‘–log’ to see more information.
acme-mailcow-1 | [Wed Sep 2 11:19:15 AWST 2026] See: acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
acme-mailcow-1 | Wed Sep 2 11:19:16 AWST 2026 - Failed to obtain certificate /var/lib/acme/autodiscover.littlehosting.com/cert.pem for domains ‘autodiscover.littlehosting.com autoconfig.littlehosting.com’ via DNS challenge

MeZmeriZe1

I’ve just noticed the log as asking for PDNS_Url but I have PDNS_API_URL which I think I got pdns docs.
I’ve added PDNS_Url but it’s still complaining that it has not been set. I’ve swapped back to httpd ssl and thats working but It does not do all of what I need so I need to get the DNS API working.

looking at the source of acme.sh/dnsapi/dns_pdns.sh I see this:
PDNS_Url=“${PDNS_Url:-$(readaccountconf_mutable PDNS_Url)}”
PDNS_ServerId=“${PDNS_ServerId:-$(readaccountconf_mutable PDNS_ServerId)}”
PDNS_Token=“${PDNS_Token:-$(readaccountconf_mutable PDNS_Token)}”
PDNS_Ttl=“${PDNS_Ttl:-$(readaccountconf_mutable PDNS_Ttl)}”

which seems to indicate I am on the right track. _readaccountconf_mutable appears to create an account file using the env vars of that name or read it if it already exists. I’ve matched those vars in mailcow.conf (and dns-01.conf not that it’s made any difference. because the container does not contain them as envs presumably).

This is what I have now:

ACME_DNS_CHALLENGE=y
ACME_DNS_PROVIDER=dns_pdns
ACME_ACCOUNT_EMAIL=franki@gmail.com
#found in dns_pdns.sh
PDNS_Url=http://192.168.1.129:8081
PDNS_ServerId=“localhost”
PDNS_Token=Thisismyapipasswordbutnotreal
PDNS_Ttl=60

hmmm… I printed the acme-mailcow containers env and did not find any of the PDNS vars which explains why the script keeps telling me the PDNS_URL is undefined.

I suppose I could add the Vars to the dockerfile but that does not seem the right way to fix this.

I’d love some pointers if anyone else is running this config.

cheers

ETNyx

You know there is docs?

Well not sure in what file you have what, mailcow.conf got ACME_DNS_CHALLENGE + ACME_DNS_PROVIDER + ACME_ACCOUNT_EMAIL and dns-01.conf got PDNS_Url + PDNS_ServerId + PDNS_Token + PDNS_Ttl right?

Dan

Did you put the PowerDNS config in data/conf/acme/dns-01.conf like @ETNyx mentioned?

This is probably more of an acme.sh question rather than a Mailcow one. See if it works if you use acme.sh directly. While testing, use the Let’s Encrypt staging server to avoid hitting rate limits for production cert issuance. If you can’t get it working through acme.sh directly, their repo is here: https://github.com/acmesh-official/acme.sh

An alternative option is to use acme-dns: acme-dns/acme-dns. It’s a separate DNS server that’s only used for ACME challenges. This is good for security because it avoids needing to use a powerful API key that can change any records in your domain. Let’s Encrypt follows CNAMEs and supports IPv6-only DNS servers, so you don’t need a spare IPv4 address and can run it just on an IPv6 address.