DNS Alias mode (--challenge-alias) not RFC compliant?

[kgts23]

Hello,

I have received a message from united-domains.de (IONOS Group SE) that a CNAME record like

_acme-challenge.example.com
 => _acme-challenge.aliasDomainForValidationOnly.com

is not valid because of the underscore and refers to rfc952.

So only the option --domain-alias is rfc compliant, because the target can be a hostname without underscore. Is this correct? If so, should there be a note in the documentation?

[github-actions]

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

[gerdesj]

You'll need to chase through all the DNS related RFCs because the one you quote is pre DNS - "DOD INTERNET HOST TABLE SPECIFICATION"

_acme-challenge is not really a hostname but you'll need to cover RFC 1123 and all the other updates (there are six directly to RFC 1123 alone).

Most people seem happy with using leading _ for well known names. SPF would not work, nor would SIP, Active Directory and many more without them.