alidns provider do not match subdomain

[lkad]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

alidns provider can match subdomain.

For example, I have a domain name example.com, but for security reasons, I configured a subdomain c.example.com on Alibaba Cloud for separate resolution.
This allows me to configure sub-users to only have permissions to configure the resolution of c.example.com.
However, when I tried to configure the domain name m.c.example.com using Lego, it recognize the subdomain c.example.com and change the text record on c.example.com

What did you see instead?

For example, I have a domain name example.com, but for security reasons, I configured a subdomain c.example.com on Alibaba Cloud for separate resolution.
This allows me to configure sub-users to only have permissions to configure the resolution of c.example.com.
However, when I tried to configure the domain name m.c.example.com using Lego, it did not recognize the subdomain c.example.com and still used the example.com domain for resolution, which resulted in DNS resolution authentication failure.

How do you use lego?

Traefik

Reproduction steps

1. config a alibaba cloud subdomain
   
2. config ram user dns
3. grant usr dns full access domain privilage
4. get ak and sk
5. Obtaining a domain certificate for a subdomain using alidns provider, for example, a.subdomain.

Version of lego

import (
	"github.com/go-acme/lego/v4/

Logs

text record infor 
_acme-challenge.whoami2.docker
and value  VZTUwPiJMoYY-qUA5Zexi1lGZ3wne7FqmOTDAyY4Shs
 my  subdomain is docker.lkad.net , use whoami2.docker.lkad.lnet request  HTTPS certificate

Go environment (if applicable)

I use traefik 2.9.9 docker image : traefik:v2.9.9

$ go version && go env
# paste output here

[lkad]

time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/219389910267"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Could not find solver for: tls-alpn-01"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Could not find solver for: http-01"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: use dns-01 solver"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Preparing to solve DNS-01"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Trying to solve DNS-01"
time="2023-04-14T15:00:56Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Checking DNS record propagation using [127.0.0.53:53]"
time="2023-04-14T15:00:58Z" level=debug msg="legolog: [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]"
time="2023-04-14T15:00:58Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:00Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:02Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:04Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:06Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:08Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:10Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:12Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:14Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:16Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:18Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:20Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:22Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:24Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:26Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:28Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:30Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:32Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:34Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:36Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:38Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:40Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:43Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:45Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:47Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:49Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:51Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:53Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:55Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:57Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Waiting for DNS record propagation."
time="2023-04-14T15:01:59Z" level=debug msg="legolog: [INFO] [whoami2.docker.lkad.net] acme: Cleaning DNS-01 challenge"
time="2023-04-14T15:02:00Z" level=debug msg="legolog: [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/219389910267"
time="2023-04-14T15:02:01Z" level=error msg="Unable to obtain ACME certificate for domains \"whoami2.docker.lkad.net\": unable to generate a certificate for the domains [whoami2.docker.lkad.net]: error: one or more domains had a problem:\n[whoami2.docker.lkad.net] time limit exceeded: last error: NS dns14.hichina.com. did not return the expected TXT record [fqdn: _acme-challenge.whoami2.docker.lkad.net., value: A7-gNHVCT96Q7oaw82UWNEdua5BQykWFEERUkKwBzTE]: \n" providerName=myresolver.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=whoami@docker rule="Host(`whoami2.docker.lkad.net`)"

[ldez]

Hello,

it's because you don't have an A record on docker.lkad.net

[lkad]

i check the code in providers/dns/alidns/alidns.go :

func (d *DNSProvider) getHostedZone(domain string) (string, error) {
  ........
........
........
	authZone, err := dns01.FindZoneByFqdn(domain)
	if err != nil {
		return "", err
	}

	var hostedZone alidns.DomainInDescribeDomains
	for _, zone := range domains {
		if zone.DomainName == dns01.UnFqdn(authZone) || zone.PunyCode == dns01.UnFqdn(authZone) {
			hostedZone = zone
		}
	}

	if hostedZone.DomainId == "" {
		return "", fmt.Errorf("zone %s not found in AliDNS for domain %s", authZone, domain)
	}

	return hostedZone.DomainName, nil

when domains is

[]github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DomainInDescribeDomains len: 3, cap: 3, [{Remark: "", CreateTime: "2022-08-01T14:34Z", RecordCount: 3, InstanceId: "", DomainName: "docker.lkad.net", DomainId: "b97b9e5d044d4046a1a9cbc53de3883f", AliDomain: false, GroupId: "", GroupName: "", ResourceGroupId: "rg-acfmzaembfaydyy", InstanceEndTime: "", InstanceExpired: false, VersionName: "Alibaba Cloud DNS", VersionCode: "mianfei", PunyCode: "docker.lkad.net", RegistrantEmail: "", CreateTimestamp: 1659364476000, Starmark: false, DnsServers: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DnsServersInDescribeDomains")(0xc000bb0478), Tags: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.TagsInDescribeDomains")(0xc000bb0490)},{Remark: "", CreateTime: "2018-02-01T03:11Z", RecordCount: 0, InstanceId: "", DomainName: "lkad.top", DomainId: "d28a6f8d-8b65-49c7-b2eb-563be7636b60", AliDomain: true, GroupId: "", GroupName: "", ResourceGroupId: "rg-acfmzaembfaydyy", InstanceEndTime: "", InstanceExpired: false, VersionName: "Alibaba Cloud DNS", VersionCode: "mianfei", PunyCode: "lkad.top", RegistrantEmail: "", CreateTimestamp: 1517454717000, Starmark: false, DnsServers: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DnsServersInDescribeDomains")(0xc000bb05a0), Tags: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.TagsInDescribeDomains")(0xc000bb05b8)},{Remark: "", CreateTime: "2018-02-01T03:11Z", RecordCount: 12, InstanceId: "", DomainName: "lkad.net", DomainId: "2905e600-f844-4d38-b9be-2599450a74f8", AliDomain: true, GroupId: "", GroupName: "", ResourceGroupId: "rg-acfmzaembfaydyy", InstanceEndTime: "", InstanceExpired: false, VersionName: "Alibaba Cloud DNS", VersionCode: "mianfei", PunyCode: "lkad.net", RegistrantEmail: "", CreateTimestamp: 1517454717000, Starmark: false, DnsServers: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DnsServersInDescribeDomains")(0xc000bb06c8), Tags: (*"github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.TagsInDescribeDomains")(0xc000bb06e0)}]

docker.lkad.net is in the domains
but authZone is lkad.net
so
hostzone is

github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DomainInDescribeDomains {Remark: "", CreateTime: "2018-02-01T03:11Z", RecordCount: 13, InstanceId: "", DomainName: "lkad.net", DomainId: "2905e600-f844-4d38-b9be-2599450a74f8", AliDomain: true, GroupId: "", GroupName: "", ResourceGroupId: "rg-acfmzaembfaydyy", InstanceEndTime: "", InstanceExpired: false, VersionName: "Alibaba Cloud DNS", VersionCode: "mianfei", PunyCode: "lkad.net", RegistrantEmail: "", CreateTimestamp: 1517454717000, Starmark: false, DnsServers: github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.DnsServersInDescribeDomains {DnsServer: []string len: 2, cap: 2, ["dns13.hichina.com","dns14.hichina.com"]}, Tags: github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.TagsInDescribeDomains {Tag: []github.com/aliyun/alibaba-cloud-sdk-go/services/alidns.Tag len: 0, cap: 0, []}}

hostzone.DomainName is lkad.net not docker.lkad.net .so the txt is on lkad.net ,not on docker.lkad.net
can fix this bug ?

[ldez]

have you read my message?

[lkad]

yes i read the message . so i change the record to A ,after 30min,but no things changes.
docker.lkad.net record is

the log is

 ALICLOUD_SECRET_KEY=iecPLm72c0faBwFtJXRpWSpkwCS4WB /home/loony/.gvm/pkgsets/go1.19/global/bin/dlv dap --client-addr=:43671 
2023/04/15 23:27:34 [INFO] [whoaxx.docker.lkad.net] acme: Obtaining bundled SAN certificate
2023/04/15 23:27:36 [INFO] [whoaxx.docker.lkad.net] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/219668318177
2023/04/15 23:27:36 [INFO] [whoaxx.docker.lkad.net] acme: Could not find solver for: tls-alpn-01
2023/04/15 23:27:36 [INFO] [whoaxx.docker.lkad.net] acme: Could not find solver for: http-01
2023/04/15 23:27:36 [INFO] [whoaxx.docker.lkad.net] acme: use dns-01 solver
2023/04/15 23:27:36 [INFO] [whoaxx.docker.lkad.net] acme: Preparing to solve DNS-01
2023-04-15T23:27:37+08:00 error layer=debugger gnu_debuglink CRC check failed for /lib/x86_64-linux-gnu/libc-2.27.so (want 7c906570 got 8c0be908)
2023-04-15T23:27:37+08:00 error layer=debugger gnu_debuglink CRC check failed for /lib/x86_64-linux-gnu/libnss_files-2.27.so (want 1f98c3bc got 37ad35a7)
2023-04-15T23:27:37+08:00 error layer=debugger gnu_debuglink CRC check failed for /lib/x86_64-linux-gnu/libnss_dns-2.27.so (want 98198ac8 got 1356aba3)
2023-04-15T23:27:37+08:00 error layer=debugger gnu_debuglink CRC check failed for /lib/x86_64-linux-gnu/libresolv-2.27.so (want 38fc22bc got da29cf12)
2023/04/15 23:28:04 [INFO] [whoaxx.docker.lkad.net] acme: Trying to solve DNS-01
2023/04/15 23:28:04 [INFO] [whoaxx.docker.lkad.net] acme: Checking DNS record propagation using [127.0.0.53:53]
2023/04/15 23:28:06 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2023/04/15 23:28:12 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:17 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:24 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:32 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:38 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:53 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:28:59 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:29:03 [INFO] [whoaxx.docker.lkad.net] acme: Waiting for DNS record propagation.
2023/04/15 23:29:08 [INFO] [whoaxx.docker.lkad.net] acme: Cleaning DNS-01 challenge
2023/04/15 23:39:30 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/219668318177
2023/04/15 23:39:31 Could not obtain certificates:
        error: one or more domains had a problem:
[whoaxx.docker.lkad.net] time limit exceeded: last error: NS dns13.hichina.com. did not return the expected TXT record [fqdn: _acme-challenge.whoaxx.docker.lkad.net., value: yEhFOOhSR7noHSDPRPX8LYhbf5oNZmielR0RIYYa0pA]: 

when the log print 2023/04/15 23:29:08 [INFO] [whoaxx.docker.lkad.net] acme: Cleaning DNS-01 challenge
the lkad.net record is

the record _acme-challenge.whoaxx.docker on lkad.net is the wrong record,it must be _acme-challenge.whoaxx on docker.lkda.net

[ldez]

For the domain whoaxx.docker.lkad.net the expected TXT record is _acme-challenge.whoaxx.docker.lkad.net

If the domain authority is lkad.net, the behavior is expected.

For me, the problem is related to your configuration: docker.lkad.net must be authoritative.

[lkad]

yes ,the docker.lkad.net congiguration is authoriative.

Thank you very much for your help. Could you please take a look at the Alibaba Cloud DNS documentation at https://www.alibabacloud.com/help/en/alibaba-cloud-dns/latest/subdomain-management? I have used the Alibaba Cloud subdomain management feature. My domain name, lkad.net, is managed on the Alibaba Cloud domain, and I have also configured the subdomain management for docker.lkad.net. The resolution records for *.docker.lkad.net are managed in the subdomain of docker.lkad.net. However, when I use lego, for the domain whoaxx.docker.lkad.net, the expected TXT record is _acme-challenge.whoaxx.docker.lkad.net. This TXT record is configured on lkad.net, which leads to a failure in resolving. The correct configuration should be in the subdomain of docker.klad.net."