I would like to contribute support for the ACME dns-account-01
Unlike dns-01, this challenge uses an account-specific DNS label,
The implementation:
adds DnsAccount01 to AcmeChallengeType
recognizes dns-account-01 ACME challenge objects
derives the DNS label from the ACME account URL according to
publishes the TXT record through the configured automatic DNS provider
supports apex and wildcard authorizations
exposes the new option in the WebUI schema
I manually verified certificate issuance for an apex domain and wildcard
Proposed branch:
feature/dns-account-01
All-in-one Mail & Collaboration server. Secure, scalable and fluent in every protocol (IMAP, JMAP, SMTP, CalDAV, CardDAV, WebDAV). - marat2509/stalwart
And PR:
main ← marat2509:feature/dns-account-01
closed 11:20PM - 18 Aug 26 UTC
Tested on Google Trust Services Public CA:
```
stalwart | 2026-08-18T23:14:44… Z INFO ACME authentication started (acme.auth-start) hostname = "example.com", type = "dns-account-01", url = "https://dv.acme-v02.api.pki.goog/new-order"
stalwart | 2026-08-18T23:14:45Z INFO DNS record created (dns.record-created) hostname = "{HASHED_ID}._acme-challenge.example.com", details = "example.com", type = "TXT", value = ["{TXT_RECORD_VALUE_1}"]
stalwart | 2026-08-18T23:15:00Z INFO DNS record propagated (dns.record-propagated) hostname = "{HASHED_ID}._acme-challenge.example.com", details = "example.com", type = "TXT", value = "{TXT_RECORD_VALUE_1}"
stalwart | 2026-08-18T23:15:08Z INFO ACME authentication valid (acme.auth-valid) hostname = "example.com", url = "https://dv.acme-v02.api.pki.goog/new-order"
stalwart | 2026-08-18T23:15:08Z INFO ACME authentication started (acme.auth-start) hostname = "example.com", type = "dns-account-01", url = "https://dv.acme-v02.api.pki.goog/new-order"
stalwart | 2026-08-18T23:15:10Z INFO DNS record created (dns.record-created) hostname = "{HASHED_ID}._acme-challenge.example.com", details = "example.com", type = "TXT", value = ["{TXT_RECORD_VALUE_2}"]
stalwart | 2026-08-18T23:15:14Z INFO Invalid EHLO command (smtp.invalid-ehlo) listenerId = "smtp", localPort = 25, remoteIp = 77.83.39.4, remotePort = 62274, domain = "User"
stalwart | 2026-08-18T23:15:14Z INFO Authentication not allowed (smtp.auth-not-allowed) listenerId = "smtp", localPort = 25, remoteIp = 77.83.39.4, remotePort = 62274
stalwart | 2026-08-18T23:15:53Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-08-18T23:20:52Z, id = "alertMetrics"
stalwart | 2026-08-18T23:15:53Z INFO Task scheduled for future execution (task-manager.task-scheduled) due = 2026-08-18T23:20:52Z, id = "calculateMetrics"
stalwart | 2026-08-18T23:15:53Z INFO Metrics collected (telemetry.metrics-collected) elapsed = 2ms
stalwart | 2026-08-18T23:16:10Z WARN DNS record propagation timeout (dns.record-propagation-timeout) hostname = "{HASHED_ID}._acme-challenge.example.com", details = "example.com", type = "TXT", value = "KU8Uo5OF4s6SU8kZXaDNiwZZMVLzeNWZBq54DIn-k3c"
stalwart | 2026-08-18T23:16:17Z INFO ACME authentication valid (acme.auth-valid) hostname = "example.com", url = "https://dv.acme-v02.api.pki.goog/new-order"
stalwart | 2026-08-18T23:16:17Z INFO ACME authentication completed (acme.auth-completed) url = "https://dv.acme-v02.api.pki.goog/new-order", hostname = ["*.example.com", "example.com"]
stalwart | 2026-08-18T23:16:18Z INFO ACME order ready (acme.order-ready) url = "https://dv.acme-v02.api.pki.goog/new-order", hostname = ["*.example.com", "example.com"]
stalwart | 2026-08-18T23:16:20Z INFO ACME order processing (acme.order-processing) url = "https://dv.acme-v02.api.pki.goog/new-order", hostname = ["*.example.com", "example.com"], total = 0
stalwart | 2026-08-18T23:16:21Z INFO ACME order processing (acme.order-processing) url = "https://dv.acme-v02.api.pki.goog/new-order", hostname = ["*.example.com", "example.com"], total = 1
stalwart | 2026-08-18T23:16:28Z INFO ACME order valid (acme.order-valid) url = "https://dv.acme-v02.api.pki.goog/new-order", hostname = ["*.example.com", "example.com"]
```