Billionmail/BillionMail · error

Failed to set Alibaba Cloud DNS verification: {}

Error message

Failed to set Alibaba Cloud DNS verification: {}

What it means

For vtype == "dns" with dnsProvider == "alidns", SetDnsAliyun constructs a lego Alibaba Cloud DNS provider from dnsProviderToken and attaches it via SetDNS01Provider. This error surfaces when that construction/registration fails — almost always invalid or wrongly formatted Aliyun AccessKey credentials. The real cause is inside the wrapped err text.

Source

Thrown at core/internal/service/acme/acme.go:414

	if vtype == "http" {
		// Assume the HTTP server is already running and properly configured
		// to handle the challenge requests
		err = client.Challenge.SetHTTP01Provider(http01.NewProviderServer("127.0.0.1", "60880"))
		if err != nil {
			return "", "", errors.New(public.LangCtx(ctx, "Failed to set HTTP verification: {}", err.Error()))
		}
	} else if vtype == "dns" && dnsProvider != "" {
		// Set DNS verification - same as in the standard ApplySSL function
		switch dnsProvider {
		case "tencentcloud":
			err = SetDnsTencentcloud(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Tencent Cloud DNS verification: {}", err.Error()))
			}
		case "alidns":
			err = SetDnsAliyun(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Alibaba Cloud DNS verification: {}", err.Error()))
			}
		case "cloudxns":
			err = SetDnsCloudxns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set CloudXNS DNS verification: {}", err.Error()))
			}
		case "azuredns":
			err = SetDnsAzuredns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set AzureDNS verification: {}", err.Error()))
			}
		case "cloudflare":
			err = SetDnsCloudflare(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Cloudflare DNS verification: {}", err.Error()))
			}
		case "godaddy":
			err = SetDnsGodaddy(ctx, client, dnsProviderToken)

View on GitHub (pinned to fc36c76c05)

Solutions

1. Read the wrapped err; correct the dnsProviderToken format (AccessKey ID + AccessKey Secret in the expected layout, trimmed)
2. Attach AliyunDNS FullAccess policy to the RAM user owning the key and confirm the domain is hosted in that Aliyun account
3. Recreate the AccessKey if it was disabled or leaked-rotated, update the stored token, and retry

Example fix

// before
dnsProviderToken = "LTAI..." // only the AccessKey ID
// after
dnsProviderToken = "LTAI...:secretKeyPart" // ID:Secret, both present

func validAliyunToken(tok string) bool {
    parts := strings.Split(strings.TrimSpace(tok), ":")
    return len(parts) == 2 && parts[0] != "" && parts[1] != ""
}
if dnsProvider == "alidns" && !validAliyunToken(dnsProviderToken) {
    return errors.New("invalid Aliyun AccessKey format")
}

func isAliDNSConfigured(vtype, provider, token string) bool {
    return vtype == "dns" && provider == "alidns" && strings.TrimSpace(token) != ""
}

cert, _, err := ApplySSLWithExistingServer(ctx, ...)
if err != nil && strings.Contains(err.Error(), "Alibaba Cloud DNS") {
    return fmt.Errorf("verify Aliyun AccessKey and RAM DNS permissions: %w", err)
}

When it happens

Trigger: ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype="dns", dnsProvider="alidns", and a dnsProviderToken that is missing, malformed (AccessKey ID/Secret misordered or bad separator), or belongs to a RAM user lacking AliyunDNS FullAccess.

Common situations: Using an AccessKey without DNS permissions for the hosted zone; disabling/deleting the RAM user after storing the token; token format changed between app versions.

Related errors

• Failed to set Tencent Cloud DNS verification: {}
• Failed to set AzureDNS verification: {}
• Failed to set Cloudflare DNS verification: {}
• Failed to set Godaddy DNS verification: {}
• DNS automated resolution failed: APIKey or SecretKey is empt

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/5dab50a3d9ef2b52. Report an issue: GitHub.