Billionmail/BillionMail · error

Failed to set AzureDNS verification: {}

Error message

Failed to set AzureDNS verification: {}

What it means

For vtype == "dns" with dnsProvider == "azuredns", SetDnsAzuredns builds a lego Azure DNS provider from dnsProviderToken and attaches it via SetDNS01Provider. Failure here means the Azure credential string could not be used — Azure requires multiple values (tenant ID, client ID, client secret, subscription ID, resource group) and any missing or wrong piece fails setup or later authentication.

Source

Thrown at core/internal/service/acme/acme.go:424

		case "tencentcloud":
			err = SetDnsTencentcloud(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Tencent Cloud DNS verification: {}", err.Error()))
			}
		case "alidns":
			err = SetDnsAliyun(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Alibaba Cloud DNS verification: {}", err.Error()))
			}
		case "cloudxns":
			err = SetDnsCloudxns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set CloudXNS DNS verification: {}", err.Error()))
			}
		case "azuredns":
			err = SetDnsAzuredns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set AzureDNS verification: {}", err.Error()))
			}
		case "cloudflare":
			err = SetDnsCloudflare(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Cloudflare DNS verification: {}", err.Error()))
			}
		case "godaddy":
			err = SetDnsGodaddy(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Godaddy DNS verification: {}", err.Error()))
			}
		default:
			return "", "", errors.New(public.LangCtx(ctx, "Unsupported DNS provider: {}", dnsProvider))
		}
	}

	// Register or query existing user on ACME server
	var reg *registration.Resource

View on GitHub (pinned to fc36c76c05)

Solutions

  1. Verify dnsProviderToken contains every required Azure value (tenant ID, client ID, client secret, subscription ID, resource group) in the format the app expects
  2. Assign the DNS Zone Contributor role on the target zone's resource group to the service principal
  3. Confirm the zone name matches the certificate domain exactly (e.g. contoso.com hosted zone)

Example fix

// before
dnsProviderToken = "clientSecretOnly"
// after
dnsProviderToken = "tenantID:clientID:clientSecret:subscriptionID:resourceGroup"
Defensive patterns

Strategy: validation

Validate before calling

func validAzureToken(tok string) bool {
    // tenant:client:secret:subscription:resourceGroup
    return len(strings.Split(strings.TrimSpace(tok), ":")) == 5
}
if dnsProvider == "azuredns" && !validAzureToken(dnsProviderToken) {
    return errors.New("azure token must contain tenant/client/secret/subscription/resourceGroup")
}

Type guard

func isAzureConfigured(vtype, provider, token string) bool {
    return vtype == "dns" && provider == "azuredns" && len(strings.Split(token, ":")) == 5
}

Try / catch

cert, _, err := ApplySSLWithExistingServer(ctx, ...)
if err != nil && strings.Contains(err.Error(), "AzureDNS") {
    return fmt.Errorf("verify Azure service principal and DNS Zone Contributor role: %w", err)
}

Prevention

When it happens

Trigger: ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype="dns", dnsProvider="azuredns", and a dnsProviderToken missing tenant/subscription/resource-group fields, or a service principal without DNS Zone Contributor rights on the zone.

Common situations: Providing only the client secret without the full credential tuple; principal scoped to the wrong subscription; zone lives in a different resource group than configured.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/dda1ac605689e357. Report an issue: GitHub.