Billionmail/BillionMail · error

Failed to set Godaddy DNS verification: {}

Error message

Failed to set Godaddy DNS verification: {}

What it means

For vtype == "dns" with dnsProvider == "godaddy", SetDnsGodaddy builds a lego GoDaddy provider from dnsProviderToken and attaches it via SetDNS01Provider. Failure means the GoDaddy API key/secret could not initialize the provider. GoDaddy's lego provider also only works for domains registered/hosed with GoDaddy DNS; unrelated zones fail later or at setup.

Source

Thrown at core/internal/service/acme/acme.go:434

		case "cloudxns":
			err = SetDnsCloudxns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set CloudXNS DNS verification: {}", err.Error()))
			}
		case "azuredns":
			err = SetDnsAzuredns(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set AzureDNS verification: {}", err.Error()))
			}
		case "cloudflare":
			err = SetDnsCloudflare(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Cloudflare DNS verification: {}", err.Error()))
			}
		case "godaddy":
			err = SetDnsGodaddy(ctx, client, dnsProviderToken)
			if err != nil {
				return "", "", errors.New(public.LangCtx(ctx, "Failed to set Godaddy DNS verification: {}", err.Error()))
			}
		default:
			return "", "", errors.New(public.LangCtx(ctx, "Unsupported DNS provider: {}", dnsProvider))
		}
	}

	// Register or query existing user on ACME server
	var reg *registration.Resource
	// Try to query existing registration first (same key = same account)
	reg, err = client.Registration.QueryRegistration()
	if err != nil || reg == nil {
		// No existing registration, register new account
		reg, err = client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})
		if err != nil {
			return "", "", errors.New(public.LangCtx(ctx, "Failed to register user: {}", err.Error()))
		}
	}

View on GitHub (pinned to fc36c76c05)

Solutions

  1. Regenerate a GoDaddy production API key/secret pair and store it as key:secret in dnsProviderToken (correct order, trimmed)
  2. Confirm the certificate domain's DNS is actually served by GoDaddy; if not, choose the provider that hosts the zone
  3. Check the wrapped err text to separate format errors from auth rejection

Example fix

// before
dnsProviderToken = "secretOnly"
// after
dnsProviderToken = "apiKey:apiSecret" // production credentials
Defensive patterns

Strategy: validation

Validate before calling

func validGoDaddyToken(tok string) bool {
    parts := strings.Split(strings.TrimSpace(tok), ":")
    return len(parts) == 2 && parts[0] != "" && parts[1] != ""
}
if dnsProvider == "godaddy" && !validGoDaddyToken(dnsProviderToken) {
    return errors.New("godaddy token must be key:secret (production)")
}

Type guard

func isGoDaddyConfigured(vtype, provider, token string) bool {
    return vtype == "dns" && provider == "godaddy" && strings.TrimSpace(token) != ""
}

Try / catch

cert, _, err := ApplySSLWithExistingServer(ctx, ...)
if err != nil && strings.Contains(err.Error(), "Godaddy") {
    return fmt.Errorf("regenerate GoDaddy production API key and verify DNS hosting: %w", err)
}

Prevention

When it happens

Trigger: ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype="dns", dnsProvider="godaddy", and a dnsProviderToken that is a malformed API key:secret pair, a revoked production key, or a test-key used in production.

Common situations: Using GoDaddy 'OTE' (test) credentials against production API; key/secret swapped in the token; domain's DNS actually delegated to another provider so records can never be created.

Related errors

AI-assisted analysis of Billionmail/BillionMail@fc36c76c05 (2026-09-05). Data as JSON: /api/errors/4df721ce17a4d8e9. Report an issue: GitHub.