{"record":{"id":"5dab50a3d9ef2b52","repo":"Billionmail/BillionMail","slug":"failed-to-set-alibaba-cloud-dns-verification","errorCode":null,"errorMessage":"Failed to set Alibaba Cloud DNS verification: {}","messagePattern":"Failed to set Alibaba Cloud DNS verification: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/internal/service/acme/acme.go","lineNumber":414,"sourceCode":"\tif vtype == \"http\" {\n\t\t// Assume the HTTP server is already running and properly configured\n\t\t// to handle the challenge requests\n\t\terr = client.Challenge.SetHTTP01Provider(http01.NewProviderServer(\"127.0.0.1\", \"60880\"))\n\t\tif err != nil {\n\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set HTTP verification: {}\", err.Error()))\n\t\t}\n\t} else if vtype == \"dns\" && dnsProvider != \"\" {\n\t\t// Set DNS verification - same as in the standard ApplySSL function\n\t\tswitch dnsProvider {\n\t\tcase \"tencentcloud\":\n\t\t\terr = SetDnsTencentcloud(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Tencent Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"alidns\":\n\t\t\terr = SetDnsAliyun(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Alibaba Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudxns\":\n\t\t\terr = SetDnsCloudxns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set CloudXNS DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"azuredns\":\n\t\t\terr = SetDnsAzuredns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set AzureDNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudflare\":\n\t\t\terr = SetDnsCloudflare(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Cloudflare DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"godaddy\":\n\t\t\terr = SetDnsGodaddy(ctx, client, dnsProviderToken)","sourceCodeStart":396,"sourceCodeEnd":432,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/acme/acme.go#L396-L432","documentation":"For vtype == \"dns\" with dnsProvider == \"alidns\", SetDnsAliyun constructs a lego Alibaba Cloud DNS provider from dnsProviderToken and attaches it via SetDNS01Provider. This error surfaces when that construction/registration fails — almost always invalid or wrongly formatted Aliyun AccessKey credentials. The real cause is inside the wrapped err text.","triggerScenarios":"ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype=\"dns\", dnsProvider=\"alidns\", and a dnsProviderToken that is missing, malformed (AccessKey ID/Secret misordered or bad separator), or belongs to a RAM user lacking AliyunDNS FullAccess.","commonSituations":"Using an AccessKey without DNS permissions for the hosted zone; disabling/deleting the RAM user after storing the token; token format changed between app versions.","solutions":["Read the wrapped err; correct the dnsProviderToken format (AccessKey ID + AccessKey Secret in the expected layout, trimmed)","Attach AliyunDNS FullAccess policy to the RAM user owning the key and confirm the domain is hosted in that Aliyun account","Recreate the AccessKey if it was disabled or leaked-rotated, update the stored token, and retry"],"exampleFix":"// before\ndnsProviderToken = \"LTAI...\" // only the AccessKey ID\n// after\ndnsProviderToken = \"LTAI...:secretKeyPart\" // ID:Secret, both present","handlingStrategy":"validation","validationCode":"func validAliyunToken(tok string) bool {\n    parts := strings.Split(strings.TrimSpace(tok), \":\")\n    return len(parts) == 2 && parts[0] != \"\" && parts[1] != \"\"\n}\nif dnsProvider == \"alidns\" && !validAliyunToken(dnsProviderToken) {\n    return errors.New(\"invalid Aliyun AccessKey format\")\n}","typeGuard":"func isAliDNSConfigured(vtype, provider, token string) bool {\n    return vtype == \"dns\" && provider == \"alidns\" && strings.TrimSpace(token) != \"\"\n}","tryCatchPattern":"cert, _, err := ApplySSLWithExistingServer(ctx, ...)\nif err != nil && strings.Contains(err.Error(), \"Alibaba Cloud DNS\") {\n    return fmt.Errorf(\"verify Aliyun AccessKey and RAM DNS permissions: %w\", err)\n}","preventionTips":["Attach AliyunDNS FullAccess to the RAM user owning the key","Keep AccessKey ID and Secret in the correct order with the expected separator","Verify the zone is hosted in the same Aliyun account as the key"],"tags":["acme","dns-01","alidns","credentials"],"backgroundTag":"dns-provider-auth-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}