{"record":{"id":"dda1ac605689e357","repo":"Billionmail/BillionMail","slug":"failed-to-set-azuredns-verification","errorCode":null,"errorMessage":"Failed to set AzureDNS verification: {}","messagePattern":"Failed to set AzureDNS verification: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/internal/service/acme/acme.go","lineNumber":424,"sourceCode":"\t\tcase \"tencentcloud\":\n\t\t\terr = SetDnsTencentcloud(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Tencent Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"alidns\":\n\t\t\terr = SetDnsAliyun(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Alibaba Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudxns\":\n\t\t\terr = SetDnsCloudxns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set CloudXNS DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"azuredns\":\n\t\t\terr = SetDnsAzuredns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set AzureDNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudflare\":\n\t\t\terr = SetDnsCloudflare(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Cloudflare DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"godaddy\":\n\t\t\terr = SetDnsGodaddy(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Godaddy DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tdefault:\n\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Unsupported DNS provider: {}\", dnsProvider))\n\t\t}\n\t}\n\n\t// Register or query existing user on ACME server\n\tvar reg *registration.Resource","sourceCodeStart":406,"sourceCodeEnd":442,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/acme/acme.go#L406-L442","documentation":"For vtype == \"dns\" with dnsProvider == \"azuredns\", SetDnsAzuredns builds a lego Azure DNS provider from dnsProviderToken and attaches it via SetDNS01Provider. Failure here means the Azure credential string could not be used — Azure requires multiple values (tenant ID, client ID, client secret, subscription ID, resource group) and any missing or wrong piece fails setup or later authentication.","triggerScenarios":"ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype=\"dns\", dnsProvider=\"azuredns\", and a dnsProviderToken missing tenant/subscription/resource-group fields, or a service principal without DNS Zone Contributor rights on the zone.","commonSituations":"Providing only the client secret without the full credential tuple; principal scoped to the wrong subscription; zone lives in a different resource group than configured.","solutions":["Verify dnsProviderToken contains every required Azure value (tenant ID, client ID, client secret, subscription ID, resource group) in the format the app expects","Assign the DNS Zone Contributor role on the target zone's resource group to the service principal","Confirm the zone name matches the certificate domain exactly (e.g. contoso.com hosted zone)"],"exampleFix":"// before\ndnsProviderToken = \"clientSecretOnly\"\n// after\ndnsProviderToken = \"tenantID:clientID:clientSecret:subscriptionID:resourceGroup\"","handlingStrategy":"validation","validationCode":"func validAzureToken(tok string) bool {\n    // tenant:client:secret:subscription:resourceGroup\n    return len(strings.Split(strings.TrimSpace(tok), \":\")) == 5\n}\nif dnsProvider == \"azuredns\" && !validAzureToken(dnsProviderToken) {\n    return errors.New(\"azure token must contain tenant/client/secret/subscription/resourceGroup\")\n}","typeGuard":"func isAzureConfigured(vtype, provider, token string) bool {\n    return vtype == \"dns\" && provider == \"azuredns\" && len(strings.Split(token, \":\")) == 5\n}","tryCatchPattern":"cert, _, err := ApplySSLWithExistingServer(ctx, ...)\nif err != nil && strings.Contains(err.Error(), \"AzureDNS\") {\n    return fmt.Errorf(\"verify Azure service principal and DNS Zone Contributor role: %w\", err)\n}","preventionTips":["Include all five Azure values in the credential string","Assign DNS Zone Contributor on the zone's resource group","Confirm subscription/resource group match where the zone lives"],"tags":["acme","dns-01","azuredns","credentials"],"backgroundTag":"dns-provider-auth-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}