onetimesecret/onetimesecret · error · Onetime::Problem

TXT record hostname can only contain letters, numbers, dots,

Error message

TXT record hostname can only contain letters, numbers, dots, underscores, and hyphens

What it means

Error "TXT record hostname can only contain letters, numbers, dots, underscores, and hyphens" thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/models/custom_domain.rb:592

    def allow_public_api?
      api_config = ApiConfig.find_by_domain_id(identifier)
      unless api_config
        OT.le "[CustomDomain] ApiConfig missing for domain #{identifier}; using safe default (false). Run migration 20260417_01_backfill_homepage_config to repair."
        return false
      end

      api_config.enabled?
    end

    # Validates the format of TXT record host and value used for domain verification.
    # The host must be alphanumeric with dots, underscores, or hyphens only.
    # The value must be a 32-character hexadecimal string.
    #
    # @raise [Onetime::Problem] If the TXT record host or value format is invalid
    # @return [void]
    def validate_txt_record!
      unless txt_validation_host.to_s.match?(/\A[a-zA-Z0-9._-]+\z/)
        raise Onetime::Problem, 'TXT record hostname can only contain letters, numbers, dots, underscores, and hyphens'
      end

      return if txt_validation_value.to_s.match?(/\A[a-f0-9]{32}\z/)

      raise Onetime::Problem, 'TXT record value must be a 32-character hexadecimal string'
    end

    # Generates a TXT record for domain ownership verification.
    # Format: _onetime-challenge-<short_id>[.subdomain]
    #
    # The record consists of:
    # - A prefix (_onetime-challenge-)
    # - First 7 chars of the domain identifier
    # - Subdomain parts if present (e.g. .www or .status.www)
    # - A 32-char random hex value
    #
    # @return [Array<String, String>] The TXT record host and value
    # @raise [Onetime::Problem] If the generated record is invalid

View on GitHub (pinned to f81295e41b)

Solutions

1. Remove invalid characters from the TXT record hostname; use only letters, numbers, dots, underscores, and hyphens.

When it happens

Trigger: Thrown at lib/onetime/models/custom_domain.rb:592 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/6bca2ebfd42bf193. Report an issue: GitHub.