DNS Challenge with provide Ionos

[CrazyVaclav]

Hi, I am trying to use the lego linux cmd tool to perform a dns Challenge for my domains.

The Provide Ionos is officially supported and my IONOS_API_KEY is correct because I tested it with curl:

curl -X GET "https://api.hosting.ionos.com/dns/v1/zones" -H "X-API-Key: <prefix>.<key>"

That returns a JSON Object with all my domains and their id.

When I try to perform a DNS Challenge I get this Error

IONOS_API_KEY=<prefix>.<key> \lego --email [email protected] --dns ionos  --dns.resolvers  1.1.1.1  --domains myDomain run
2023/11/13 15:58:59 [INFO] [myDomain] acme: Obtaining bundled SAN certificate
2023/11/13 15:58:59 [INFO] [myDomain] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/283437662356
2023/11/13 15:58:59 [INFO] [myDomain] acme: Could not find solver for: tls-alpn-01
2023/11/13 15:58:59 [INFO] [myDomain] acme: Could not find solver for: http-01
2023/11/13 15:58:59 [INFO] [myDomain] acme: use dns-01 solver
2023/11/13 15:58:59 [INFO] [myDomain] acme: Preparing to solve DNS-01
2023/11/13 15:59:02 [INFO] [myDomain] acme: Trying to solve DNS-01
2023/11/13 15:59:02 [INFO] [myDomain] acme: Checking DNS record propagation using [1.1.1.1:53]
2023/11/13 15:59:04 [INFO] Wait for propagation [timeout: 1m0s, interval: 2s]
2023/11/13 15:59:04 [INFO] [myDomain] acme: Waiting for DNS record propagation.

...

2023/11/13 16:00:03 [INFO] [myDomain] acme: Waiting for DNS record propagation.
2023/11/13 16:00:05 [INFO] [myDomain] acme: Cleaning DNS-01 challenge
2023/11/13 16:00:21 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/283437662356
2023/11/13 16:00:21 Could not obtain certificates:
        error: one or more domains had a problem:
[myDomain] **time limit exceeded: last error: NS ns1114.ui-dns.de. returned REFUSED for _acme-challenge.myDomain.**

ns1114.ui-dns.de is one of the Nameservers of the Provider Ionos.

I also get the same Error if I choose one of Ionos Nameservers directly with the --dns.resolvers flag

My Knowledge is of the DNS Challange is limited but If I understand it correctly, with the API Key I can modify records in my DNS and letsencrypt is allowed to do so because I give it my API Key.

The TXT record also gets sucessfully created when I run the lego command:

I tried contacting the Ionos Provider but there phone Support does not understand what I mean and the Support ticket is open since a long time with no response

[ldez]

Hello,

the error REFUSED is return during DNS query, so it's a DNS problem.

REFUSED: DNS query failed because the server refused to answer due to policy.

You have to check your local network: firewall, local DNS, etc.