Comment by reincarnate0x14
3 years ago
If you have split DNS you're not even leaking internal addresses, the public name record just has to exist.
3 years ago
If you have split DNS you're not even leaking internal addresses, the public name record just has to exist.
> […] the public name record just has to exist.
Specifically a TXT record for _acme-challenge has to exist for the requested hostname. Or a CNAME of the requested hostname pointing somewhere else that you control:
* https://dan.langille.org/2019/02/01/acme-domain-alias-mode/
* https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo...
* https://www.eff.org/deeplinks/2018/02/technical-deep-dive-se...
No A (or AAAA) records needed.