PowerShell module · 17.6

List and check the CNAME records of DNS-01 Alias Mode

Two commands help you prepare the CNAME records for DNS-01 Alias Mode before you create the certificate, or hand them to the team that manages the production zone. Both work locally and do not call the Management API, so they need no permission in TLSPilot.

Get-TLSPilotDnsAliasRecords lists the CNAME records. It does not query DNS. A wildcard name *.<domain> counts as <domain>, and duplicate names appear only once:

Get-TLSPilotDnsAliasRecords -Domain 'shop.example.com','www.example.org' `
    -DnsAliasDomain 'servicedomain.net'

Each result has the properties Name, Owner (the CNAME record in the production zone, _acme-challenge.<name>) and Target (_acme-challenge.<name>.<alias domain>).

Test-TLSPilotDnsAliasRecords checks each record at the public resolvers of Cloudflare and Google over DNS over HTTPS, as TLSPilot does before every order:

Test-TLSPilotDnsAliasRecords -Domain 'shop.example.com','www.example.org' `
    -DnsAliasDomain 'servicedomain.net' | Format-Table Owner, Ok, Message

It adds the properties Ok and Message. The messages:

Messages of Test-TLSPilotDnsAliasRecords
Message	Meaning
CNAME _acme-challenge.<name> points at <target>.	The record is correct (`Ok` is `True`).
… is missing. It must point at <target>. Fresh CNAMEs can stay hidden for a few minutes because of negative caching.	No CNAME record found.
… points at <other name>, expected <target>.	The CNAME record has the wrong target.
… has more than one CNAME. Keep a single CNAME to <target>.	Several CNAME records at the same name.
… has a TXT record at the same name. Remove it before the order.	A TXT record exists next to the CNAME record.
… could not check. No DNS-over-HTTPS resolver answered.	Neither resolver answered, for example because outbound HTTPS is blocked. The state of the record is unknown.