DNS-01 with acme.sh, does it delete only the record it created or all related TXT records

[everygamer]

I use CloudFlare, and CloudFlare does edge certificate management with LetsEncrypt. I want to also use acme.sh on the server behind cloudflare to update the local certificate, which is needed for users in network that won't be going through cloudflare (internet only).

CloudFlare is also our DNS, and it supports multiple TXT records for the same subdomain. For example ...

_acme-challenege.my.domainname.com TXT "cloudflare edge certificate validation key"
_acme-challenege.my.domainname.com TXT "my server edge certificate validation key"

So, I suspect that acme.sh can correctly create the new TXT record for my server, but when it does the clean up afterwards to delete the record, will it only delete the record it created with the matching key? or will it remove both?

[Junaid-PK]

With the Cloudflare DNS hook, cleanup is scoped to the exact TXT value that acme.sh added; it does not delete every TXT record at that name.

The current dns_cf_rm() queries Cloudflare with both filters:

GET zones/.../dns_records?type=TXT&name=$fulldomain&content=$txtvalue

It then deletes only the returned record ID. The implementation is here: https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_cf.sh#L128-L158

So the Cloudflare edge-validation value remains as long as it differs from the ACME value created for your origin certificate. Two caveats:

• This answer is specific to dns_cf; cleanup behavior belongs to each DNS-provider hook.
• Use a narrowly scoped Cloudflare API token for the relevant zone, and test one staging issuance first if the existing record is operationally critical.

[neilpang]

Correct. This is also the rule for every dnsapi hook, not just dns_cf:
rm looks the record up by name + TXT value and deletes only that one.