Problems with DNS Persist Mode and Let's Encrypt

[PassiveMortal]

I'm getting an error trying to use DNS Persist Mode with Let's Encrypt (other challenge methods are working fine). I also want this to be a wildcard certificate.
Here's what I'm trying (note: I have tried to replace actual domain names and other identifying info in the examples below):

Set Let’s Encrypt as the Default CA:
acme.sh --set-default-ca --server letsencrypt

Get the DNS Persist Mode TXT record value:
acme.sh --make-dns-persist-value --dns-persist-wildcard -d example.com

I get a result like this:
TXT persist domain:_validation-persist.example.com
TXT persist value :"letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/9999999999; policy=wildcard"

I create the DNS TXT record.
Testing via a DNS query using a remote server I see that the _validation-persist.example.com TXT record returns:
"letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/9999999999; policy=wildcard"

I issue the certificate:
acme.sh --issue --keylength 2048 --dns-persist -d example.com -d '*.example.com'
I get this error:
Using CA: https://acme-v02.api.letsencrypt.org/directory
Multi domain='DNS:example.com,DNS:*.example.com'
Getting webroot for domain='example.com'
Cannot get domain token entry example.com for dns-persist-01
Supported validation types are: tls-alpn-01 http-01 dns-01 , but you specified: dns-persist-01
Please add '--debug' or '--log' to see more information.
See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh

Can anyone advise as to what I'm doing wrong?

[YCistak]

You're not doing anything wrong on the DNS side. That error comes from the CA, not from your TXT record. acme.sh asks the CA for the authorization of example.com, looks for a challenge of the type you requested, and prints what the CA actually offered:

Supported validation types are: tls-alpn-01 http-01 dns-01 , but you specified: dns-persist-01

So Let's Encrypt's production endpoint (acme-v02.api.letsencrypt.org) isn't offering dns-persist-01 for your order. The TXT record is never even checked. Let's Encrypt announced the challenge type in February (dns-persist-01) with a staged rollout, staging first and production later. Until production offers it, acme.sh can't use it there.

What you can do:

• Test against staging. If staging offers it, you'll see the full flow work: acme.sh --issue --server letsencrypt_test --dns-persist -d example.com -d '*.example.com'. Note that staging is a separate account, so the accounturi in the TXT record must be your staging account URI. Run --make-dns-persist-value again with --server letsencrypt_test to get it.
• For a production wildcard today, use regular dns-01 (--dns dns_xxx with your DNS provider's API, or --dns --yes-I-know-dns-manual-mode-enough-go-ahead-please for manual mode).
• Keep the _validation-persist record. Once Let's Encrypt enables dns-persist-01 in production, the same --dns-persist command will work without touching DNS again (as long as the account stays the same).

A quick way to check later whether production supports it: the same --issue command will stop listing only tls-alpn-01 http-01 dns-01.

[PassiveMortal]

Thanks @YCistak for the clear response (I suspected the error was coming form Let's Encrypt but I wasn't sure). For testing, and to confirm that I was issuing the commands correctly, I successfully issued the certificate by adding the --server letsencrypt_test parameter to the following commands:
acme.sh --make-dns-persist-value --dns-persist-wildcard -d example.com --server letsencrypt_test
acme.sh --issue --keylength 2048 --dns-persist -d example.com -d '*.example.com' --server letsencrypt_test
Both of the above commands worked correctly.

Unfortunately, the Let's Encrypt Staging Environment "has four active root certificates which are not present in browser/client trust stores" (as I'm sure you know) so this won't work for any production SSL certificates at this time. Hopefully Let's Encrypt will offer DNS Persist Mode on their production endpoint sometime soon.

Cheers!