Let's Encrypt INWX DNS provider does not work with lego and PiHole, as SOA response is missing

[malteger]

Describe the issue you are experiencing

If using the dns provider behind a caching DNS server without working SOA responses (e.g. Pi-Hole), the cert cannot be renewed (error inwx: (2303) Object does not exist). It is working when the DNS server in the HAOS network settings is changed to a different DNS server with working SOA responses.

The problem is described in the lego docs at https://go-acme.github.io/lego/usage/cli/options/index.html#dns-resolvers-and-challenge-verification and the solution would be to provide a different resolver to lego. It looks like that this is not possible at the moment, as there is no way to do that using an environment variable.

To fix this a solution is needed to be able to provide a custom DNS server to be used by certbot/lego (e.g. on used by the container).

What type of installation are you running?

Home Assistant OS

Which operating system are you running on?

Home Assistant Operating System

Which app are you reporting an issue with?

Let's Encrypt

What is the version of the app?

6.1.1

Steps to reproduce the issue

1. run addon with DNS server without SOA repsonses
2. error inwx: (2303) Object does not exist
3. Change DNS of the HAOS to one with working SOA, works now
   ...

System Health information

System Information

version	core-2026.3.2
installation_type	Home Assistant OS
dev	false
hassio	true
docker	true
container_arch	amd64
user	root
virtualenv	false
python_version	3.14.2
os_name	Linux
os_version	6.12.67-haos
arch	x86_64
timezone	Europe/Berlin
config_dir	/config

Home Assistant Community Store

GitHub API	ok
GitHub Content	ok
GitHub Web	ok
HACS Data	ok
GitHub API Calls Remaining	5000
Installed Version	2.0.5
Stage	running
Available Repositories	2875
Downloaded Repositories	3

Home Assistant Cloud

logged_in	false
can_reach_cert_server	ok
can_reach_cloud_auth	ok
can_reach_cloud	ok

Home Assistant Supervisor

host_os	Home Assistant OS 17.1
update_channel	stable
supervisor_version	supervisor-2026.03.0
agent_version	1.8.1
docker_version	29.1.3
disk_total	30.8 GB
disk_used	9.2 GB
nameservers	192.168.4.4, 192.168.4.1, fd40:XXX
healthy	true
supported	true
host_connectivity	true
supervisor_connectivity	true
ntp_synchronized	true
virtualization	kvm
board	ova
supervisor_api	ok
version_api	ok
installed_addons	Terminal & SSH (10.0.2), Music Assistant (2.7.11), Let's Encrypt (6.1.1), NGINX Home Assistant SSL proxy (4.1.0), Mosquitto broker (6.5.2), Prometheus Node Exporter (2.0.0)

Dashboards

dashboards	6
resources	2
views	4
mode	storage

Network Configuration

adapters	lo (disabled), enp0s18 (enabled, default, auto), hassio (disabled), docker0 (disabled), veth6077782 (disabled), veth72907b8 (disabled), vethae89aaa (disabled), vetha82d0fa (disabled), veth3bc9d4b (disabled), veth3e3fe76 (disabled), veth5f84ba7 (disabled), vethc0dccab (disabled)
ipv4_addresses	lo (127.0.0.1/8), enp0s18 (192.168.4.10/22), hassio (172.30.32.1/23), docker0 (172.30.232.1/23), veth6077782 (), veth72907b8 (), vethae89aaa (), vetha82d0fa (), veth3bc9d4b (), veth3e3fe76 (), veth5f84ba7 (), vethc0dccab ()
ipv6_addresses	lo (::1/128), enp0s18 (2003:XXX/64, fd40:XXX/64, fe80::XXX/64), hassio (fe80::dcf7:5bff:fe92:28f8/64), docker0 (fe80::644c:9cff:feb4:591f/64), veth6077782 (fe80::1806:cbff:fe52:27fd/64), veth72907b8 (fe80::9cf0:42ff:fe26:10fa/64), vethae89aaa (fe80::cc53:6fff:fee9:7faa/64), vetha82d0fa (fe80::3cbd:eaff:fe3b:d4e2/64), veth3bc9d4b (fe80::3847:e5ff:fe48:47e6/64), veth3e3fe76 (fe80::6818:7ff:fea8:74a5/64), veth5f84ba7 (fe80::f462:3cff:fec6:363c/64), vethc0dccab (fe80::e4c1:fbff:fe55:dad3/64)
announce_addresses	192.168.4.10, 2003:XXX, fd40:XXX, fe80::XXX

Recorder

oldest_recorder_run	21. Februar 2026 um 07:22
current_recorder_run	18. März 2026 um 00:27
estimated_db_size	632.56 MiB
database_engine	sqlite
database_version	3.49.2

Anything in the Supervisor logs that might be useful for us?

Anything in the app logs that might be useful for us?

[16:45:11] INFO: Selected DNS Provider: dns-inwx
[16:45:11] INFO: Use propagation seconds: 60
[16:45:11] INFO: Using certbot-dns-multi for dns-inwx
[16:45:11] INFO: Detecting existing certificate type for home.XXX.de
Saving debug log to /var/log/letsencrypt/letsencrypt.log
[16:45:11] INFO: Existing certificate using 'ecdsa' key type.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for home.XXX.de
Cleanup of home.XXX.de failed: inwx: (2303) Object does not exist
inwx: (2303) Object does not exist
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

Additional information

No response

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[malteger]

This issue has been fixed in the last release by #4528.