AutoSSL wildcard issuance after the cPanel v106 PowerDNS transition with external DNS

Answer the Question First

In cPanel 106+ the authoritative nameserver is PowerDNS. AutoSSL can only write the TXT records required for the DNS‑01 challenge automatically when the zone is stored in PowerDNS or when the domain is managed through a cPanel‑supported provider plugin (e.g., Cloudflare, Route 53). For a domain whose zone is hosted at an external provider that has no plugin, the only supported path is to add the TXT record manually or to use a custom hook that talks to the provider’s API.

Confirmed Facts

• AutoSSL defaults to Let’s Encrypt and uses HTTP‑01 unless a DNS‑01 challenge is required for a wildcard.
• DNS‑01 automation is available only for zones managed by PowerDNS or by a supported provider plugin.
• Enabling the PowerDNS API on the cPanel host does not affect zones that are external; the API is local to the server’s zone database.
• DNSSEC rollovers on a PowerDNS cluster can temporarily break validation if a replica is still behind the primary. The replication delay can be tuned via replication‑delay in pdns.conf, but the effect depends on the cluster topology and the external provider’s DNSSEC policy.

Likely Explanation for Your Scenario

Because your zone lives at an unsupported external provider, AutoSSL cannot push the TXT record automatically. The challenge will fail unless you manually create the record or provide a hook that creates it via the provider’s API. The PowerDNS API can be enabled for your own zones but will not interfere with the external zone, as it cannot reach the external DNS server.

Steps to Automate the DNS‑01 Challenge with a Custom Hook

1. Verify the domain is not listed in cPanel’s zone list. If it is, AutoSSL will work automatically.
2. Create a hook script, e.g. /usr/local/cpanel/hooks/autossl_dns_hook.sh, that accepts $1 (domain), $2 (challenge name), and $3 (challenge value).
3. In the script, call your external provider’s API to add a TXT record for _acme-challenge.$1 with the value $3.
4. Wait for propagation (short sleep or API status check).
5. Return exit code 0 so AutoSSL can continue.
6. After the certificate is issued, delete the TXT record via the same API.

# /usr/local/cpanel/hooks/autossl_dns_hook.sh
#!/bin/bash
set -e
DOMAIN=$1
CHALLENGE=$2
VALUE=$3

# Example: call provider API to add TXT
provider_api add-txt \
  --host=_acme-challenge.$DOMAIN \
  --value=$VALUE

# Optional: wait for propagation
sleep 5

# Return success
exit 0

Make the script executable: chmod +x /usr/local/cpanel/hooks/autossl_dns_hook.sh. Test the hook manually with cPanel‑auto‑ssl --test $DOMAIN before relying on it in production.

Monitoring and Validation

• Check /usr/local/cpanel/logs/autossl.log for “DNS‑01 challenge succeeded” entries.
• Verify the TXT record appears in the external zone (via the provider’s dashboard or dig).
• Watch for DNSSEC validation errors during provider rollovers; tune replication-delay if necessary.

Missing Diagnostic Detail

Which external DNS provider are you using? Knowing the provider will let me suggest a concrete API call for the hook.