acme-dns, a limited scope DNS server with a REST API, purpose built to answer ACME DNS-01 challenges without exposing your production DNS zone.
acme-dns is an open source, deliberately minimal DNS server with a small RESTful HTTP API, built for a single job: answering the DNS-01 challenges that certificate authorities use to verify domain control. Rather than giving certificate automation broad credentials for your real DNS provider, you delegate one dedicated subdomain to acme-dns and point a CNAME at it, so each enrolled client can update only its own private subdomain and nothing else. It runs as one static binary with an embedded datastore, and every major ACME client already speaks its three endpoint API.
The cloudimg image is hardened and fully patched, with acme-dns preconfigured and running as a dedicated unprivileged service that holds only the capability it needs to bind low ports. It ships with no default, shared or example credentials: first boot mints a per instance TLS certificate for the API, generates a challenge zone unique to that instance, enrols its API account through the product's own registration endpoint, and proves the path end to end before completing. A start time guard refuses to serve any published example configuration. Every instance is backed by a paired deploy guide and 24/7 cloudimg support.