# DNS Update (RFC2136)


<!-- Code generated by gen-dns-providers; DO NOT EDIT. -->

Configuration for the [DNS Update (RFC2136)](https://www.rfc-editor.org/rfc/rfc2136.html) DNS provider.

See the [lego documentation](https://go-acme.github.io/lego/dns/rfc2136/) for full details.

```yaml
letsEncrypt:
  dnsProvider: "rfc2136"
  dnsCredentials:
    # DNSUPDATE_NAMESERVER: Network address in the form "host" or "host:port"
    nameserver: ""
    # DNSUPDATE_DNS_TIMEOUT: API request timeout in seconds (Default: 10)
    dnsTimeout: ""
    # DNSUPDATE_POLLING_INTERVAL: Time between DNS propagation check in seconds (Default: 2)
    pollingInterval: ""
    # DNSUPDATE_PROPAGATION_TIMEOUT: Maximum waiting time for DNS propagation in seconds (Default: 60)
    propagationTimeout: ""
    # DNSUPDATE_SEQUENCE_INTERVAL: Time between sequential requests in seconds (Default: 60)
    sequenceInterval: ""
    # DNSUPDATE_TSIG_ALGORITHM: TSIG algorithm. See [miekg/dns#tsig.go](https://github.com/miekg/dns/blob/master/tsig.go) for supported values. To disable TSIG authentication, leave the `DNSUPDATE_TSIG_KEY` or `DNSUPDATE_TSIG_SECRET` variables unset.
    tsigAlgorithm: ""
    # DNSUPDATE_TSIG_FILE: Path to a key file generated by tsig-keygen
    tsigFile: ""
    # DNSUPDATE_TSIG_GSS_KEYTAB_FILE: Path to Kerberos keytab file. The TSIG algorithm must be `gss-tsig.`.
    tsigGSSKeytabFile: ""
    # DNSUPDATE_TSIG_GSS_PASSWORD: Kerberos password. The TSIG algorithm must be `gss-tsig.`.
    tsigGSSPassword: ""
    # DNSUPDATE_TSIG_GSS_REALM: Kerberos realm. The TSIG algorithm must be `gss-tsig.`.
    tsigGSSRealm: ""
    # DNSUPDATE_TSIG_GSS_USERNAME: Kerberos username. The TSIG algorithm must be `gss-tsig.`.
    tsigGSSUsername: ""
    # DNSUPDATE_TSIG_KEY: Name of the secret key as defined in DNS server configuration. To disable TSIG authentication, leave the `DNSUPDATE_TSIG_KEY` variable unset.
    tsigKey: ""
    # DNSUPDATE_TSIG_SECRET: Secret key payload. To disable TSIG authentication, leave the `DNSUPDATE_TSIG_SECRET` variable unset.
    tsigSecret: ""
    # DNSUPDATE_TTL: The TTL of the TXT record used for the DNS challenge in seconds (Default: 120)
    ttl: ""
```

Credentials are passed directly to lego using strong types and are never written to the process environment.
You may also use the raw lego environment-variable names as keys instead of the normalized names.