We use two DNS providers for redundancy. Since the DynDNS DDOS attack of 2016, I expect we are not alone in this practice.
I am attempting to use the Let's Encrypt certbot with DNS challenge. Having two DNS providers seems to pose a problem. Do both DNS providers need to be updated with identical TXT records as part of the challenge process?
The real question is, how does the Let's Encrypt ACME Certificate Authority (CA) validate DNS TXT entries? Does it simply query the public DNS like any client would, or does it query against the specific DNS provider that maps to the certbot plugin I'm using? I suspect the former.
I attempted to create a certificate using only one of the plugins. The TXT entries were created, but validation failed. I expect I will need to update both DNS providers (or figure out how to link the two providers so they synchronize changes).
The documentation doesn't seem to indicate that using multiple plugins of the same type is possible, although I haven't tried it yet. One of my providers requires that I upgrade to gain access to their API.
If it is not possible to chain multiple authentication plugins, then I believe my only option for automated renewal is using the pre- and post-hooks with a custom script to modify both DNS providers.
I'd appreciate confirmation of this before I undertake the work and expense required (or choose to manage the renewal process manually).
EDIT: I'm aware that StackExchange wrote and published its own open-source DNS updater, dnscontrol, which could be used in pre- and post-hook scripts. However, one of our providers is not supported.