Does it work?

[amirych]

The software was installed in the Calculate Linux distro (no systemd)
so I start it by hands ".dnsbox/dnsboxd" with exporting the
needed DNSBOX_DOMAIN="dnsbox.io" DNSBOX_IP="xx.xx.xx.xx"
DNSBOX_NS_NAME=ns3

dig +short xx.xx.xx.xx.dnsbox.io
results as expected:
143.244.206.240

It starts without errors but if I check it by

openssl s_client -connect xx.xx.xx.xx:443 -servername xx.xx.xx.xx.dnsbox.io

I got:

...
[dnsbox] 2025/12/08 21:00:46 [WARN] [letsencrypt] ❌ Authorization failed — TXT deleted for _acme-challenge.xx.xx.xx.xx.dnsbox.io
[dnsbox] 2025/12/08 21:00:46 [ERROR] [httpsproxy] failed to fetch cert for xx.xx.xx.xx.dnsbox.io: acme: authorization error for xx.xx.xx.xx.dnsbox.io: 403 urn:ietf:params:acme:error:unauthorized: No TXT record found at _acme-challenge.xx.xx.xx.xx.dnsbox.io
2025/12/08 21:00:46 http: TLS handshake error from 85.174.183.216:1670: acme: authorization error for xx.xx.xx.xx.dnsbox.io: 403 urn:ietf:params:acme:error:unauthorized: No TXT record found at _acme-challenge.xx.xx.xx.xx.dnsbox.io
[dnsbox] 2025/12/08 21:01:00 [INFO] [httpsproxy] no peer has cert, generating via Let's Encrypt
...

Does the service still work?

[fropsas]

Hi! Thanks for the report — DNSBox is working correctly, and the issue is related to how the self-hosted instance is configured.

Here are the important points:

1. DNSBox works only with public IP addresses

The system is designed for globally reachable public IPs.
Private/local IPs (127.0.0.1, 10.x.x.x, 192.168.x.x, etc.) are not supported for issuing certificates, because Let’s Encrypt must reach your DNS via public Internet.

2. You cannot self-host DNSBox using dnsbox.io as your domain

You’re starting the binary with:

DNSBOX_DOMAIN="dnsbox.io"
DNSBOX_IP="xx.xx.xx.xx"
DNSBOX_NS_NAME=ns3

But dnsbox.io is managed by the public DNSBox service, not by your self-hosted server.
Let’s Encrypt performs ACME validation against the authoritative NS for dnsbox.io, which means your TXT records are never seen.

That's why you get:

No TXT record found at _acme-challenge.xx.xx.xx.xx.dnsbox.io

To self-host DNSBox properly you need to:

1. Buy your own domain (e.g. example.com)
2. Point its NS records to your own servers (ns1.example.com, ns2.example.com)
3. Run DNSBox like this:

./dnsboxd --domain=example.com --ip=<YOUR_PUBLIC_IP> --ns=ns1

Using dnsbox.io as DNSBOX_DOMAIN for self-hosting is not supported.

3. If you only need SSL for a public IP — you don’t need to run DNSBox locally

If your IP is public and you simply need an HTTPS endpoint with a valid Let’s Encrypt certificate, you can use the already-running public service:

https://xx.xx.xx.xx.dnsbox.io

To test via OpenSSL:

openssl s_client -connect xx.xx.xx.xx:443 -servername xx.xx.xx.xx.dnsbox.io

No local installation of DNSBox is required in this case — ACME validation and DNS records are handled by the public dnsbox.io infrastructure.

---

Summary

• ✔️ The public *.dnsbox.io service is working normally
• ❌ Self-hosting with DNSBOX_DOMAIN=dnsbox.io is not possible (you don’t control that zone)
• ✔️ Use the public service for SSL on a public IP or buy your own domain and delegate NS to your own server to run a self-hosted instance

[amirych]

I see! Thanks for such a detailed explanation!
xx.xx.xx.xx is public IP.

My task is to deploy my personal VPN service based on the Openconnect proto (ocserv)
and to complete the setup certificate and its key files are needed. I would not like to use self-signed one.
Is it possible to use a cerficate issued by let's-encrypt for xx.xx.xx.xx.dnsbox.io?