mirror of
https://github.com/rkivalin/certforge.git
synced 2026-10-12 16:00:45 +00:00
DNS clients now accept both `zone` (single) and `zones` (list). Zone matching uses longest suffix: `mail.example.com` matches `example.com`, and `host.sub.example.com` prefers `sub.example.com` over `example.com`. Config validation checks that every certificate domain (via its DNS-01 solver) and every DANE name matches at least one zone in the referenced DNS client. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>