acme.xml

  <para>
   You'll need to mirror the <literal>A</literal>,
   <literal>AAAA</literal> and <literal>NS</literal> records with the
   upstream DNS provider for your domain (here
   <literal>example.com</literal>) so that the CA can resolve the
   acme-dns domain. Note that if your DNS provider doesn't support glue
   records (having both <literal>A</literal>/<literal>AAAA</literal> and
   <literal>NS</literal> records for the same zone), you'll need to set
   <xref linkend="opt-security.acme-dns.general.nsname" />, change the
   zones of the upstream <literal>A</literal>/<literal>AAAA</literal>
   records (but <emphasis>not</emphasis> the ones in the acme-dns
   configuration) to to that configured <literal>nsname</literal>,
   and change the <literal>NS</literal> record to
   <literal>acme-dns.example.com. NS acme-dns-ns.example.com.</literal>
   both upstream and in the acme-dns configuration.
  </para>