fix: netcup and DuckDNS.

vendor/github.com/xenolf/lego/acme/dns_challenge.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/miekg/dns"
@@ -18,8 +19,9 @@ type preCheckDNSFunc func(fqdn, value string) (bool, error)
 var (
 	// PreCheckDNS checks DNS propagation before notifying ACME that
 	// the DNS challenge is ready.
-	PreCheckDNS preCheckDNSFunc = checkDNSPropagation
-	fqdnToZone                  = map[string]string{}
+	PreCheckDNS  preCheckDNSFunc = checkDNSPropagation
+	fqdnToZone                   = map[string]string{}
+	muFqdnToZone sync.Mutex
 )
 
 const defaultResolvConf = "/etc/resolv.conf"
@@ -262,6 +264,9 @@ func lookupNameservers(fqdn string) ([]string, error) {
 // FindZoneByFqdn determines the zone apex for the given fqdn by recursing up the
 // domain labels until the nameserver returns a SOA record in the answer section.
 func FindZoneByFqdn(fqdn string, nameservers []string) (string, error) {
+	muFqdnToZone.Lock()
+	defer muFqdnToZone.Unlock()
+
 	// Do we have it cached?
 	if zone, ok := fqdnToZone[fqdn]; ok {
 		return zone, nil

vendor/github.com/xenolf/lego/providers/dns/auroradns/auroradns.go

@@ -1,3 +1,4 @@
+// Package auroradns implements a DNS provider for solving the DNS-01 challenge using Aurora DNS.
 package auroradns
 
 import (
@@ -6,9 +7,7 @@ import (
 	"sync"
 	"time"
 
-	"github.com/edeckers/auroradnsclient"
-	"github.com/edeckers/auroradnsclient/records"
-	"github.com/edeckers/auroradnsclient/zones"
+	"github.com/ldez/go-auroradns"
 	"github.com/xenolf/lego/acme"
 	"github.com/xenolf/lego/platform/config/env"
 )
@@ -39,7 +38,7 @@ type DNSProvider struct {
 	recordIDs   map[string]string
 	recordIDsMu sync.Mutex
 	config      *Config
-	client      *auroradnsclient.AuroraDNSClient
+	client      *auroradns.Client
 }
 
 // NewDNSProvider returns a DNSProvider instance configured for AuroraDNS.
@@ -85,7 +84,12 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		config.BaseURL = defaultBaseURL
 	}
 
-	client, err := auroradnsclient.NewAuroraDNSClient(config.BaseURL, config.UserID, config.Key)
+	tr, err := auroradns.NewTokenTransport(config.UserID, config.Key)
+	if err != nil {
+		return nil, fmt.Errorf("aurora: %v", err)
+	}
+
+	client, err := auroradns.NewClient(tr.Client(), auroradns.WithBaseURL(config.BaseURL))
 	if err != nil {
 		return nil, fmt.Errorf("aurora: %v", err)
 	}
@@ -117,26 +121,25 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
 
 	authZone = acme.UnFqdn(authZone)
 
-	zoneRecord, err := d.getZoneInformationByName(authZone)
+	zone, err := d.getZoneInformationByName(authZone)
 	if err != nil {
 		return fmt.Errorf("aurora: could not create record: %v", err)
 	}
 
-	reqData :=
-		records.CreateRecordRequest{
-			RecordType: "TXT",
-			Name:       subdomain,
-			Content:    value,
-			TTL:        d.config.TTL,
-		}
+	record := auroradns.Record{
+		RecordType: "TXT",
+		Name:       subdomain,
+		Content:    value,
+		TTL:        d.config.TTL,
+	}
 
-	respData, err := d.client.CreateRecord(zoneRecord.ID, reqData)
+	newRecord, _, err := d.client.CreateRecord(zone.ID, record)
 	if err != nil {
 		return fmt.Errorf("aurora: could not create record: %v", err)
 	}
 
 	d.recordIDsMu.Lock()
-	d.recordIDs[fqdn] = respData.ID
+	d.recordIDs[fqdn] = newRecord.ID
 	d.recordIDsMu.Unlock()
 
 	return nil
@@ -161,12 +164,12 @@ func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
 
 	authZone = acme.UnFqdn(authZone)
 
-	zoneRecord, err := d.getZoneInformationByName(authZone)
+	zone, err := d.getZoneInformationByName(authZone)
 	if err != nil {
 		return err
 	}
 
-	_, err = d.client.RemoveRecord(zoneRecord.ID, recordID)
+	_, _, err = d.client.DeleteRecord(zone.ID, recordID)
 	if err != nil {
 		return err
 	}
@@ -184,10 +187,10 @@ func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
 	return d.config.PropagationTimeout, d.config.PollingInterval
 }
 
-func (d *DNSProvider) getZoneInformationByName(name string) (zones.ZoneRecord, error) {
-	zs, err := d.client.GetZones()
+func (d *DNSProvider) getZoneInformationByName(name string) (auroradns.Zone, error) {
+	zs, _, err := d.client.ListZones()
 	if err != nil {
-		return zones.ZoneRecord{}, err
+		return auroradns.Zone{}, err
 	}
 
 	for _, element := range zs {
@@ -196,5 +199,5 @@ func (d *DNSProvider) getZoneInformationByName(name string) (zones.ZoneRecord, e
 		}
 	}
 
-	return zones.ZoneRecord{}, fmt.Errorf("could not find Zone record")
+	return auroradns.Zone{}, fmt.Errorf("could not find Zone record")
 }

vendor/github.com/xenolf/lego/providers/dns/azure/azure.go

@@ -7,6 +7,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"strings"
 	"time"
@@ -15,18 +16,26 @@ import (
 	"github.com/Azure/go-autorest/autorest"
 	"github.com/Azure/go-autorest/autorest/adal"
 	"github.com/Azure/go-autorest/autorest/azure"
+	"github.com/Azure/go-autorest/autorest/azure/auth"
 	"github.com/Azure/go-autorest/autorest/to"
 	"github.com/xenolf/lego/acme"
 	"github.com/xenolf/lego/platform/config/env"
 )
 
+const defaultMetadataEndpoint = "http://169.254.169.254"
+
 // Config is used to configure the creation of the DNSProvider
 type Config struct {
-	ClientID           string
-	ClientSecret       string
-	SubscriptionID     string
-	TenantID           string
-	ResourceGroup      string
+	// optional if using instance metadata service
+	ClientID     string
+	ClientSecret string
+	TenantID     string
+
+	SubscriptionID string
+	ResourceGroup  string
+
+	MetadataEndpoint string
+
 	PropagationTimeout time.Duration
 	PollingInterval    time.Duration
 	TTL                int
@@ -39,29 +48,26 @@ func NewDefaultConfig() *Config {
 		TTL:                env.GetOrDefaultInt("AZURE_TTL", 60),
 		PropagationTimeout: env.GetOrDefaultSecond("AZURE_PROPAGATION_TIMEOUT", 2*time.Minute),
 		PollingInterval:    env.GetOrDefaultSecond("AZURE_POLLING_INTERVAL", 2*time.Second),
+		MetadataEndpoint:   env.GetOrFile("AZURE_METADATA_ENDPOINT"),
 	}
 }
 
 // DNSProvider is an implementation of the acme.ChallengeProvider interface
 type DNSProvider struct {
-	config *Config
+	config     *Config
+	authorizer autorest.Authorizer
 }
 
 // NewDNSProvider returns a DNSProvider instance configured for azure.
-// Credentials must be passed in the environment variables: AZURE_CLIENT_ID,
-// AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_RESOURCE_GROUP
+// Credentials can be passed in the environment variables:
+// AZURE_CLIENT_ID, AZURE_CLIENT_SECRET, AZURE_SUBSCRIPTION_ID, AZURE_TENANT_ID, AZURE_RESOURCE_GROUP
+// If the credentials are _not_ set via the environment,
+// then it will attempt to get a bearer token via the instance metadata service.
+// see: https://github.com/Azure/go-autorest/blob/v10.14.0/autorest/azure/auth/auth.go#L38-L42
 func NewDNSProvider() (*DNSProvider, error) {
-	values, err := env.Get("AZURE_CLIENT_ID", "AZURE_CLIENT_SECRET", "AZURE_SUBSCRIPTION_ID", "AZURE_TENANT_ID", "AZURE_RESOURCE_GROUP")
-	if err != nil {
-		return nil, fmt.Errorf("azure: %v", err)
-	}
-
 	config := NewDefaultConfig()
-	config.ClientID = values["AZURE_CLIENT_ID"]
-	config.ClientSecret = values["AZURE_CLIENT_SECRET"]
-	config.SubscriptionID = values["AZURE_SUBSCRIPTION_ID"]
-	config.TenantID = values["AZURE_TENANT_ID"]
-	config.ResourceGroup = values["AZURE_RESOURCE_GROUP"]
+	config.SubscriptionID = env.GetOrFile("AZURE_SUBSCRIPTION_ID")
+	config.ResourceGroup = env.GetOrFile("AZURE_RESOURCE_GROUP")
 
 	return NewDNSProviderConfig(config)
 }
@@ -73,8 +79,8 @@ func NewDNSProviderCredentials(clientID, clientSecret, subscriptionID, tenantID,
 	config := NewDefaultConfig()
 	config.ClientID = clientID
 	config.ClientSecret = clientSecret
-	config.SubscriptionID = subscriptionID
 	config.TenantID = tenantID
+	config.SubscriptionID = subscriptionID
 	config.ResourceGroup = resourceGroup
 
 	return NewDNSProviderConfig(config)
@@ -86,11 +92,40 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("azure: the configuration of the DNS provider is nil")
 	}
 
-	if config.ClientID == "" || config.ClientSecret == "" || config.SubscriptionID == "" || config.TenantID == "" || config.ResourceGroup == "" {
-		return nil, errors.New("azure: some credentials information are missing")
+	if config.HTTPClient == nil {
+		config.HTTPClient = http.DefaultClient
 	}
 
-	return &DNSProvider{config: config}, nil
+	authorizer, err := getAuthorizer(config)
+	if err != nil {
+		return nil, err
+	}
+
+	if config.SubscriptionID == "" {
+		subsID, err := getMetadata(config, "subscriptionId")
+		if err != nil {
+			return nil, fmt.Errorf("azure: %v", err)
+		}
+
+		if subsID == "" {
+			return nil, errors.New("azure: SubscriptionID is missing")
+		}
+		config.SubscriptionID = subsID
+	}
+
+	if config.ResourceGroup == "" {
+		resGroup, err := getMetadata(config, "resourceGroupName")
+		if err != nil {
+			return nil, fmt.Errorf("azure: %v", err)
+		}
+
+		if resGroup == "" {
+			return nil, errors.New("azure: ResourceGroup is missing")
+		}
+		config.ResourceGroup = resGroup
+	}
+
+	return &DNSProvider{config: config, authorizer: authorizer}, nil
 }
 
 // Timeout returns the timeout and interval to use when checking for DNS
@@ -110,12 +145,7 @@ func (d *DNSProvider) Present(domain, token, keyAuth string) error {
 	}
 
 	rsc := dns.NewRecordSetsClient(d.config.SubscriptionID)
-	spt, err := d.newServicePrincipalToken(azure.PublicCloud.ResourceManagerEndpoint)
-	if err != nil {
-		return fmt.Errorf("azure: %v", err)
-	}
-
-	rsc.Authorizer = autorest.NewBearerAuthorizer(spt)
+	rsc.Authorizer = d.authorizer
 
 	relative := toRelativeRecord(fqdn, acme.ToFqdn(zone))
 	rec := dns.RecordSet{
@@ -145,12 +175,7 @@ func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
 
 	relative := toRelativeRecord(fqdn, acme.ToFqdn(zone))
 	rsc := dns.NewRecordSetsClient(d.config.SubscriptionID)
-	spt, err := d.newServicePrincipalToken(azure.PublicCloud.ResourceManagerEndpoint)
-	if err != nil {
-		return fmt.Errorf("azure: %v", err)
-	}
-
-	rsc.Authorizer = autorest.NewBearerAuthorizer(spt)
+	rsc.Authorizer = d.authorizer
 
 	_, err = rsc.Delete(ctx, d.config.ResourceGroup, zone, relative, dns.TXT, "")
 	if err != nil {
@@ -166,14 +191,8 @@ func (d *DNSProvider) getHostedZoneID(ctx context.Context, fqdn string) (string,
 		return "", err
 	}
 
-	// Now we want to to Azure and get the zone.
-	spt, err := d.newServicePrincipalToken(azure.PublicCloud.ResourceManagerEndpoint)
-	if err != nil {
-		return "", err
-	}
-
 	dc := dns.NewZonesClient(d.config.SubscriptionID)
-	dc.Authorizer = autorest.NewBearerAuthorizer(spt)
+	dc.Authorizer = d.authorizer
 
 	zone, err := dc.Get(ctx, d.config.ResourceGroup, acme.UnFqdn(authZone))
 	if err != nil {
@@ -184,17 +203,61 @@ func (d *DNSProvider) getHostedZoneID(ctx context.Context, fqdn string) (string,
 	return to.String(zone.Name), nil
 }
 
-// NewServicePrincipalTokenFromCredentials creates a new ServicePrincipalToken using values of the
-// passed credentials map.
-func (d *DNSProvider) newServicePrincipalToken(scope string) (*adal.ServicePrincipalToken, error) {
-	oauthConfig, err := adal.NewOAuthConfig(azure.PublicCloud.ActiveDirectoryEndpoint, d.config.TenantID)
-	if err != nil {
-		return nil, err
-	}
-	return adal.NewServicePrincipalToken(*oauthConfig, d.config.ClientID, d.config.ClientSecret, scope)
-}
-
 // Returns the relative record to the domain
 func toRelativeRecord(domain, zone string) string {
 	return acme.UnFqdn(strings.TrimSuffix(domain, zone))
 }
+
+func getAuthorizer(config *Config) (autorest.Authorizer, error) {
+	if config.ClientID != "" && config.ClientSecret != "" && config.TenantID != "" {
+		oauthConfig, err := adal.NewOAuthConfig(azure.PublicCloud.ActiveDirectoryEndpoint, config.TenantID)
+		if err != nil {
+			return nil, err
+		}
+
+		spt, err := adal.NewServicePrincipalToken(*oauthConfig, config.ClientID, config.ClientSecret, azure.PublicCloud.ResourceManagerEndpoint)
+		if err != nil {
+			return nil, err
+		}
+
+		spt.SetSender(config.HTTPClient)
+		return autorest.NewBearerAuthorizer(spt), nil
+	}
+
+	return auth.NewAuthorizerFromEnvironment()
+}
+
+// Fetches metadata from environment or he instance metadata service
+// borrowed from https://github.com/Microsoft/azureimds/blob/master/imdssample.go
+func getMetadata(config *Config, field string) (string, error) {
+	metadataEndpoint := config.MetadataEndpoint
+	if len(metadataEndpoint) == 0 {
+		metadataEndpoint = defaultMetadataEndpoint
+	}
+
+	resource := fmt.Sprintf("%s/metadata/instance/compute/%s", metadataEndpoint, field)
+	req, err := http.NewRequest(http.MethodGet, resource, nil)
+	if err != nil {
+		return "", err
+	}
+
+	req.Header.Add("Metadata", "True")
+
+	q := req.URL.Query()
+	q.Add("format", "text")
+	q.Add("api-version", "2017-12-01")
+	req.URL.RawQuery = q.Encode()
+
+	resp, err := config.HTTPClient.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+
+	respBody, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return "", err
+	}
+
+	return string(respBody[:]), nil
+}

vendor/github.com/xenolf/lego/providers/dns/dnsmadeeasy/client.go

@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"time"
 )
@@ -27,6 +28,10 @@ type Record struct {
 	SourceID int    `json:"sourceId"`
 }
 
+type recordsResponse struct {
+	Records *[]Record `json:"data"`
+}
+
 // Client DNSMadeEasy client
 type Client struct {
 	apiKey     string
@@ -82,10 +87,6 @@ func (c *Client) GetRecords(domain *Domain, recordName, recordType string) (*[]R
 	}
 	defer resp.Body.Close()
 
-	type recordsResponse struct {
-		Records *[]Record `json:"data"`
-	}
-
 	records := &recordsResponse{}
 	err = json.NewDecoder(resp.Body).Decode(&records)
 	if err != nil {
@@ -151,7 +152,11 @@ func (c *Client) sendRequest(method, resource string, payload interface{}) (*htt
 	}
 
 	if resp.StatusCode > 299 {
-		return nil, fmt.Errorf("DNSMadeEasy API request failed with HTTP status code %d", resp.StatusCode)
+		body, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return nil, fmt.Errorf("request failed with HTTP status code %d", resp.StatusCode)
+		}
+		return nil, fmt.Errorf("request failed with HTTP status code %d: %s", resp.StatusCode, string(body))
 	}
 
 	return resp, nil

vendor/github.com/xenolf/lego/providers/dns/dnsmadeeasy/dnsmadeeasy.go

@@ -1,3 +1,4 @@
+// Package dnsmadeeasy implements a DNS provider for solving the DNS-01 challenge using DNS Made Easy.
 package dnsmadeeasy
 
 import (
@@ -112,13 +113,13 @@ func (d *DNSProvider) Present(domainName, token, keyAuth string) error {
 
 	authZone, err := acme.FindZoneByFqdn(fqdn, acme.RecursiveNameservers)
 	if err != nil {
-		return err
+		return fmt.Errorf("dnsmadeeasy: unable to find zone for %s: %v", fqdn, err)
 	}
 
 	// fetch the domain details
 	domain, err := d.client.GetDomain(authZone)
 	if err != nil {
-		return err
+		return fmt.Errorf("dnsmadeeasy: unable to get domain for zone %s: %v", authZone, err)
 	}
 
 	// create the TXT record
@@ -126,7 +127,10 @@ func (d *DNSProvider) Present(domainName, token, keyAuth string) error {
 	record := &Record{Type: "TXT", Name: name, Value: value, TTL: d.config.TTL}
 
 	err = d.client.CreateRecord(domain, record)
-	return err
+	if err != nil {
+		return fmt.Errorf("dnsmadeeasy: unable to create record for %s: %v", name, err)
+	}
+	return nil
 }
 
 // CleanUp removes the TXT records matching the specified parameters
@@ -135,31 +139,32 @@ func (d *DNSProvider) CleanUp(domainName, token, keyAuth string) error {
 
 	authZone, err := acme.FindZoneByFqdn(fqdn, acme.RecursiveNameservers)
 	if err != nil {
-		return err
+		return fmt.Errorf("dnsmadeeasy: unable to find zone for %s: %v", fqdn, err)
 	}
 
 	// fetch the domain details
 	domain, err := d.client.GetDomain(authZone)
 	if err != nil {
-		return err
+		return fmt.Errorf("dnsmadeeasy: unable to get domain for zone %s: %v", authZone, err)
 	}
 
 	// find matching records
 	name := strings.Replace(fqdn, "."+authZone, "", 1)
 	records, err := d.client.GetRecords(domain, name, "TXT")
 	if err != nil {
-		return err
+		return fmt.Errorf("dnsmadeeasy: unable to get records for domain %s: %v", domain.Name, err)
 	}
 
 	// delete records
+	var lastError error
 	for _, record := range *records {
 		err = d.client.DeleteRecord(record)
 		if err != nil {
-			return err
+			lastError = fmt.Errorf("dnsmadeeasy: unable to delete record [id=%d, name=%s]: %v", record.ID, record.Name, err)
 		}
 	}
 
-	return nil
+	return lastError
 }
 
 // Timeout returns the timeout and interval to use when checking for DNS propagation.

vendor/github.com/xenolf/lego/providers/dns/dreamhost/dreamhost.go

@@ -1,4 +1,4 @@
-// Package dreamhost Adds lego support for http://dreamhost.com DNS updates
+// Package dreamhost implements a DNS provider for solving the DNS-01 challenge using DreamHost.
 // See https://help.dreamhost.com/hc/en-us/articles/217560167-API_overview
 // and https://help.dreamhost.com/hc/en-us/articles/217555707-DNS-API-commands for the API spec.
 package dreamhost

vendor/github.com/xenolf/lego/providers/dns/duckdns/duckdns.go

@@ -1,4 +1,4 @@
-// Package duckdns Adds lego support for http://duckdns.org.
+// Package duckdns implements a DNS provider for solving the DNS-01 challenge using DuckDNS.
 // See http://www.duckdns.org/spec.jsp for more info on updating TXT records.
 package duckdns
 
@@ -7,8 +7,12 @@ import (
 	"fmt"
 	"io/ioutil"
 	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
 	"time"
 
+	"github.com/miekg/dns"
 	"github.com/xenolf/lego/acme"
 	"github.com/xenolf/lego/platform/config/env"
 )
@@ -96,9 +100,16 @@ func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
 // To update the TXT record we just need to make one simple get request.
 // In DuckDNS you only have one TXT record shared with the domain and all sub domains.
 func updateTxtRecord(domain, token, txt string, clear bool) error {
-	u := fmt.Sprintf("https://www.duckdns.org/update?domains=%s&token=%s&clear=%t&txt=%s", domain, token, clear, txt)
+	u, _ := url.Parse("https://www.duckdns.org/update")
 
-	response, err := acme.HTTPClient.Get(u)
+	query := u.Query()
+	query.Set("domains", getMainDomain(domain))
+	query.Set("token", token)
+	query.Set("clear", strconv.FormatBool(clear))
+	query.Set("txt", txt)
+	u.RawQuery = query.Encode()
+
+	response, err := acme.HTTPClient.Get(u.String())
 	if err != nil {
 		return err
 	}
@@ -115,3 +126,23 @@ func updateTxtRecord(domain, token, txt string, clear bool) error {
 	}
 	return nil
 }
+
+// DuckDNS only lets you write to your subdomain
+// so it must be in format subdomain.duckdns.org
+// not in format subsubdomain.subdomain.duckdns.org
+// so strip off everything that is not top 3 levels
+func getMainDomain(domain string) string {
+	domain = acme.UnFqdn(domain)
+
+	split := dns.Split(domain)
+	if strings.HasSuffix(strings.ToLower(domain), "duckdns.org") {
+		if len(split) < 3 {
+			return ""
+		}
+
+		firstSubDomainIndex := split[len(split)-3]
+		return domain[firstSubDomainIndex:]
+	}
+
+	return domain[split[len(split)-1]:]
+}

vendor/github.com/xenolf/lego/providers/dns/netcup/client.go

@@ -25,27 +25,27 @@ type Request struct {
 	Param  interface{} `json:"param"`
 }
 
-// LoginMsg as specified in netcup WSDL
+// LoginRequest as specified in netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#login
-type LoginMsg struct {
+type LoginRequest struct {
 	CustomerNumber  string `json:"customernumber"`
 	APIKey          string `json:"apikey"`
 	APIPassword     string `json:"apipassword"`
 	ClientRequestID string `json:"clientrequestid,omitempty"`
 }
 
-// LogoutMsg as specified in netcup WSDL
+// LogoutRequest as specified in netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#logout
-type LogoutMsg struct {
+type LogoutRequest struct {
 	CustomerNumber  string `json:"customernumber"`
 	APIKey          string `json:"apikey"`
 	APISessionID    string `json:"apisessionid"`
 	ClientRequestID string `json:"clientrequestid,omitempty"`
 }
 
-// UpdateDNSRecordsMsg as specified in netcup WSDL
+// UpdateDNSRecordsRequest as specified in netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#updateDnsRecords
-type UpdateDNSRecordsMsg struct {
+type UpdateDNSRecordsRequest struct {
 	DomainName      string       `json:"domainname"`
 	CustomerNumber  string       `json:"customernumber"`
 	APIKey          string       `json:"apikey"`
@@ -55,15 +55,15 @@ type UpdateDNSRecordsMsg struct {
 }
 
 // DNSRecordSet as specified in netcup WSDL
-// needed in UpdateDNSRecordsMsg
+// needed in UpdateDNSRecordsRequest
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#Dnsrecordset
 type DNSRecordSet struct {
 	DNSRecords []DNSRecord `json:"dnsrecords"`
 }
 
-// InfoDNSRecordsMsg as specified in netcup WSDL
+// InfoDNSRecordsRequest as specified in netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#infoDnsRecords
-type InfoDNSRecordsMsg struct {
+type InfoDNSRecordsRequest struct {
 	DomainName      string `json:"domainname"`
 	CustomerNumber  string `json:"customernumber"`
 	APIKey          string `json:"apikey"`
@@ -87,33 +87,30 @@ type DNSRecord struct {
 // ResponseMsg as specified in netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php#Responsemessage
 type ResponseMsg struct {
-	ServerRequestID string       `json:"serverrequestid"`
-	ClientRequestID string       `json:"clientrequestid,omitempty"`
-	Action          string       `json:"action"`
-	Status          string       `json:"status"`
-	StatusCode      int          `json:"statuscode"`
-	ShortMessage    string       `json:"shortmessage"`
-	LongMessage     string       `json:"longmessage"`
-	ResponseData    ResponseData `json:"responsedata,omitempty"`
+	ServerRequestID string          `json:"serverrequestid"`
+	ClientRequestID string          `json:"clientrequestid,omitempty"`
+	Action          string          `json:"action"`
+	Status          string          `json:"status"`
+	StatusCode      int             `json:"statuscode"`
+	ShortMessage    string          `json:"shortmessage"`
+	LongMessage     string          `json:"longmessage"`
+	ResponseData    json.RawMessage `json:"responsedata,omitempty"`
 }
 
-// LogoutResponseMsg similar to ResponseMsg
-// allows empty ResponseData field whilst unmarshaling
-type LogoutResponseMsg struct {
-	ServerRequestID string `json:"serverrequestid"`
-	ClientRequestID string `json:"clientrequestid,omitempty"`
-	Action          string `json:"action"`
-	Status          string `json:"status"`
-	StatusCode      int    `json:"statuscode"`
-	ShortMessage    string `json:"shortmessage"`
-	LongMessage     string `json:"longmessage"`
-	ResponseData    string `json:"responsedata,omitempty"`
+func (r *ResponseMsg) Error() string {
+	return fmt.Sprintf("an error occurred during the action %s: [Status=%s, StatusCode=%d, ShortMessage=%s, LongMessage=%s]",
+		r.Action, r.Status, r.StatusCode, r.ShortMessage, r.LongMessage)
 }
 
-// ResponseData to enable correct unmarshaling of ResponseMsg
-type ResponseData struct {
+// LoginResponse response to login action.
+type LoginResponse struct {
+	APISessionID string `json:"apisessionid"`
+}
+
+// InfoDNSRecordsResponse response to infoDnsRecords action.
+type InfoDNSRecordsResponse struct {
 	APISessionID string      `json:"apisessionid"`
-	DNSRecords   []DNSRecord `json:"dnsrecords"`
+	DNSRecords   []DNSRecord `json:"dnsrecords,omitempty"`
 }
 
 // Client netcup DNS client
@@ -126,7 +123,11 @@ type Client struct {
 }
 
 // NewClient creates a netcup DNS client
-func NewClient(customerNumber string, apiKey string, apiPassword string) *Client {
+func NewClient(customerNumber string, apiKey string, apiPassword string) (*Client, error) {
+	if customerNumber == "" || apiKey == "" || apiPassword == "" {
+		return nil, fmt.Errorf("credentials missing")
+	}
+
 	return &Client{
 		customerNumber: customerNumber,
 		apiKey:         apiKey,
@@ -135,7 +136,7 @@ func NewClient(customerNumber string, apiKey string, apiPassword string) *Client
 		HTTPClient: &http.Client{
 			Timeout: 10 * time.Second,
 		},
-	}
+	}, nil
 }
 
 // Login performs the login as specified by the netcup WSDL
@@ -144,7 +145,7 @@ func NewClient(customerNumber string, apiKey string, apiPassword string) *Client
 func (c *Client) Login() (string, error) {
 	payload := &Request{
 		Action: "login",
-		Param: &LoginMsg{
+		Param: &LoginRequest{
 			CustomerNumber:  c.customerNumber,
 			APIKey:          c.apiKey,
 			APIPassword:     c.apiPassword,
@@ -152,21 +153,13 @@ func (c *Client) Login() (string, error) {
 		},
 	}
 
-	response, err := c.sendRequest(payload)
+	var responseData LoginResponse
+	err := c.doRequest(payload, &responseData)
 	if err != nil {
-		return "", fmt.Errorf("error sending request to DNS-API, %v", err)
+		return "", fmt.Errorf("loging error: %v", err)
 	}
 
-	var r ResponseMsg
-
-	err = json.Unmarshal(response, &r)
-	if err != nil {
-		return "", fmt.Errorf("error decoding response of DNS-API, %v", err)
-	}
-	if r.Status != success {
-		return "", fmt.Errorf("error logging into DNS-API, %v", r.LongMessage)
-	}
-	return r.ResponseData.APISessionID, nil
+	return responseData.APISessionID, nil
 }
 
 // Logout performs the logout with the supplied sessionID as specified by the netcup WSDL
@@ -174,7 +167,7 @@ func (c *Client) Login() (string, error) {
 func (c *Client) Logout(sessionID string) error {
 	payload := &Request{
 		Action: "logout",
-		Param: &LogoutMsg{
+		Param: &LogoutRequest{
 			CustomerNumber:  c.customerNumber,
 			APIKey:          c.apiKey,
 			APISessionID:    sessionID,
@@ -182,54 +175,34 @@ func (c *Client) Logout(sessionID string) error {
 		},
 	}
 
-	response, err := c.sendRequest(payload)
+	err := c.doRequest(payload, nil)
 	if err != nil {
-		return fmt.Errorf("error logging out of DNS-API: %v", err)
+		return fmt.Errorf("logout error: %v", err)
 	}
 
-	var r LogoutResponseMsg
-
-	err = json.Unmarshal(response, &r)
-	if err != nil {
-		return fmt.Errorf("error logging out of DNS-API: %v", err)
-	}
-
-	if r.Status != success {
-		return fmt.Errorf("error logging out of DNS-API: %v", r.ShortMessage)
-	}
 	return nil
 }
 
 // UpdateDNSRecord performs an update of the DNSRecords as specified by the netcup WSDL
 // https://ccp.netcup.net/run/webservice/servers/endpoint.php
-func (c *Client) UpdateDNSRecord(sessionID, domainName string, record DNSRecord) error {
+func (c *Client) UpdateDNSRecord(sessionID, domainName string, records []DNSRecord) error {
 	payload := &Request{
 		Action: "updateDnsRecords",
-		Param: UpdateDNSRecordsMsg{
+		Param: UpdateDNSRecordsRequest{
 			DomainName:      domainName,
 			CustomerNumber:  c.customerNumber,
 			APIKey:          c.apiKey,
 			APISessionID:    sessionID,
 			ClientRequestID: "",
-			DNSRecordSet:    DNSRecordSet{DNSRecords: []DNSRecord{record}},
+			DNSRecordSet:    DNSRecordSet{DNSRecords: records},
 		},
 	}
 
-	response, err := c.sendRequest(payload)
+	err := c.doRequest(payload, nil)
 	if err != nil {
-		return err
+		return fmt.Errorf("error when sending the request: %v", err)
 	}
 
-	var r ResponseMsg
-
-	err = json.Unmarshal(response, &r)
-	if err != nil {
-		return err
-	}
-
-	if r.Status != success {
-		return fmt.Errorf("%s: %+v", r.ShortMessage, r)
-	}
 	return nil
 }
 
@@ -239,7 +212,7 @@ func (c *Client) UpdateDNSRecord(sessionID, domainName string, record DNSRecord)
 func (c *Client) GetDNSRecords(hostname, apiSessionID string) ([]DNSRecord, error) {
 	payload := &Request{
 		Action: "infoDnsRecords",
-		Param: InfoDNSRecordsMsg{
+		Param: InfoDNSRecordsRequest{
 			DomainName:      hostname,
 			CustomerNumber:  c.customerNumber,
 			APIKey:          c.apiKey,
@@ -248,82 +221,98 @@ func (c *Client) GetDNSRecords(hostname, apiSessionID string) ([]DNSRecord, erro
 		},
 	}
 
-	response, err := c.sendRequest(payload)
+	var responseData InfoDNSRecordsResponse
+	err := c.doRequest(payload, &responseData)
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error when sending the request: %v", err)
 	}
 
-	var r ResponseMsg
-
-	err = json.Unmarshal(response, &r)
-	if err != nil {
-		return nil, err
-	}
-
-	if r.Status != success {
-		return nil, fmt.Errorf("%s", r.ShortMessage)
-	}
-	return r.ResponseData.DNSRecords, nil
+	return responseData.DNSRecords, nil
 
 }
 
-// sendRequest marshals given body to JSON, send the request to netcup API
+// doRequest marshals given body to JSON, send the request to netcup API
 // and returns body of response
-func (c *Client) sendRequest(payload interface{}) ([]byte, error) {
+func (c *Client) doRequest(payload interface{}, responseData interface{}) error {
 	body, err := json.Marshal(payload)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
 	req, err := http.NewRequest(http.MethodPost, c.BaseURL, bytes.NewReader(body))
 	if err != nil {
-		return nil, err
+		return err
 	}
-	req.Close = true
 
+	req.Close = true
 	req.Header.Set("content-type", "application/json")
 	req.Header.Set("User-Agent", acme.UserAgent)
 
 	resp, err := c.HTTPClient.Do(req)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	if resp.StatusCode > 299 {
-		return nil, fmt.Errorf("API request failed with HTTP Status code %d", resp.StatusCode)
+	if err = checkResponse(resp); err != nil {
+		return err
 	}
 
-	body, err = ioutil.ReadAll(resp.Body)
+	respMsg, err := decodeResponseMsg(resp)
 	if err != nil {
-		return nil, fmt.Errorf("read of response body failed, %v", err)
+		return err
 	}
-	defer resp.Body.Close()
 
-	return body, nil
-}
+	if respMsg.Status != success {
+		return respMsg
+	}
 
-// GetDNSRecordIdx searches a given array of DNSRecords for a given DNSRecord
-// equivalence is determined by Destination and RecortType attributes
-// returns index of given DNSRecord in given array of DNSRecords
-func GetDNSRecordIdx(records []DNSRecord, record DNSRecord) (int, error) {
-	for index, element := range records {
-		if record.Destination == element.Destination && record.RecordType == element.RecordType {
-			return index, nil
+	if responseData != nil {
+		err = json.Unmarshal(respMsg.ResponseData, responseData)
+		if err != nil {
+			return fmt.Errorf("%v: unmarshaling %T error: %v: %s",
+				respMsg, responseData, err, string(respMsg.ResponseData))
 		}
 	}
-	return -1, fmt.Errorf("no DNS Record found")
+
+	return nil
 }
 
-// CreateTxtRecord uses the supplied values to return a DNSRecord of type TXT for the dns-01 challenge
-func CreateTxtRecord(hostname, value string, ttl int) DNSRecord {
-	return DNSRecord{
-		ID:           0,
-		Hostname:     hostname,
-		RecordType:   "TXT",
-		Priority:     "",
-		Destination:  value,
-		DeleteRecord: false,
-		State:        "",
-		TTL:          ttl,
+func checkResponse(resp *http.Response) error {
+	if resp.StatusCode > 299 {
+		if resp.Body == nil {
+			return fmt.Errorf("response body is nil, status code=%d", resp.StatusCode)
+		}
+
+		defer resp.Body.Close()
+
+		raw, err := ioutil.ReadAll(resp.Body)
+		if err != nil {
+			return fmt.Errorf("unable to read body: status code=%d, error=%v", resp.StatusCode, err)
+		}
+
+		return fmt.Errorf("status code=%d: %s", resp.StatusCode, string(raw))
 	}
+
+	return nil
+}
+
+func decodeResponseMsg(resp *http.Response) (*ResponseMsg, error) {
+	if resp.Body == nil {
+		return nil, fmt.Errorf("response body is nil, status code=%d", resp.StatusCode)
+	}
+
+	defer resp.Body.Close()
+
+	raw, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read body: status code=%d, error=%v", resp.StatusCode, err)
+	}
+
+	var respMsg ResponseMsg
+	err = json.Unmarshal(raw, &respMsg)
+	if err != nil {
+		return nil, fmt.Errorf("unmarshaling %T error [status code=%d]: %v: %s", respMsg, resp.StatusCode, err, string(raw))
+	}
+
+	return &respMsg, nil
 }

vendor/github.com/xenolf/lego/providers/dns/netcup/netcup.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"github.com/xenolf/lego/acme"
+	"github.com/xenolf/lego/log"
 	"github.com/xenolf/lego/platform/config/env"
 )
 
@@ -27,8 +28,8 @@ type Config struct {
 func NewDefaultConfig() *Config {
 	return &Config{
 		TTL:                env.GetOrDefaultInt("NETCUP_TTL", 120),
-		PropagationTimeout: env.GetOrDefaultSecond("NETCUP_PROPAGATION_TIMEOUT", acme.DefaultPropagationTimeout),
-		PollingInterval:    env.GetOrDefaultSecond("NETCUP_POLLING_INTERVAL", acme.DefaultPollingInterval),
+		PropagationTimeout: env.GetOrDefaultSecond("NETCUP_PROPAGATION_TIMEOUT", 120*time.Second),
+		PollingInterval:    env.GetOrDefaultSecond("NETCUP_POLLING_INTERVAL", 5*time.Second),
 		HTTPClient: &http.Client{
 			Timeout: env.GetOrDefaultSecond("NETCUP_HTTP_TIMEOUT", 10*time.Second),
 		},
@@ -76,11 +77,11 @@ func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
 		return nil, errors.New("netcup: the configuration of the DNS provider is nil")
 	}
 
-	if config.Customer == "" || config.Key == "" || config.Password == "" {
-		return nil, fmt.Errorf("netcup: netcup credentials missing")
+	client, err := NewClient(config.Customer, config.Key, config.Password)
+	if err != nil {
+		return nil, fmt.Errorf("netcup: %v", err)
 	}
 
-	client := NewClient(config.Customer, config.Key, config.Password)
 	client.HTTPClient = config.HTTPClient
 
 	return &DNSProvider{client: client, config: config}, nil
@@ -100,27 +101,37 @@ func (d *DNSProvider) Present(domainName, token, keyAuth string) error {
 		return fmt.Errorf("netcup: %v", err)
 	}
 
-	hostname := strings.Replace(fqdn, "."+zone, "", 1)
-	record := CreateTxtRecord(hostname, value, d.config.TTL)
-
-	err = d.client.UpdateDNSRecord(sessionID, acme.UnFqdn(zone), record)
-	if err != nil {
-		if errLogout := d.client.Logout(sessionID); errLogout != nil {
-			return fmt.Errorf("netcup: failed to add TXT-Record: %v; %v", err, errLogout)
+	defer func() {
+		err = d.client.Logout(sessionID)
+		if err != nil {
+			log.Print("netcup: %v", err)
 		}
+	}()
+
+	hostname := strings.Replace(fqdn, "."+zone, "", 1)
+	record := createTxtRecord(hostname, value, d.config.TTL)
+
+	zone = acme.UnFqdn(zone)
+
+	records, err := d.client.GetDNSRecords(zone, sessionID)
+	if err != nil {
+		// skip no existing records
+		log.Infof("no existing records, error ignored: %v", err)
+	}
+
+	records = append(records, record)
+
+	err = d.client.UpdateDNSRecord(sessionID, zone, records)
+	if err != nil {
 		return fmt.Errorf("netcup: failed to add TXT-Record: %v", err)
 	}
 
-	err = d.client.Logout(sessionID)
-	if err != nil {
-		return fmt.Errorf("netcup: %v", err)
-	}
 	return nil
 }
 
 // CleanUp removes the TXT record matching the specified parameters
-func (d *DNSProvider) CleanUp(domainname, token, keyAuth string) error {
-	fqdn, value, _ := acme.DNS01Record(domainname, keyAuth)
+func (d *DNSProvider) CleanUp(domainName, token, keyAuth string) error {
+	fqdn, value, _ := acme.DNS01Record(domainName, keyAuth)
 
 	zone, err := acme.FindZoneByFqdn(fqdn, acme.RecursiveNameservers)
 	if err != nil {
@@ -132,6 +143,13 @@ func (d *DNSProvider) CleanUp(domainname, token, keyAuth string) error {
 		return fmt.Errorf("netcup: %v", err)
 	}
 
+	defer func() {
+		err = d.client.Logout(sessionID)
+		if err != nil {
+			log.Print("netcup: %v", err)
+		}
+	}()
+
 	hostname := strings.Replace(fqdn, "."+zone, "", 1)
 
 	zone = acme.UnFqdn(zone)
@@ -141,27 +159,20 @@ func (d *DNSProvider) CleanUp(domainname, token, keyAuth string) error {
 		return fmt.Errorf("netcup: %v", err)
 	}
 
-	record := CreateTxtRecord(hostname, value, 0)
+	record := createTxtRecord(hostname, value, 0)
 
-	idx, err := GetDNSRecordIdx(records, record)
+	idx, err := getDNSRecordIdx(records, record)
 	if err != nil {
 		return fmt.Errorf("netcup: %v", err)
 	}
 
 	records[idx].DeleteRecord = true
 
-	err = d.client.UpdateDNSRecord(sessionID, zone, records[idx])
+	err = d.client.UpdateDNSRecord(sessionID, zone, []DNSRecord{records[idx]})
 	if err != nil {
-		if errLogout := d.client.Logout(sessionID); errLogout != nil {
-			return fmt.Errorf("netcup: %v; %v", err, errLogout)
-		}
 		return fmt.Errorf("netcup: %v", err)
 	}
 
-	err = d.client.Logout(sessionID)
-	if err != nil {
-		return fmt.Errorf("netcup: %v", err)
-	}
 	return nil
 }
 
@@ -170,3 +181,29 @@ func (d *DNSProvider) CleanUp(domainname, token, keyAuth string) error {
 func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
 	return d.config.PropagationTimeout, d.config.PollingInterval
 }
+
+// getDNSRecordIdx searches a given array of DNSRecords for a given DNSRecord
+// equivalence is determined by Destination and RecortType attributes
+// returns index of given DNSRecord in given array of DNSRecords
+func getDNSRecordIdx(records []DNSRecord, record DNSRecord) (int, error) {
+	for index, element := range records {
+		if record.Destination == element.Destination && record.RecordType == element.RecordType {
+			return index, nil
+		}
+	}
+	return -1, fmt.Errorf("no DNS Record found")
+}
+
+// createTxtRecord uses the supplied values to return a DNSRecord of type TXT for the dns-01 challenge
+func createTxtRecord(hostname, value string, ttl int) DNSRecord {
+	return DNSRecord{
+		ID:           0,
+		Hostname:     hostname,
+		RecordType:   "TXT",
+		Priority:     "",
+		Destination:  value,
+		DeleteRecord: false,
+		State:        "",
+		TTL:          ttl,
+	}
+}