Add DNS provider for Netlify. (#1144)

README.md

@@ -57,12 +57,12 @@ Detailed documentation is available [here](https://go-acme.github.io/lego/dns).
 | [HTTP request](https://go-acme.github.io/lego/dns/httpreq/)                     | [Internet Initiative Japan](https://go-acme.github.io/lego/dns/iij/)            | [INWX](https://go-acme.github.io/lego/dns/inwx/)                                | [Joker](https://go-acme.github.io/lego/dns/joker/)                              |
 | [Joohoi's ACME-DNS](https://go-acme.github.io/lego/dns/acme-dns/)               | [Linode (deprecated)](https://go-acme.github.io/lego/dns/linode/)               | [Linode (v4)](https://go-acme.github.io/lego/dns/linodev4/)                     | [Liquid Web](https://go-acme.github.io/lego/dns/liquidweb/)                     |
 | [Manual](https://go-acme.github.io/lego/dns/manual/)                            | [MyDNS.jp](https://go-acme.github.io/lego/dns/mydnsjp/)                         | [MythicBeasts](https://go-acme.github.io/lego/dns/mythicbeasts/)                | [Name.com](https://go-acme.github.io/lego/dns/namedotcom/)                      |
-| [Namecheap](https://go-acme.github.io/lego/dns/namecheap/)                      | [Namesilo](https://go-acme.github.io/lego/dns/namesilo/)                        | [Netcup](https://go-acme.github.io/lego/dns/netcup/)                            | [NIFCloud](https://go-acme.github.io/lego/dns/nifcloud/)                        |
+| [Namecheap](https://go-acme.github.io/lego/dns/namecheap/)                      | [Namesilo](https://go-acme.github.io/lego/dns/namesilo/)                        | [Netcup](https://go-acme.github.io/lego/dns/netcup/)                            | [Netlify](https://go-acme.github.io/lego/dns/netlify/)                          |
-| [NS1](https://go-acme.github.io/lego/dns/ns1/)                                  | [Open Telekom Cloud](https://go-acme.github.io/lego/dns/otc/)                   | [Oracle Cloud](https://go-acme.github.io/lego/dns/oraclecloud/)                 | [OVH](https://go-acme.github.io/lego/dns/ovh/)                                  |
+| [NIFCloud](https://go-acme.github.io/lego/dns/nifcloud/)                        | [NS1](https://go-acme.github.io/lego/dns/ns1/)                                  | [Open Telekom Cloud](https://go-acme.github.io/lego/dns/otc/)                   | [Oracle Cloud](https://go-acme.github.io/lego/dns/oraclecloud/)                 |
-| [PowerDNS](https://go-acme.github.io/lego/dns/pdns/)                            | [Rackspace](https://go-acme.github.io/lego/dns/rackspace/)                      | [reg.ru](https://go-acme.github.io/lego/dns/regru/)                             | [RFC2136](https://go-acme.github.io/lego/dns/rfc2136/)                          |
+| [OVH](https://go-acme.github.io/lego/dns/ovh/)                                  | [PowerDNS](https://go-acme.github.io/lego/dns/pdns/)                            | [Rackspace](https://go-acme.github.io/lego/dns/rackspace/)                      | [reg.ru](https://go-acme.github.io/lego/dns/regru/)                             |
-| [RimuHosting](https://go-acme.github.io/lego/dns/rimuhosting/)                  | [Sakura Cloud](https://go-acme.github.io/lego/dns/sakuracloud/)                 | [Scaleway](https://go-acme.github.io/lego/dns/scaleway/)                        | [Selectel](https://go-acme.github.io/lego/dns/selectel/)                        |
+| [RFC2136](https://go-acme.github.io/lego/dns/rfc2136/)                          | [RimuHosting](https://go-acme.github.io/lego/dns/rimuhosting/)                  | [Sakura Cloud](https://go-acme.github.io/lego/dns/sakuracloud/)                 | [Scaleway](https://go-acme.github.io/lego/dns/scaleway/)                        |
-| [Servercow](https://go-acme.github.io/lego/dns/servercow/)                      | [Stackpath](https://go-acme.github.io/lego/dns/stackpath/)                      | [TransIP](https://go-acme.github.io/lego/dns/transip/)                          | [VegaDNS](https://go-acme.github.io/lego/dns/vegadns/)                          |
+| [Selectel](https://go-acme.github.io/lego/dns/selectel/)                        | [Servercow](https://go-acme.github.io/lego/dns/servercow/)                      | [Stackpath](https://go-acme.github.io/lego/dns/stackpath/)                      | [TransIP](https://go-acme.github.io/lego/dns/transip/)                          |
-| [Versio.[nl/eu/uk]](https://go-acme.github.io/lego/dns/versio/)                 | [Vscale](https://go-acme.github.io/lego/dns/vscale/)                            | [Vultr](https://go-acme.github.io/lego/dns/vultr/)                              | [Yandex](https://go-acme.github.io/lego/dns/yandex/)                            |
+| [VegaDNS](https://go-acme.github.io/lego/dns/vegadns/)                          | [Versio.[nl/eu/uk]](https://go-acme.github.io/lego/dns/versio/)                 | [Vscale](https://go-acme.github.io/lego/dns/vscale/)                            | [Vultr](https://go-acme.github.io/lego/dns/vultr/)                              |
-| [Zone.ee](https://go-acme.github.io/lego/dns/zoneee/)                           | [Zonomi](https://go-acme.github.io/lego/dns/zonomi/)                            |                                                                                 |                                                                                 |
+| [Yandex](https://go-acme.github.io/lego/dns/yandex/)                            | [Zone.ee](https://go-acme.github.io/lego/dns/zoneee/)                           | [Zonomi](https://go-acme.github.io/lego/dns/zonomi/)                            |                                                                                 |
 
 <!-- END DNS PROVIDERS LIST -->

cmd/zz_gen_cmd_dnshelp.go

@@ -63,6 +63,7 @@ func allDNSCodes() string {
 		"namedotcom",
 		"namesilo",
 		"netcup",
+		"netlify",
 		"nifcloud",
 		"ns1",
 		"oraclecloud",
@@ -1132,6 +1133,26 @@ func displayDNSHelp(name string) error {
 		ew.writeln()
 		ew.writeln(`More information: https://go-acme.github.io/lego/dns/netcup`)
 
+	case "netlify":
+		// generated from: providers/dns/netlify/netlify.toml
+		ew.writeln(`Configuration for Netlify.`)
+		ew.writeln(`Code:	'netlify'`)
+		ew.writeln(`Since:	'v0.3.7'`)
+		ew.writeln()
+
+		ew.writeln(`Credentials:`)
+		ew.writeln(`	- "NETLIFY_TOKEN":	Token`)
+		ew.writeln()
+
+		ew.writeln(`Additional Configuration:`)
+		ew.writeln(`	- "NETLIFY_HTTP_TIMEOUT":	API request timeout`)
+		ew.writeln(`	- "NETLIFY_POLLING_INTERVAL":	Time between DNS propagation check`)
+		ew.writeln(`	- "NETLIFY_PROPAGATION_TIMEOUT":	Maximum waiting time for DNS propagation`)
+		ew.writeln(`	- "NETLIFY_TTL":	The TTL of the TXT record used for the DNS challenge`)
+
+		ew.writeln()
+		ew.writeln(`More information: https://go-acme.github.io/lego/dns/netlify`)
+
 	case "nifcloud":
 		// generated from: providers/dns/nifcloud/nifcloud.toml
 		ew.writeln(`Configuration for NIFCloud.`)

docs/content/dns/zz_gen_netlify.md

@@ -0,0 +1,62 @@
+---
+title: "Netlify"
+date: 2019-03-03T16:39:46+01:00
+draft: false
+slug: netlify
+---
+
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+<!-- providers/dns/netlify/netlify.toml -->
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+
+Since: v0.3.7
+
+Configuration for [Netlify](https://www.netlify.com).
+
+
+<!--more-->
+
+- Code: `netlify`
+
+Here is an example bash command using the Netlify provider:
+
+```bash
+NETLIFY_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --dns netlify --domains my.domain.com --email my@email.com run
+```
+
+
+
+
+## Credentials
+
+| Environment Variable Name | Description |
+|-----------------------|-------------|
+| `NETLIFY_TOKEN` | Token |
+
+The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
+More information [here](/lego/dns/#configuration-and-credentials).
+
+
+## Additional Configuration
+
+| Environment Variable Name | Description |
+|--------------------------------|-------------|
+| `NETLIFY_HTTP_TIMEOUT` | API request timeout |
+| `NETLIFY_POLLING_INTERVAL` | Time between DNS propagation check |
+| `NETLIFY_PROPAGATION_TIMEOUT` | Maximum waiting time for DNS propagation |
+| `NETLIFY_TTL` | The TTL of the TXT record used for the DNS challenge |
+
+The environment variable names can be suffixed by `_FILE` to reference a file instead of a value.
+More information [here](/lego/dns/#configuration-and-credentials).
+
+
+
+
+## More information
+
+- [API documentation](https://open-api.netlify.com/)
+
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->
+<!-- providers/dns/netlify/netlify.toml -->
+<!-- THIS DOCUMENTATION IS AUTO-GENERATED. PLEASE DO NOT EDIT. -->

providers/dns/dns_providers.go

@@ -54,6 +54,7 @@ import (
 	"github.com/go-acme/lego/v3/providers/dns/namedotcom"
 	"github.com/go-acme/lego/v3/providers/dns/namesilo"
 	"github.com/go-acme/lego/v3/providers/dns/netcup"
+	"github.com/go-acme/lego/v3/providers/dns/netlify"
 	"github.com/go-acme/lego/v3/providers/dns/nifcloud"
 	"github.com/go-acme/lego/v3/providers/dns/ns1"
 	"github.com/go-acme/lego/v3/providers/dns/oraclecloud"
@@ -183,6 +184,8 @@ func NewDNSChallengeProviderByName(name string) (challenge.Provider, error) {
 		return namesilo.NewDNSProvider()
 	case "netcup":
 		return netcup.NewDNSProvider()
+	case "netlify":
+		return netlify.NewDNSProvider()
 	case "nifcloud":
 		return nifcloud.NewDNSProvider()
 	case "ns1":

providers/dns/netlify/internal/client.go

@@ -0,0 +1,164 @@
+package internal
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"path"
+)
+
+const defaultBaseURL = "https://api.netlify.com/api/v1"
+
+// Client Netlify API client.
+type Client struct {
+	HTTPClient *http.Client
+	BaseURL    string
+
+	token string
+}
+
+// NewClient creates a new Client.
+func NewClient(token string) *Client {
+	return &Client{
+		HTTPClient: http.DefaultClient,
+		BaseURL:    defaultBaseURL,
+		token:      token,
+	}
+}
+
+// GetRecords gets a DNS records.
+func (c *Client) GetRecords(zoneID string) ([]DNSRecord, error) {
+	endpoint, err := c.createEndpoint("dns_zones", zoneID, "dns_records")
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse endpoint: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodGet, endpoint, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.token))
+
+	resp, err := c.HTTPClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("API call failed: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("invalid status code: %s: %s", resp.Status, string(body))
+	}
+
+	var records []DNSRecord
+	err = json.Unmarshal(body, &records)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal response body: %w", err)
+	}
+
+	return records, nil
+}
+
+// CreateRecord creates a DNS records.
+func (c *Client) CreateRecord(zoneID string, record DNSRecord) (*DNSRecord, error) {
+	endpoint, err := c.createEndpoint("dns_zones", zoneID, "dns_records")
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse endpoint: %w", err)
+	}
+
+	marshaledRecord, err := json.Marshal(record)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal request body: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, endpoint, bytes.NewReader(marshaledRecord))
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Content-Type", "application/json; charset=utf-8")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.token))
+
+	resp, err := c.HTTPClient.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("API call failed: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusCreated {
+		return nil, fmt.Errorf("invalid status code: %s: %s", resp.Status, string(body))
+	}
+
+	var recordResp DNSRecord
+	err = json.Unmarshal(body, &recordResp)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal response body: %w", err)
+	}
+
+	return &recordResp, nil
+}
+
+// RemoveRecord removes a DNS records.
+func (c *Client) RemoveRecord(zoneID string, recordID string) error {
+	endpoint, err := c.createEndpoint("dns_zones", zoneID, "dns_records", recordID)
+	if err != nil {
+		return fmt.Errorf("failed to parse endpoint: %w", err)
+	}
+
+	req, err := http.NewRequest(http.MethodDelete, endpoint, nil)
+	if err != nil {
+		return fmt.Errorf("failed to create request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", c.token))
+
+	resp, err := c.HTTPClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("API call failed: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	body, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		return fmt.Errorf("failed to read response body: %w", err)
+	}
+
+	if resp.StatusCode != http.StatusNoContent {
+		return fmt.Errorf("invalid status code: %s: %s", resp.Status, string(body))
+	}
+
+	return nil
+}
+
+func (c *Client) createEndpoint(parts ...string) (string, error) {
+	base, err := url.Parse(c.BaseURL)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse base URL: %w", err)
+	}
+
+	endpoint, err := base.Parse(path.Join(base.Path, path.Join(parts...)))
+	if err != nil {
+		return "", fmt.Errorf("failed to parse endpoint path: %w", err)
+	}
+
+	return endpoint.String(), nil
+}

providers/dns/netlify/internal/client_test.go

@@ -0,0 +1,145 @@
+package internal
+
+import (
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestClient_GetRecords(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	mux.HandleFunc("/dns_zones/zoneID/dns_records", func(rw http.ResponseWriter, req *http.Request) {
+		if req.Method != http.MethodGet {
+			http.Error(rw, "unsupported method", http.StatusMethodNotAllowed)
+			return
+		}
+
+		auth := req.Header.Get("Authorization")
+		if auth != "Bearer tokenA" {
+			http.Error(rw, fmt.Sprintf("invali token: %s", auth), http.StatusUnauthorized)
+			return
+		}
+
+		rw.Header().Set("Content-Type", "application/json; charset=utf-8")
+
+		file, err := os.Open("./fixtures/get_records.json")
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer func() { _ = file.Close() }()
+
+		_, err = io.Copy(rw, file)
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	})
+
+	client := NewClient("tokenA")
+	client.BaseURL = server.URL
+
+	records, err := client.GetRecords("zoneID")
+	require.NoError(t, err)
+
+	expected := []DNSRecord{
+		{ID: "u6b433c15a27a2d79c6616d6", Hostname: "example.org", TTL: 3600, Type: "A", Value: "10.10.10.10"},
+		{ID: "u6b4764216f272872ac0ff71", Hostname: "test.example.org", TTL: 300, Type: "TXT", Value: "txtxtxtxtxtxt"},
+	}
+
+	assert.Equal(t, expected, records)
+}
+
+func TestClient_CreateRecord(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	mux.HandleFunc("/dns_zones/zoneID/dns_records", func(rw http.ResponseWriter, req *http.Request) {
+		if req.Method != http.MethodPost {
+			http.Error(rw, "unsupported method", http.StatusMethodNotAllowed)
+			return
+		}
+
+		auth := req.Header.Get("Authorization")
+		if auth != "Bearer tokenB" {
+			http.Error(rw, fmt.Sprintf("invali token: %s", auth), http.StatusUnauthorized)
+			return
+		}
+
+		rw.Header().Set("Content-Type", "application/json; charset=utf-8")
+		rw.WriteHeader(http.StatusCreated)
+
+		file, err := os.Open("./fixtures/create_record.json")
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer func() { _ = file.Close() }()
+
+		_, err = io.Copy(rw, file)
+		if err != nil {
+			http.Error(rw, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	})
+
+	client := NewClient("tokenB")
+	client.BaseURL = server.URL
+
+	record := DNSRecord{
+		Hostname: "_acme-challenge.example.com",
+		TTL:      300,
+		Type:     "TXT",
+		Value:    "txtxtxtxtxtxt",
+	}
+
+	result, err := client.CreateRecord("zoneID", record)
+	require.NoError(t, err)
+
+	expected := &DNSRecord{
+		ID:       "u6b4764216f272872ac0ff71",
+		Hostname: "test.example.org",
+		TTL:      300,
+		Type:     "TXT",
+		Value:    "txtxtxtxtxtxt",
+	}
+
+	assert.Equal(t, expected, result)
+}
+
+func TestClient_RemoveRecord(t *testing.T) {
+	mux := http.NewServeMux()
+	server := httptest.NewServer(mux)
+	t.Cleanup(server.Close)
+
+	mux.HandleFunc("/dns_zones/zoneID/dns_records/recordID", func(rw http.ResponseWriter, req *http.Request) {
+		if req.Method != http.MethodDelete {
+			http.Error(rw, "unsupported method", http.StatusMethodNotAllowed)
+			return
+		}
+
+		auth := req.Header.Get("Authorization")
+		if auth != "Bearer tokenC" {
+			http.Error(rw, fmt.Sprintf("invali token: %s", auth), http.StatusUnauthorized)
+			return
+		}
+
+		rw.WriteHeader(http.StatusNoContent)
+	})
+
+	client := NewClient("tokenC")
+	client.BaseURL = server.URL
+
+	err := client.RemoveRecord("zoneID", "recordID")
+	require.NoError(t, err)
+}

providers/dns/netlify/internal/fixtures/create_record.json

@@ -0,0 +1,16 @@
+{
+  "hostname": "test.example.org",
+  "type": "TXT",
+  "ttl": 300,
+  "priority": null,
+  "weight": null,
+  "port": null,
+  "flag": null,
+  "tag": null,
+  "id": "u6b4764216f272872ac0ff71",
+  "site_id": null,
+  "dns_zone_id": "u6b4336178f002e0a06bb0b6",
+  "errors": [],
+  "managed": false,
+  "value": "txtxtxtxtxtxt"
+}

providers/dns/netlify/internal/fixtures/get_records.json

@@ -0,0 +1,34 @@
+[
+  {
+    "hostname": "example.org",
+    "type": "A",
+    "ttl": 3600,
+    "priority": null,
+    "weight": null,
+    "port": null,
+    "flag": null,
+    "tag": null,
+    "id": "u6b433c15a27a2d79c6616d6",
+    "site_id": null,
+    "dns_zone_id": "u6b4336178f002e0a06bb0b6",
+    "errors": [],
+    "managed": false,
+    "value": "10.10.10.10"
+  },
+  {
+    "hostname": "test.example.org",
+    "type": "TXT",
+    "ttl": 300,
+    "priority": null,
+    "weight": null,
+    "port": null,
+    "flag": null,
+    "tag": null,
+    "id": "u6b4764216f272872ac0ff71",
+    "site_id": null,
+    "dns_zone_id": "u6b4336178f002e0a06bb0b6",
+    "errors": [],
+    "managed": false,
+    "value": "txtxtxtxtxtxt"
+  }
+]

providers/dns/netlify/internal/model.go

@@ -0,0 +1,10 @@
+package internal
+
+// DNSRecord DNS record representation.
+type DNSRecord struct {
+	ID       string `json:"id,omitempty"`
+	Hostname string `json:"hostname,omitempty"`
+	TTL      int    `json:"ttl,omitempty"`
+	Type     string `json:"type,omitempty"`
+	Value    string `json:"value,omitempty"`
+}

providers/dns/netlify/netlify.go

@@ -0,0 +1,162 @@
+// Package netlify implements a DNS provider for solving the DNS-01 challenge using Netlify.
+package netlify
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/go-acme/lego/v3/challenge/dns01"
+	"github.com/go-acme/lego/v3/platform/config/env"
+	"github.com/go-acme/lego/v3/providers/dns/netlify/internal"
+)
+
+// Environment variables names.
+const (
+	envNamespace = "NETLIFY_"
+
+	EnvToken = envNamespace + "TOKEN"
+
+	EnvTTL                = envNamespace + "TTL"
+	EnvPropagationTimeout = envNamespace + "PROPAGATION_TIMEOUT"
+	EnvPollingInterval    = envNamespace + "POLLING_INTERVAL"
+	EnvHTTPTimeout        = envNamespace + "HTTP_TIMEOUT"
+)
+
+// Config is used to configure the creation of the DNSProvider.
+type Config struct {
+	Token              string
+	PropagationTimeout time.Duration
+	PollingInterval    time.Duration
+	TTL                int
+	HTTPClient         *http.Client
+}
+
+// NewDefaultConfig returns a default configuration for the DNSProvider.
+func NewDefaultConfig() *Config {
+	return &Config{
+		TTL:                env.GetOrDefaultInt(EnvTTL, 300),
+		PropagationTimeout: env.GetOrDefaultSecond(EnvPropagationTimeout, dns01.DefaultPropagationTimeout),
+		PollingInterval:    env.GetOrDefaultSecond(EnvPollingInterval, dns01.DefaultPollingInterval),
+		HTTPClient: &http.Client{
+			Timeout: env.GetOrDefaultSecond(EnvHTTPTimeout, 30*time.Second),
+		},
+	}
+}
+
+// DNSProvider is an implementation of the challenge.Provider interface.
+type DNSProvider struct {
+	config *Config
+	client *internal.Client
+
+	recordIDs   map[string]string
+	recordIDsMu sync.Mutex
+}
+
+// NewDNSProvider returns a DNSProvider instance configured for Netlify.
+// Credentials must be passed in the environment variable: NETLIFY_TOKEN.
+func NewDNSProvider() (*DNSProvider, error) {
+	values, err := env.Get(EnvToken)
+	if err != nil {
+		return nil, fmt.Errorf("netlify: %w", err)
+	}
+
+	config := NewDefaultConfig()
+	config.Token = values[EnvToken]
+
+	return NewDNSProviderConfig(config)
+}
+
+// NewDNSProviderConfig return a DNSProvider instance configured for Netlify.
+func NewDNSProviderConfig(config *Config) (*DNSProvider, error) {
+	if config == nil {
+		return nil, errors.New("netlify: the configuration of the DNS provider is nil")
+	}
+
+	if config.Token == "" {
+		return nil, errors.New("netlify: incomplete credentials, missing token")
+	}
+
+	client := internal.NewClient(config.Token)
+
+	if config.HTTPClient != nil {
+		client.HTTPClient = config.HTTPClient
+	}
+
+	return &DNSProvider{
+		config:    config,
+		client:    client,
+		recordIDs: make(map[string]string),
+	}, nil
+}
+
+// Timeout returns the timeout and interval to use when checking for DNS propagation.
+// Adjusting here to cope with spikes in propagation times.
+func (d *DNSProvider) Timeout() (timeout, interval time.Duration) {
+	return d.config.PropagationTimeout, d.config.PollingInterval
+}
+
+// Present creates a TXT record using the specified parameters.
+func (d *DNSProvider) Present(domain, token, keyAuth string) error {
+	fqdn, value := dns01.GetRecord(domain, keyAuth)
+
+	authZone, err := dns01.FindZoneByFqdn(fqdn)
+	if err != nil {
+		return fmt.Errorf("netlify: failed to find zone: %w", err)
+	}
+
+	authZone = dns01.UnFqdn(authZone)
+
+	record := internal.DNSRecord{
+		Hostname: dns01.UnFqdn(fqdn),
+		TTL:      d.config.TTL,
+		Type:     "TXT",
+		Value:    value,
+	}
+
+	resp, err := d.client.CreateRecord(strings.ReplaceAll(authZone, ".", "_"), record)
+	if err != nil {
+		return fmt.Errorf("netlify: failed to create TXT records: fqdn=%s, authZone=%s: %w", fqdn, authZone, err)
+	}
+
+	d.recordIDsMu.Lock()
+	d.recordIDs[token] = resp.ID
+	d.recordIDsMu.Unlock()
+
+	return nil
+}
+
+// CleanUp removes the TXT record matching the specified parameters.
+func (d *DNSProvider) CleanUp(domain, token, keyAuth string) error {
+	fqdn, _ := dns01.GetRecord(domain, keyAuth)
+
+	authZone, err := dns01.FindZoneByFqdn(fqdn)
+	if err != nil {
+		return fmt.Errorf("netlify: failed to find zone: %w", err)
+	}
+
+	authZone = dns01.UnFqdn(authZone)
+
+	// gets the record's unique ID from when we created it
+	d.recordIDsMu.Lock()
+	recordID, ok := d.recordIDs[token]
+	d.recordIDsMu.Unlock()
+	if !ok {
+		return fmt.Errorf("netlify: unknown record ID for '%s' '%s'", fqdn, token)
+	}
+
+	err = d.client.RemoveRecord(strings.ReplaceAll(authZone, ".", "_"), recordID)
+	if err != nil {
+		return fmt.Errorf("netlify: failed to delete TXT records: fqdn=%s, authZone=%s, recordID=%s: %w", fqdn, authZone, recordID, err)
+	}
+
+	// deletes record ID from map
+	d.recordIDsMu.Lock()
+	delete(d.recordIDs, token)
+	d.recordIDsMu.Unlock()
+
+	return nil
+}

providers/dns/netlify/netlify.toml

@@ -0,0 +1,22 @@
+Name = "Netlify"
+Description = ''''''
+URL = "https://www.netlify.com"
+Code = "netlify"
+Since = "v0.3.7"
+
+Example = '''
+NETLIFY_TOKEN=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx \
+lego --dns netlify --domains my.domain.com --email my@email.com run
+'''
+
+[Configuration]
+  [Configuration.Credentials]
+    NETLIFY_TOKEN = "Token"
+  [Configuration.Additional]
+    NETLIFY_POLLING_INTERVAL = "Time between DNS propagation check"
+    NETLIFY_PROPAGATION_TIMEOUT = "Maximum waiting time for DNS propagation"
+    NETLIFY_TTL = "The TTL of the TXT record used for the DNS challenge"
+    NETLIFY_HTTP_TIMEOUT = "API request timeout"
+
+[Links]
+  API = "https://open-api.netlify.com/"

providers/dns/netlify/netlify_test.go

@@ -0,0 +1,116 @@
+package netlify
+
+import (
+	"testing"
+	"time"
+
+	"github.com/go-acme/lego/v3/platform/tester"
+	"github.com/stretchr/testify/require"
+)
+
+const envDomain = envNamespace + "DOMAIN"
+
+var envTest = tester.NewEnvTest(EnvToken).WithDomain(envDomain)
+
+func TestNewDNSProvider(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		envVars  map[string]string
+		expected string
+	}{
+		{
+			desc: "success",
+			envVars: map[string]string{
+				EnvToken: "123",
+			},
+		},
+		{
+			desc: "missing credentials",
+			envVars: map[string]string{
+				EnvToken: "",
+			},
+			expected: "netlify: some credentials information are missing: NETLIFY_TOKEN",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			defer envTest.RestoreEnv()
+			envTest.ClearEnv()
+
+			envTest.Apply(test.envVars)
+
+			p, err := NewDNSProvider()
+
+			if len(test.expected) == 0 {
+				require.NoError(t, err)
+				require.NotNil(t, p)
+				require.NotNil(t, p.config)
+			} else {
+				require.EqualError(t, err, test.expected)
+			}
+		})
+	}
+}
+
+func TestNewDNSProviderConfig(t *testing.T) {
+	testCases := []struct {
+		desc     string
+		expected string
+		token    string
+	}{
+		{
+			desc:  "success",
+			token: "api_key",
+		},
+		{
+			desc:     "missing credentials",
+			expected: "netlify: incomplete credentials, missing token",
+		},
+	}
+
+	for _, test := range testCases {
+		t.Run(test.desc, func(t *testing.T) {
+			config := NewDefaultConfig()
+			config.Token = test.token
+
+			p, err := NewDNSProviderConfig(config)
+
+			if len(test.expected) == 0 {
+				require.NoError(t, err)
+				require.NotNil(t, p)
+				require.NotNil(t, p.config)
+			} else {
+				require.EqualError(t, err, test.expected)
+			}
+		})
+	}
+}
+
+func TestLivePresent(t *testing.T) {
+	if !envTest.IsLiveTest() {
+		t.Skip("skipping live test")
+	}
+
+	envTest.RestoreEnv()
+	provider, err := NewDNSProvider()
+	require.NoError(t, err)
+
+	err = provider.Present(envTest.GetDomain(), "", "123d==")
+	require.NoError(t, err)
+}
+
+func TestLiveCleanUp(t *testing.T) {
+	if !envTest.IsLiveTest() {
+		t.Skip("skipping live test")
+	}
+
+	envTest.RestoreEnv()
+	provider, err := NewDNSProvider()
+	require.NoError(t, err)
+
+	time.Sleep(1 * time.Second)
+
+	err = provider.CleanUp(envTest.GetDomain(), "", "123d==")
+	require.NoError(t, err)
+}