From 47412d1822a99aaa692f5c7214ab80f80d8f34e4 Mon Sep 17 00:00:00 2001
From: alexandergott-afk <alexander.gott@patentamt.at>
Date: Thu, 12 Feb 2026 15:24:45 +0100
Subject: [PATCH 1/3] Update dns_nsupdate.sh

---
 dnsapi/dns_nsupdate.sh | 87 +++++++++++++++++++++++++-----------------
 1 file changed, 51 insertions(+), 36 deletions(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index 9b14553b..0b54b358 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -34,42 +34,49 @@ dns_nsupdate_add() {
   [ -n "${NSUPDATE_KEY}" ] || NSUPDATE_KEY=""
   [ -n "${NSUPDATE_OPT}" ] || NSUPDATE_OPT=""
 
+  NSUPDATE_SERVER_LIST=$(printf "%s" "$NSUPDATE_SERVER" | tr ',' ' ')
+
   _info "adding ${fulldomain}. 60 in txt \"${txtvalue}\""
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -z "${NSUPDATE_ZONE}" ]; then
-    #shellcheck disable=SC2086
-    if [ -z "${NSUPDATE_KEY}" ]; then
-      nsupdate $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+
+  for NS_SERVER in $NSUPDATE_SERVER_LIST; do
+    _info "Updating DNS server: $NS_SERVER"
+
+    if [ -z "${NSUPDATE_ZONE}" ]; then
+      #shellcheck disable=SC2086
+      if [ -z "${NSUPDATE_KEY}" ]; then
+        nsupdate $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
-    else
-      nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      else
+        nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
-    fi
-  else
-    #shellcheck disable=SC2086
-    if [ -z "${NSUPDATE_KEY}" ]; then
-      nsupdate $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      fi
+    else
+      #shellcheck disable=SC2086
+      if [ -z "${NSUPDATE_KEY}" ]; then
+        nsupdate $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 zone ${NSUPDATE_ZONE}.
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
-    else
-      nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      else
+        nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 zone ${NSUPDATE_ZONE}.
 update add ${fulldomain}. 60 in txt "${txtvalue}"
 send
 EOF
+      fi
     fi
-  fi
+  done
   if [ $? -ne 0 ]; then
     _err "error updating domain"
     return 1
@@ -91,42 +98,50 @@ dns_nsupdate_rm() {
   [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
   [ -n "${NSUPDATE_KEY}" ] || NSUPDATE_KEY=""
+  
+  NSUPDATE_SERVER_LIST=$(printf "%s" "$NSUPDATE_SERVER" | tr ',' ' ')
+  
   _info "removing ${fulldomain}. txt"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"
-  if [ -z "${NSUPDATE_ZONE}" ]; then
-    #shellcheck disable=SC2086
-    if [ -z "${NSUPDATE_KEY}" ]; then
-      nsupdate $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+
+  for NS_SERVER in $NSUPDATE_SERVER_LIST; do
+    _info "Updating DNS server: $NS_SERVER"
+
+    if [ -z "${NSUPDATE_ZONE}" ]; then
+      #shellcheck disable=SC2086
+      if [ -z "${NSUPDATE_KEY}" ]; then
+        nsupdate $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 update delete ${fulldomain}. txt
 send
 EOF
-    else
-      nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      else
+        nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 update delete ${fulldomain}. txt
 send
 EOF
-    fi
-  else
-    #shellcheck disable=SC2086
-    if [ -z "${NSUPDATE_KEY}" ]; then
-      nsupdate $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      fi
+    else
+      #shellcheck disable=SC2086
+      if [ -z "${NSUPDATE_KEY}" ]; then
+        nsupdate $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 zone ${NSUPDATE_ZONE}.
 update delete ${fulldomain}. txt
 send
 EOF
-    else
-      nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
-server ${NSUPDATE_SERVER}  ${NSUPDATE_SERVER_PORT}
+      else
+        nsupdate -k "${NSUPDATE_KEY}" $nsdebug $NSUPDATE_OPT <<EOF
+server ${NS_SERVER}  ${NSUPDATE_SERVER_PORT}
 zone ${NSUPDATE_ZONE}.
 update delete ${fulldomain}. txt
 send
 EOF
+      fi
     fi
-  fi
+  done
   if [ $? -ne 0 ]; then
     _err "error updating domain"
     return 1

From 5bc44caf50f0c3e4fe4beabd6bea3781c20d7837 Mon Sep 17 00:00:00 2001
From: alexandergott-afk <alexander.gott@patentamt.at>
Date: Thu, 12 Feb 2026 15:27:23 +0100
Subject: [PATCH 2/3] Allow more than one DNS server for HA environments

---
 dnsapi/dns_nsupdate.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index 0b54b358..cc57cc38 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -98,9 +98,9 @@ dns_nsupdate_rm() {
   [ -n "${NSUPDATE_SERVER}" ] || NSUPDATE_SERVER="localhost"
   [ -n "${NSUPDATE_SERVER_PORT}" ] || NSUPDATE_SERVER_PORT=53
   [ -n "${NSUPDATE_KEY}" ] || NSUPDATE_KEY=""
-  
+
   NSUPDATE_SERVER_LIST=$(printf "%s" "$NSUPDATE_SERVER" | tr ',' ' ')
-  
+
   _info "removing ${fulldomain}. txt"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_1" ] && nsdebug="-d"
   [ -n "$DEBUG" ] && [ "$DEBUG" -ge "$DEBUG_LEVEL_2" ] && nsdebug="-D"

From 83424e7ba4c8e116ca5d39bf352c84258482d8c0 Mon Sep 17 00:00:00 2001
From: alexandergott-afk <alexander.gott@patentamt.at>
Date: Thu, 12 Feb 2026 15:32:53 +0100
Subject: [PATCH 3/3] Add the information from my last accepted pull that the
 TSIG key is optional.

---
 dnsapi/dns_nsupdate.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dnsapi/dns_nsupdate.sh b/dnsapi/dns_nsupdate.sh
index cc57cc38..8d7fe2c0 100755
--- a/dnsapi/dns_nsupdate.sh
+++ b/dnsapi/dns_nsupdate.sh
@@ -6,7 +6,7 @@ Docs: github.com/acmesh-official/acme.sh/wiki/dnsapi#dns_nsupdate
 Options:
  NSUPDATE_SERVER Server hostname. Default: "localhost".
  NSUPDATE_SERVER_PORT Server port. Default: "53".
- NSUPDATE_KEY File path to TSIG key. Default: ""
+ NSUPDATE_KEY File path to TSIG key. Default: "". Optional.
  NSUPDATE_ZONE Domain zone to update. Optional.
 '