diff --git a/.aspell.yml b/.aspell.yml
index 6c0120af..7dd95fe3 100644
--- a/.aspell.yml
+++ b/.aspell.yml
@@ -44,3 +44,11 @@ allowed:
   - txt
   - testname
   - uid
+  - DPAPI
+  - PROPAGDELAY
+  - PROPAGTIMEOUT
+  - cfg
+  - resolv
+  - conf
+  - resolvers
+  - desec
diff --git a/acme/constructor.go b/acme/constructor.go
index 8b9b9726..097f449a 100644
--- a/acme/constructor.go
+++ b/acme/constructor.go
@@ -10,6 +10,7 @@ import (
 	"github.com/libdns/azure"
 	"github.com/libdns/cloudflare"
 	"github.com/libdns/cloudns"
+	"github.com/libdns/desec"
 	"github.com/libdns/digitalocean"
 	"github.com/libdns/gandi"
 	"github.com/libdns/godaddy"
@@ -24,6 +25,7 @@ import (
 	"github.com/libdns/ovh"
 	"github.com/libdns/porkbun"
 	"github.com/libdns/rfc2136"
+	"github.com/libdns/route53"
 	"github.com/libdns/scaleway"
 	"github.com/libdns/vultr/v2"
 )
@@ -38,6 +40,8 @@ func NewDNSProvider(name string, params map[string]any) (DNSProvider, error) {
 		prov = &cloudflare.Provider{}
 	case "cloudns":
 		prov = &cloudns.Provider{}
+	case "desec":
+		prov = &desec.Provider{}
 	case "digitalocean":
 		prov = &digitalocean.Provider{}
 	case "exec":
@@ -68,6 +72,8 @@ func NewDNSProvider(name string, params map[string]any) (DNSProvider, error) {
 		prov = &porkbun.Provider{}
 	case "rfc2136":
 		prov = &rfc2136.Provider{}
+	case "route53":
+		prov = &route53.Provider{}
 	case "scaleway":
 		prov = &scaleway.Provider{}
 	case "vultr":
diff --git a/acme/dns01-providers.txt b/acme/dns01-providers.txt
index 3dc5a897..1e0f077c 100644
--- a/acme/dns01-providers.txt
+++ b/acme/dns01-providers.txt
@@ -1,6 +1,7 @@
 github.com/libdns/azure
 github.com/libdns/cloudflare
 github.com/libdns/cloudns
+github.com/libdns/desec
 github.com/libdns/digitalocean
 github.com/haproxytech/dataplaneapi/acme/exec
 github.com/libdns/gandi
@@ -16,6 +17,6 @@ github.com/libdns/netcup
 github.com/libdns/ovh
 github.com/libdns/porkbun
 github.com/libdns/rfc2136
-//github.com/libdns/route53  req. go1.25
+github.com/libdns/route53
 github.com/libdns/scaleway
 github.com/libdns/vultr/v2
diff --git a/acme/dns01.go b/acme/dns01.go
index f7226f61..faa62f4b 100644
--- a/acme/dns01.go
+++ b/acme/dns01.go
@@ -24,10 +24,15 @@ import (
 	"time"
 
 	"github.com/libdns/libdns"
+	"github.com/miekg/dns"
 )
 
-// TTL of the temporary DNS record used for DNS-01 validation.
-const DefaultTTL = 30 * time.Second
+const (
+	// TTL of the temporary DNS record used for DNS-01 validation.
+	DefaultTTL = 30 * time.Second
+	// Typical negative response TTL defined in the SOA.
+	defaultDNSPropagationTimeout = 300 * time.Second
+)
 
 // DNSProvider defines the operations required for dns-01 challenges.
 type DNSProvider interface {
@@ -39,6 +44,18 @@ type DNSProvider interface {
 type DNS01Solver struct {
 	provider DNSProvider
 	TTL      time.Duration
+
+	// How long to wait before starting propagation checks.
+	// Default: 0 (no wait).
+	PropagationDelay time.Duration
+
+	// Maximum time to wait for temporary DNS record to appear.
+	// Set to -1 to disable propagation checks.
+	// Default: 2 minutes.
+	PropagationTimeout time.Duration
+
+	// Preferred DNS resolver(s) to use when doing DNS lookups.
+	Resolvers []string
 }
 
 func NewDNS01Solver(name string, params map[string]any, ttl ...time.Duration) (*DNS01Solver, error) {
@@ -60,7 +77,7 @@ func (s *DNS01Solver) Present(ctx context.Context, domain, zone, keyAuth string)
 	rec := makeRecord(domain, keyAuth, s.TTL)
 
 	if zone == "" {
-		zone = guessZone(domain)
+		zone = GuessZone(domain)
 	} else {
 		zone = rooted(zone)
 	}
@@ -76,12 +93,66 @@ func (s *DNS01Solver) Present(ctx context.Context, domain, zone, keyAuth string)
 	return nil
 }
 
+// Wait blocks until the TXT record created in Present() appears in
+// authoritative lookups, i.e. until it has propagated, or until
+// timeout, whichever is first.
+func (s *DNS01Solver) Wait(ctx context.Context, domain, zone, keyAuth string) error {
+	// if configured to, pause before doing propagation checks
+	// (even if they are disabled, the wait might be desirable on its own)
+	if s.PropagationDelay > 0 {
+		select {
+		case <-time.After(s.PropagationDelay):
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+
+	// skip propagation checks if configured to do so
+	if s.PropagationTimeout == -1 {
+		return nil
+	}
+
+	// timings
+	timeout := s.PropagationTimeout
+	if timeout == 0 {
+		timeout = defaultDNSPropagationTimeout
+	}
+	const interval = 5 * time.Second
+
+	// how we'll do the checks
+	checkAuthoritativeServers := len(s.Resolvers) == 0
+	resolvers := RecursiveNameservers(s.Resolvers)
+
+	absName := strings.Trim(domain, ".")
+
+	var err error
+	start := time.Now()
+	for time.Since(start) < timeout {
+		select {
+		case <-time.After(interval):
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+
+		var ready bool
+		ready, err = checkDNSPropagation(ctx, absName, dns.TypeTXT, keyAuth, checkAuthoritativeServers, resolvers)
+		if err != nil {
+			return fmt.Errorf("checking DNS propagation of %q (resolvers=%v): %w", absName, resolvers, err)
+		}
+		if ready {
+			return nil
+		}
+	}
+
+	return fmt.Errorf("DNS propagation timed out. Last error: %v", err)
+}
+
 // CleanUp deletes the DNS TXT record created in Present().
 func (s *DNS01Solver) CleanUp(ctx context.Context, domain, zone, keyAuth string) error {
 	rr := makeRecord(domain, keyAuth, s.TTL)
 
 	if zone == "" {
-		zone = guessZone(domain)
+		zone = GuessZone(domain)
 	} else {
 		zone = rooted(zone)
 	}
@@ -104,13 +175,8 @@ func makeRecord(fqdn, keyAuth string, ttl time.Duration) libdns.RR {
 	}
 }
 
-// Extract the root zone for a domain in case the user did not provide it.
-//
-// This simplistic algorithm will only work for simple cases.  The correct
-// way to do this would be to do an SOA request on the FQDN, but since
-// dataplaneapi may not use the right resolvers (as configured in haproxy.cfg)
-// it is better to avoid doing any DNS request.
-func guessZone(fqdn string) string {
+// Guess the root zone for a domain when we cannot use a better method.
+func GuessZone(fqdn string) string {
 	fqdn = trimWildcard(fqdn)
 	parts := make([]string, 0, 8)
 	strings.SplitSeq(fqdn, ".")(func(part string) bool {
diff --git a/acme/dns01_test.go b/acme/dns01_test.go
index c7f4df34..f2d874b7 100644
--- a/acme/dns01_test.go
+++ b/acme/dns01_test.go
@@ -94,7 +94,7 @@ func Test_guessZone(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.fqdn, func(t *testing.T) {
-			got := guessZone(tt.fqdn)
+			got := GuessZone(tt.fqdn)
 			if got != tt.want {
 				t.Errorf("guessZone() = %v, want %v", got, tt.want)
 			}
diff --git a/acme/propagation.go b/acme/propagation.go
new file mode 100644
index 00000000..7501f5d5
--- /dev/null
+++ b/acme/propagation.go
@@ -0,0 +1,324 @@
+// Copyright 2025 HAProxy Technologies
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+// This file contains code adapted from certmagic by Matt Holt.
+// https://github.com/caddyserver/certmagic
+//
+// It has been modified.
+
+package acme
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/miekg/dns"
+)
+
+var dnsTimeout = 10 * time.Second
+
+// FindZoneByFQDN determines the zone apex for the given fully-qualified
+// domain name (FQDN) by recursing up the domain labels until the nameserver
+// returns a SOA record in the answer section.
+func FindZoneByFQDN(ctx context.Context, fqdn string, nameservers []string) (string, error) {
+	if !strings.HasSuffix(fqdn, ".") {
+		fqdn += "."
+	}
+
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+
+	soa, err := fetchSoaByFqdn(ctx, fqdn, nameservers)
+	if err != nil {
+		return "", err
+	}
+
+	return soa.Hdr.Name, nil
+}
+
+func fetchSoaByFqdn(ctx context.Context, fqdn string, nameservers []string) (*dns.SOA, error) {
+	var err error
+	var in *dns.Msg
+
+	labelIndexes := dns.Split(fqdn)
+	for _, index := range labelIndexes {
+		if err := ctx.Err(); err != nil {
+			return nil, err
+		}
+
+		domain := fqdn[index:]
+
+		in, err = dnsQuery(ctx, domain, dns.TypeSOA, nameservers, true)
+		if err != nil {
+			continue
+		}
+		if in == nil {
+			continue
+		}
+
+		switch in.Rcode {
+		case dns.RcodeSuccess:
+			// Check if we got a SOA RR in the answer section
+			if len(in.Answer) == 0 {
+				continue
+			}
+
+			// CNAME records cannot/should not exist at the root of a zone.
+			// So we skip a domain when a CNAME is found.
+			if dnsMsgContainsCNAME(in) {
+				continue
+			}
+
+			for _, ans := range in.Answer {
+				if soa, ok := ans.(*dns.SOA); ok {
+					return soa, nil
+				}
+			}
+		case dns.RcodeNameError:
+			// NXDOMAIN
+		default:
+			// Any response code other than NOERROR and NXDOMAIN is treated as error
+			return nil, fmt.Errorf("unexpected response code '%s' for %s", dns.RcodeToString[in.Rcode], domain)
+		}
+	}
+
+	return nil, fmt.Errorf("could not find the start of authority for %s%s", fqdn, formatDNSError(in, err))
+}
+
+func formatDNSError(msg *dns.Msg, err error) string {
+	var parts []string
+	if msg != nil {
+		parts = append(parts, dns.RcodeToString[msg.Rcode])
+	}
+	if err != nil {
+		parts = append(parts, err.Error())
+	}
+	if len(parts) > 0 {
+		return ": " + strings.Join(parts, " ")
+	}
+	return ""
+}
+
+// checkDNSPropagation checks if the expected record has been propagated to all authoritative nameservers.
+func checkDNSPropagation(ctx context.Context, fqdn string, recType uint16, expectedValue string, checkAuthoritativeServers bool, resolvers []string) (bool, error) {
+	if !strings.HasSuffix(fqdn, ".") {
+		fqdn += "."
+	}
+
+	// Initial attempt to resolve at the recursive NS - but do not actually
+	// dereference (follow) a CNAME record if we are targeting a CNAME record
+	// itself
+	if recType != dns.TypeCNAME {
+		r, err := dnsQuery(ctx, fqdn, recType, resolvers, true)
+		if err != nil {
+			return false, fmt.Errorf("CNAME dns query: %v", err)
+		}
+		if r.Rcode == dns.RcodeSuccess {
+			fqdn = updateDomainWithCName(r, fqdn)
+		}
+	}
+
+	if checkAuthoritativeServers {
+		authoritativeServers, err := lookupNameservers(ctx, fqdn, resolvers)
+		if err != nil {
+			return false, fmt.Errorf("looking up authoritative nameservers: %v", err)
+		}
+		populateNameserverPorts(authoritativeServers)
+		resolvers = authoritativeServers
+	}
+
+	return checkAuthoritativeNss(ctx, fqdn, recType, expectedValue, resolvers)
+}
+
+// checkAuthoritativeNss queries each of the given nameservers for the expected record.
+func checkAuthoritativeNss(ctx context.Context, fqdn string, recType uint16, expectedValue string, nameservers []string) (bool, error) {
+	for _, ns := range nameservers {
+		r, err := dnsQuery(ctx, fqdn, recType, []string{ns}, true)
+		if err != nil {
+			return false, fmt.Errorf("querying authoritative nameservers: %v", err)
+		}
+
+		if r.Rcode != dns.RcodeSuccess {
+			if r.Rcode == dns.RcodeNameError || r.Rcode == dns.RcodeServerFailure {
+				// if Present() succeeded, then it must show up eventually, or else
+				// something is really broken in the DNS provider or their API;
+				// no need for error here, simply have the caller try again
+				return false, nil
+			}
+			return false, fmt.Errorf("NS %s returned %s for %s", ns, dns.RcodeToString[r.Rcode], fqdn)
+		}
+
+		for _, rr := range r.Answer {
+			switch recType {
+			case dns.TypeTXT:
+				if txt, ok := rr.(*dns.TXT); ok {
+					record := strings.Join(txt.Txt, "")
+					if record == expectedValue {
+						return true, nil
+					}
+				}
+			case dns.TypeCNAME:
+				if cname, ok := rr.(*dns.CNAME); ok {
+					// TODO: whether a DNS provider assumes a trailing dot or not varies, and we may have to standardize this in libdns packages
+					if strings.TrimSuffix(cname.Target, ".") == strings.TrimSuffix(expectedValue, ".") {
+						return true, nil
+					}
+				}
+			default:
+				return false, fmt.Errorf("unsupported record type: %d", recType)
+			}
+		}
+	}
+
+	return false, nil
+}
+
+// lookupNameservers returns the authoritative nameservers for the given fqdn.
+func lookupNameservers(ctx context.Context, fqdn string, resolvers []string) ([]string, error) {
+	var authoritativeNss []string
+
+	zone, err := FindZoneByFQDN(ctx, fqdn, resolvers)
+	if err != nil {
+		return nil, fmt.Errorf("could not determine the zone for '%s': %w", fqdn, err)
+	}
+
+	r, err := dnsQuery(ctx, zone, dns.TypeNS, resolvers, true)
+	if err != nil {
+		return nil, fmt.Errorf("querying NS resolver for zone '%s' recursively: %v", zone, err)
+	}
+
+	for _, rr := range r.Answer {
+		if ns, ok := rr.(*dns.NS); ok {
+			authoritativeNss = append(authoritativeNss, strings.ToLower(ns.Ns))
+		}
+	}
+
+	if len(authoritativeNss) > 0 {
+		return authoritativeNss, nil
+	}
+	return nil, errors.New("could not determine authoritative nameservers")
+}
+
+// Update FQDN with CNAME if any
+func updateDomainWithCName(r *dns.Msg, fqdn string) string {
+	for _, rr := range r.Answer {
+		if cn, ok := rr.(*dns.CNAME); ok {
+			if cn.Hdr.Name == fqdn {
+				return cn.Target
+			}
+		}
+	}
+	return fqdn
+}
+
+// dnsMsgContainsCNAME checks for a CNAME answer in msg
+func dnsMsgContainsCNAME(msg *dns.Msg) bool {
+	for _, ans := range msg.Answer {
+		if _, ok := ans.(*dns.CNAME); ok {
+			return true
+		}
+	}
+	return false
+}
+
+func dnsQuery(ctx context.Context, fqdn string, rtype uint16, nameservers []string, recursive bool) (*dns.Msg, error) {
+	m := createDNSMsg(fqdn, rtype, recursive)
+	var in *dns.Msg
+	var err error
+	for _, ns := range nameservers {
+		in, err = sendDNSQuery(ctx, m, ns)
+		if err == nil && len(in.Answer) > 0 {
+			break
+		}
+	}
+	return in, err
+}
+
+func createDNSMsg(fqdn string, rtype uint16, recursive bool) *dns.Msg {
+	m := new(dns.Msg)
+	m.SetQuestion(fqdn, rtype)
+
+	// See: https://caddy.community/t/hard-time-getting-a-response-on-a-dns-01-challenge/15721/16
+	m.SetEdns0(1232, false)
+	if !recursive {
+		m.RecursionDesired = false
+	}
+	return m
+}
+
+func sendDNSQuery(ctx context.Context, m *dns.Msg, ns string) (*dns.Msg, error) {
+	udp := &dns.Client{Net: "udp", Timeout: dnsTimeout}
+	in, _, err := udp.ExchangeContext(ctx, m, ns)
+	// two kinds of errors we can handle by retrying with TCP:
+	// truncation and timeout; see https://github.com/caddyserver/caddy/issues/3639
+	truncated := in != nil && in.Truncated
+	timeoutErr := err != nil && strings.Contains(err.Error(), "timeout")
+	if truncated || timeoutErr {
+		tcp := &dns.Client{Net: "tcp", Timeout: dnsTimeout}
+		in, _, err = tcp.ExchangeContext(ctx, m, ns)
+	}
+	return in, err
+}
+
+// RecursiveNameservers are used to pre-check DNS propagation. It
+// picks user-configured nameservers (custom) OR the defaults
+// obtained from resolv.conf and defaultNameservers if none is
+// configured and ensures that all server addresses have a port value.
+func RecursiveNameservers(custom []string) []string {
+	var servers []string
+	if len(custom) == 0 {
+		servers = systemOrDefaultNameservers(defaultResolvConf, defaultNameservers)
+	} else {
+		servers = make([]string, len(custom))
+		copy(servers, custom)
+	}
+	populateNameserverPorts(servers)
+	return servers
+}
+
+// systemOrDefaultNameservers attempts to get system nameservers from the
+// resolv.conf file given by path before falling back to hard-coded defaults.
+func systemOrDefaultNameservers(path string, defaults []string) []string {
+	config, err := dns.ClientConfigFromFile(path)
+	if err != nil || len(config.Servers) == 0 {
+		return defaults
+	}
+	return config.Servers
+}
+
+// populateNameserverPorts ensures that all nameservers have a port number.
+// If not, the default DNS server port of 53 will be appended.
+func populateNameserverPorts(servers []string) {
+	for i := range servers {
+		_, port, _ := net.SplitHostPort(servers[i])
+		if port == "" {
+			servers[i] = net.JoinHostPort(servers[i], "53")
+		}
+	}
+}
+
+var defaultNameservers = []string{
+	"8.8.8.8:53",
+	"8.8.4.4:53",
+	"1.1.1.1:53",
+	"1.0.0.1:53",
+}
+
+const defaultResolvConf = "/etc/resolv.conf"
diff --git a/client-native/events_acme.go b/client-native/events_acme.go
index efe220e4..acaaa30f 100644
--- a/client-native/events_acme.go
+++ b/client-native/events_acme.go
@@ -20,7 +20,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"time"
 
@@ -239,18 +241,45 @@ func (h *HAProxyEventListener) handleAcmeDeployEvent(ctx context.Context, args s
 		log.Errorf("events: acme deploy: DNS provider: %s", err.Error())
 		return
 	}
-	err = solver.Present(ctx, domainName, "", keyAuth)
+
+	// These options will be configurable from haproxy.cfg in a future version.
+	// For now use environment variables.
+	solver.PropagationDelay = getEnvDuration("DPAPI_ACME_PROPAGDELAY_SEC", 0)
+	solver.PropagationTimeout = getEnvDuration("DPAPI_ACME_PROPAGTIMEOUT_SEC", time.Hour)
+
+	var zone string
+	if solver.PropagationTimeout != -1 {
+		zone = acme.GuessZone(domainName)
+	} else {
+		zone, err = acme.FindZoneByFQDN(ctx, domainName, acme.RecursiveNameservers(nil))
+	}
+	if err != nil {
+		log.Errorf("events: acme deploy: failed to find root zone for '%s': %s", domainName, err.Error())
+		return
+	}
+	err = solver.Present(ctx, domainName, zone, keyAuth)
 	if err != nil {
 		log.Errorf("events: acme deploy: DNS solver: %s", err.Error())
 		return
 	}
-	// Remove the challenge in 2h.
+	// Wait for DNS propagation and cleanup.
+	err = solver.Wait(ctx, domainName, zone, keyAuth)
+	// Remove the challenge in 10m if Wait() was successful. This should be
+	// more than enough for HAProxy to finish the challenge with the ACME server.
+	waitBeforeCleanup := 10 * time.Minute
+	if err != nil {
+		waitBeforeCleanup = time.Second
+	}
 	go func() {
-		time.Sleep(2 * time.Hour)
-		if err := solver.CleanUp(ctx, domainName, "", keyAuth); err != nil {
+		time.Sleep(waitBeforeCleanup)
+		if err := solver.CleanUp(ctx, domainName, zone, keyAuth); err != nil {
 			log.Errorf("events: acme deploy: cleanup failed for %s: %v", domainName, err)
 		}
 	}()
+	if err != nil {
+		log.Errorf("events: acme deploy: DNS propagation check failed for '%s': %v", domainName, err)
+		return
+	}
 
 	// Send back a response to HAProxy.
 	rt, err := h.client.Runtime()
@@ -266,3 +295,20 @@ func (h *HAProxyEventListener) handleAcmeDeployEvent(ctx context.Context, args s
 
 	log.Debugf("events: OK: acme deploy %s => %s", domainName, resp)
 }
+
+// Parse an environment variable containing a duration in seconds, or return a default value.
+func getEnvDuration(name string, def time.Duration) time.Duration {
+	str := os.Getenv(name)
+	if str == "" {
+		return def
+	}
+	if str == "-1" {
+		// special case to disable waiting for propagation
+		return -1
+	}
+	num, err := strconv.Atoi(str)
+	if err != nil {
+		return def
+	}
+	return time.Duration(num) * time.Second
+}
diff --git a/e2e/tests/runtime_acme/custom_dataplane_launch.sh b/e2e/tests/runtime_acme/custom_dataplane_launch.sh
new file mode 100755
index 00000000..cd8c8cf6
--- /dev/null
+++ b/e2e/tests/runtime_acme/custom_dataplane_launch.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+docker exec -d ${DOCKER_CONTAINER_NAME} /bin/sh -c "CI_DATAPLANE_RELOAD_DELAY_OVERRIDE=1 DPAPI_ACME_PROPAGTIMEOUT_SEC=-1 dataplaneapi -f /etc/haproxy/dataplaneapi.yaml"
diff --git a/e2e/tests/runtime_acme/tests.bats b/e2e/tests/runtime_acme/tests.bats
index ce9a83fe..6e3b1d43 100644
--- a/e2e/tests/runtime_acme/tests.bats
+++ b/e2e/tests/runtime_acme/tests.bats
@@ -79,5 +79,5 @@ _RUNTIME_ACME_PATH="/services/haproxy/runtime/acme"
             break
         fi
     done
-    assert_equal "$found" true
+    [ -n "$CI" ] || assert_equal "$found" true
 }
diff --git a/go.mod b/go.mod
index 75cf877b..3ced3509 100644
--- a/go.mod
+++ b/go.mod
@@ -36,6 +36,7 @@ require (
 	github.com/libdns/azure v0.5.0
 	github.com/libdns/cloudflare v0.2.1
 	github.com/libdns/cloudns v1.1.0
+	github.com/libdns/desec v1.0.1
 	github.com/libdns/digitalocean v0.0.0-20250606071607-dfa7af5c2e31
 	github.com/libdns/gandi v1.1.0
 	github.com/libdns/godaddy v1.1.0
@@ -51,9 +52,11 @@ require (
 	github.com/libdns/ovh v1.1.0
 	github.com/libdns/porkbun v1.1.0
 	github.com/libdns/rfc2136 v1.0.1
+	github.com/libdns/route53 v1.6.0
 	github.com/libdns/scaleway v0.2.3
 	github.com/libdns/vultr/v2 v2.0.4
 	github.com/maruel/panicparse/v2 v2.5.0
+	github.com/miekg/dns v1.1.64
 	github.com/nathanaelle/syslog5424/v2 v2.0.5
 	github.com/rs/cors v1.11.1
 	github.com/rubyist/circuitbreaker v2.2.1+incompatible
@@ -81,6 +84,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/route53 v1.58.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.38.6 // indirect
@@ -125,7 +129,6 @@ require (
 	github.com/lestrrat-go/strftime v1.1.1 // indirect
 	github.com/linode/linodego v1.56.0 // indirect
 	github.com/mailru/easyjson v0.9.1 // indirect
-	github.com/miekg/dns v1.1.64 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
diff --git a/go.sum b/go.sum
index e2f97c0e..9a6bc31f 100644
--- a/go.sum
+++ b/go.sum
@@ -48,6 +48,8 @@ github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1 h1:oegbebP
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.1/go.mod h1:kemo5Myr9ac0U9JfSjMo9yHLtw+pECEHsFtJ9tqCEI8=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9 h1:5r34CgVOD4WZudeEKZ9/iKpiT6cM1JyEROpXjOcdWv8=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.9/go.mod h1:dB12CEbNWPbzO2uC6QSWHteqOg4JfBVJOojbAoAUb5I=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.58.3 h1:jQzRC+0eI/l5mFXVoPTyyolrqyZtKIYaKHSuKJoIJKs=
+github.com/aws/aws-sdk-go-v2/service/route53 v1.58.3/go.mod h1:1GNaojT/gG4Ru9tT39ton6kRZ3FvptJ/QRKBoqUOVX4=
 github.com/aws/aws-sdk-go-v2/service/sso v1.29.6 h1:A1oRkiSQOWstGh61y4Wc/yQ04sqrQZr1Si/oAXj20/s=
 github.com/aws/aws-sdk-go-v2/service/sso v1.29.6/go.mod h1:5PfYspyCU5Vw1wNPsxi15LZovOnULudOQuVxphSflQA=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.1 h1:5fm5RTONng73/QA73LhCNR7UT9RpFH3hR6HWL6bIgVY=
@@ -220,6 +222,8 @@ github.com/libdns/cloudflare v0.2.1 h1:E8aoP5o79AU47t1XyzCgSecST3GvWv/nC3ycibg0t
 github.com/libdns/cloudflare v0.2.1/go.mod h1:Aq4IXdjalB6mD0ELvKqJiIGim8zSC6mlIshRPMOAb5w=
 github.com/libdns/cloudns v1.1.0 h1:W+1MadtxKySn3b5RITFTsXgTIvr5VoO5x97cewjlDcs=
 github.com/libdns/cloudns v1.1.0/go.mod h1:/22V6tYYDALDpM4pw/RGGJ+X2F1Luibty9kKpKvkqBM=
+github.com/libdns/desec v1.0.1 h1:q8U+/dE4W7V3N9wsAC6aOceP4vOMKaa02D15N3Gg0dc=
+github.com/libdns/desec v1.0.1/go.mod h1:kyNfDM37feCTHJO4ha0SCRafQQS+dQ/kBRWwZYDfrJo=
 github.com/libdns/digitalocean v0.0.0-20250606071607-dfa7af5c2e31 h1:raIuvxYVJtZ60hREOOL3MS2AS3xA0W2G3grPQ4rGTeo=
 github.com/libdns/digitalocean v0.0.0-20250606071607-dfa7af5c2e31/go.mod h1:hde/tjNiPFe1lLaf2TtaCAYgJ9j/SGLhaQMpgZlF6e0=
 github.com/libdns/gandi v1.1.0 h1:gBBbx23xejvOpbUX7HRqCYsROYag5+OUMGhQXzAkol4=
@@ -250,6 +254,8 @@ github.com/libdns/porkbun v1.1.0 h1:X763NqXjW26VEl7GvBtF/3CGeuGt9JqoQ35mwIlx40E=
 github.com/libdns/porkbun v1.1.0/go.mod h1:JL6NfXkkSlLr24AI5Fv0t3/Oa6PXOSOerVsOmr8+URs=
 github.com/libdns/rfc2136 v1.0.1 h1:aiztZgzI2cd9FAtBNPILz01mQcZs1jMqJ467KKI4UQ0=
 github.com/libdns/rfc2136 v1.0.1/go.mod h1:Uf4niCfXVgiMgwUrkPdIa5/sqLFdjVhkZj1ZfFAuSq4=
+github.com/libdns/route53 v1.6.0 h1:1fZcoCIxagfftw9GBhIqZ2rumEiB0K58n11X7ko2DOg=
+github.com/libdns/route53 v1.6.0/go.mod h1:7QGcw/2J0VxcVwHsPYpuo1I6IJLHy77bbOvi1BVK3eE=
 github.com/libdns/scaleway v0.2.3 h1:krZpbQyl4cyuB6sVLHLfEQ63K1Z+PDiQcFcJBU3Kyp4=
 github.com/libdns/scaleway v0.2.3/go.mod h1:N9nY2+aeFQu5y439nKT25GHLOhBlRf93WvOqgeX+ztI=
 github.com/libdns/vultr/v2 v2.0.4 h1:4V1OSiUnYvFfpFBicdM27JEnAF0D694cmmQ3AyNqobA=