diff --git a/docker-compose.yml b/docker-compose.yml
index 428e8e6..32022b9 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,11 @@ services:
       - "--providers.docker.exposedbydefault=false"
       - "--entrypoints.web.address=:80"
       - "--entrypoints.websecure.address=:443"
-      - "--certificatesresolvers.letsencrypt.acme.tlschallenge=true"
+      # DNS-01 statt TLS-ALPN-01 (CFGMON-01): keine oeffentlich offenen 80/443
+      # fuer die Validierung noetig; ermoeglicht Wildcards. Token via .env (Host).
+      - "--certificatesresolvers.letsencrypt.acme.dnschallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.provider=ionos"
+      - "--certificatesresolvers.letsencrypt.acme.dnschallenge.resolvers=1.1.1.1:53,8.8.8.8:53"
       - "--certificatesresolvers.letsencrypt.acme.email=gamemaster@axion1337.de"
       - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
       - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
@@ -31,6 +35,10 @@ services:
     ports:
       - "80:80"
       - "443:443"
+    environment:
+      # IONOS Developer DNS-API-Key im Format <prefix>.<secret> — liegt in
+      # /opt/thread-net-git/.env (git-ignoriert), NICHT im Repo.
+      - "IONOS_API_KEY=${IONOS_API_KEY:?IONOS_API_KEY fehlt in .env}"
     volumes:
       - "/var/run/docker.sock:/var/run/docker.sock:ro"
       # Named Volume statt frueherem Portainer-Bind ./letsencrypt: enthaelt