diff --git a/security/acme-client/pkg-descr b/security/acme-client/pkg-descr
index 2593a7e78..a7e1a22ee 100644
--- a/security/acme-client/pkg-descr
+++ b/security/acme-client/pkg-descr
@@ -10,6 +10,9 @@ Plugin Changelog
 
 2.1
 
+Added:
+* add support for deSEC.io domain API (#2120)
+
 Fixed:
 * fix creation of nsupdate secrets file
 
diff --git a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
index 10ec7609c..7866682af 100644
--- a/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
+++ b/security/acme-client/src/opnsense/mvc/app/controllers/OPNsense/AcmeClient/forms/dialogValidation.xml
@@ -1181,4 +1181,19 @@
         <label>KAS Authtype</label>
         <type>dropdown</type>
     </field>
+    <field>
+        <label>deSEC.io API</label>
+        <type>header</type>
+        <style>table_dns table_dns_desec</style>
+    </field>
+    <field>
+        <id>validation.dns_desec_token</id>
+        <label>deSEC token</label>
+        <type>password</type>
+    </field>
+    <field>
+        <id>validation.dns_desec_name</id>
+        <label>deSEC domain</label>
+        <type>text</type>
+    </field>
 </form>
diff --git a/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsDedyn.php b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsDedyn.php
new file mode 100644
index 000000000..8c27dc470
--- /dev/null
+++ b/security/acme-client/src/opnsense/mvc/app/library/OPNsense/AcmeClient/LeValidation/DnsDedyn.php
@@ -0,0 +1,45 @@
+<?php
+
+/*
+ * Copyright (C) 2020 Frank Wall
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\AcmeClient\LeValidation;
+
+use OPNsense\AcmeClient\LeValidationInterface;
+use OPNsense\Core\Config;
+
+/**
+ * deSEC API
+ * @package OPNsense\AcmeClient
+ */
+class DnsDesec extends Base implements LeValidationInterface
+{
+    public function prepare()
+    {
+        $this->acme_env['DEDYN_TOKEN'] = (string)$this->config->dns_desec_token;
+        $this->acme_env['DEDYN_NAME'] = (string)$this->config->dns_desec_name;
+    }
+}
diff --git a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
index 9f7b7f633..b87b20dbc 100644
--- a/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
+++ b/security/acme-client/src/opnsense/mvc/app/models/OPNsense/AcmeClient/AcmeClient.xml
@@ -382,6 +382,7 @@
                         <dns_cx>CloudXNS.com API</dns_cx>
                         <dns_cn>Core-Networks API</dns_cn>
                         <dns_cyon>cyon.ch API</dns_cyon>
+                        <dns_desec>deSEC.io API</dns_desec>
                         <dns_dgon>DigitalOcean API</dns_dgon>
                         <dns_da>DirectAdmin API</dns_da>
                         <dns_dnsimple>DNSimple API</dns_dnsimple>
@@ -507,10 +508,10 @@
                     <Required>N</Required>
                 </dns_cx_secret>
                 <dns_cyon_user type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_cyon_user>
                 <dns_cyon_password type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_cyon_password>
                 <dns_da_key type="TextField">
                     <Required>N</Required>
@@ -520,19 +521,19 @@
                     <default>1</default>
                 </dns_da_insecure>
                 <dns_dgon_key type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_dgon_key>
                 <dns_dnsimple_token type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_dnsimple_token>
                 <dns_doapi_token type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_doapi_token>
                 <dns_do_pid type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_do_pid>
                 <dns_do_password type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_do_password>
                 <dns_dp_id type="TextField">
                     <Required>N</Required>
@@ -708,20 +709,20 @@
                     <Required>N</Required>
                 </dns_lexicon_token>
                 <dns_linode_key type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_linode_key>
                 <dns_linode_v4_key type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_linode_v4_key>
                 <dns_loopia_api type="TextField">
-                  <Required>N</Required>
-                  <default>https://api.loopia.se/RPCSERV</default>
+                    <Required>N</Required>
+                    <default>https://api.loopia.se/RPCSERV</default>
                 </dns_loopia_api>
                 <dns_loopia_user type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_loopia_user>
                 <dns_loopia_password type="TextField">
-                  <Required>N</Required>
+                    <Required>N</Required>
                 </dns_loopia_password>
                 <dns_lua_email type="TextField">
                     <Required>N</Required>
@@ -935,6 +936,12 @@
                         <sha1>SHA1</sha1>
                     </OptionValues>
                 </dns_kas_authtype>
+                <dns_desec_token type="TextField">
+                    <Required>N</Required>
+                </dns_desec_token>
+                <dns_desec_name type="TextField">
+                    <Required>N</Required>
+                </dns_desec_name>
             </validation>
         </validations>
         <actions>