diff --git a/src/cert/acme2.js b/src/cert/acme2.js
index 5d07e9a17..df51833a8 100644
--- a/src/cert/acme2.js
+++ b/src/cert/acme2.js
@@ -456,7 +456,7 @@ Acme2.prototype.prepareDnsChallenge = function (hostname, domain, authorization,
 
     debug(`prepareDnsChallenge: update ${challengeSubdomain} with ${txtValue}`);
 
-    domains.upsertDnsRecords(challengeSubdomain, domain, 'TXT', [ txtValue ], function (error) {
+    domains.upsertDnsRecords(challengeSubdomain, domain, 'TXT', [ `"${txtValue}"` ], function (error) {
         if (error) return callback(new Acme2Error(Acme2Error.EXTERNAL_ERROR, error.message));
 
         domains.waitForDnsRecord(`${challengeSubdomain}`, domain, 'TXT', txtValue, { interval: 5000, times: 200 }, function (error) {
diff --git a/src/domains.js b/src/domains.js
index b603dc09c..d1697c32f 100644
--- a/src/domains.js
+++ b/src/domains.js
@@ -380,6 +380,7 @@ function getDnsRecords(subdomain, domain, type, callback) {
     });
 }
 
+// note: for TXT records the values must be quoted
 function upsertDnsRecords(subdomain, domain, type, values, callback) {
     assert.strictEqual(typeof subdomain, 'string');
     assert.strictEqual(typeof domain, 'string');