diff --git a/pkgs/development/python-modules/certbot-dns-rfc2136/default.nix b/pkgs/development/python-modules/certbot-dns-rfc2136/default.nix
new file mode 100644
index 00000000000..19e53aa20cc
--- /dev/null
+++ b/pkgs/development/python-modules/certbot-dns-rfc2136/default.nix
@@ -0,0 +1,35 @@
+{ buildPythonPackage
+, acme
+, certbot
+, dnspython
+, isPy3k
+, pytest
+, pytestCheckHook
+}:
+
+buildPythonPackage rec {
+  inherit (certbot) src version;
+
+  pname = "certbot-dns-rfc2136";
+
+  propagatedBuildInputs = [
+    acme
+    certbot
+    dnspython
+  ];
+
+  checkInputs = [
+    pytest
+    pytestCheckHook
+  ];
+
+  disabled = !isPy3k;
+
+  pytestFlagsArray = [ "-o cache_dir=$(mktemp -d)" ];
+
+  sourceRoot = "source/${pname}";
+
+  meta = certbot.meta // {
+    description = "RFC 2136 DNS Authenticator plugin for Certbot";
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 99e8975e385..4340f6a30ee 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -581,6 +581,8 @@ in {
 
   certbot-dns-cloudflare = callPackage ../development/python-modules/certbot-dns-cloudflare { };
 
+  certbot-dns-rfc2136 = callPackage ../development/python-modules/certbot-dns-rfc2136 { };
+
   certbot-dns-route53 = callPackage ../development/python-modules/certbot-dns-route53 { };
 
   cfn-flip = callPackage ../development/python-modules/cfn-flip { };