403 error for incorrect TXT record

Help
1

Hi all,

Thanks for your help in advance.

I'm trying to install Let's Encrypt through Plesk, I'm getting an error for incorrect TXT record.
The TXT records are for email server validation, I'm assuming I'm getting the error as they are external domains, is there anyway around this?

Cheers
Alex

E.g.
Could not issue an SSL/TLS certificate for yamahaclub.com
Details

Could not issue a Let's Encrypt SSL/TLS certificate for yamahaclub.com. Authorization for the domain failed.

Details

Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/273029068756.

Details:

Type: urn:ietf:params:acme:error:unauthorized

Status: 403

Detail: Incorrect TXT record "v=spf1 include:_spf.google.com include:sparkpostmail.com ~all" found at _acme-challenge.yamahaclub.com

My domain is: yamahaclub.com

I ran this command:

It produced this output:

My web server is (include version): Apache/Nginx
The operating system my web server runs on is (include version): Ubuntu 22.04 / Plesk 18.0.55 Update #2

I can login to a root shell on my machine (yes or no, or I don't know): Have SSH access

2

It's possible to have multiple TXT RRs for the same hostname. That said, why would the _acme-challenge label have a SPF TXT record?

2 Likes
3

They likely also used a wildcard DNS entry to define their SPF record [not uncommon].

1 Like
4

Or because of a mis-placed CNAME?

_acme-challenge.yamahaclub.com.	300 IN	CNAME	yamahaclub.com.
yamahaclub.com.		3600	IN	TXT	"v=spf1 include:_spf.google.com include:sparkpostmail.com ~all"
2 Likes
6

OR
A wildcard CNAME ? ? ?
Yikes!

I'd really like to see that DNS zone.

2 Likes
7

Thanks everyone, I hadn't added the acme challenge contents correctly to the DNS. Still confused over that error message though, not explicit to what the problem was. Oh well sorted now, thanks again.

1 Like
8

What exactly wasn't clear about the error message? It said it couldn't find the correct TXT record, instead found a SPF value.

1 Like
9

It said:

Detail: Incorrect TXT record "v=spf1 include:_spf.google.com include:sparkpostmail.com ~all" found at _acme-challenge.yamahaclub.com

That TXT record had no relation to the acme-challenge, why did it hightlight this one? This TXT record was correctly deployed.

10

That's why it was incorrect.

Apparently not.

2 Likes
11

Because it was the only one heard.

2 Likes
12

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.