# Beginner - "DNS problem: SERVFAIL looking up A for..." **URL:** \ **Category:** Help\ **Created:** [November 13, 2025, 3:07pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931 "2025-11-13T15:07:13Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:07pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/1 "2025-11-13T15:07:13Z")
My domain is: [lucynet.org](http://lucynet.org) I ran this command: started swag container It produced this output: > Certbot failed to authenticate some domains (authenticator: standalone). The Certificate Authority reported these problems: > Domain: [overseerr.lucynet.org](http://overseerr.lucynet.org) > Type: dns > Detail: DNS problem: SERVFAIL looking up A for [overseerr.lucynet.org](http://overseerr.lucynet.org) - the domain's nameservers may be malfunctioning; no valid AAAA records found for [overseerr.lucynet.org](http://overseerr.lucynet.org) > > Hint: The Certificate Authority failed to download the challenge files from the temporary standalone webserver started by Certbot on port 80. Ensure that the listed domains point to this machine and that it can accept inbound connections from the internet. > > ERROR: Cert does not exist! Please see the validation error above. The issue may be due to incorrect dns or port forwarding settings. Please fix your settings and recreate the container My web server is (include version): unknown The operating system my web server runs on is (include version): Unraid 6.12.10, [Linuxserver.io](http://Linuxserver.io) swag docker My hosting provider, if applicable, is: squarespace I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 5.1.0 I'm running letsencrypt to setup a reverse proxy to access [overseerr.lucynet.org](http://overseerr.lucynet.org). I don't have a great understanding of all of this but I'm trying to learn. PortChecker says ports 80 and 443 are open. Opnsense firewall rules: ![firewallrules](https://global.discourse-cdn.com/letsencrypt/original/3X/0/8/08aa5f084dbb86ce5a35e5b44ef1b818c4956f1d.jpeg) ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:07pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/2 "2025-11-13T15:07:55Z")
Squarespace DNS CNAME setup: ![squarespacedns](https://global.discourse-cdn.com/letsencrypt/original/3X/3/5/359d2d84c298f936e0e5b34f215a6fcc4f6389c5.jpeg) ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:08pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/3 "2025-11-13T15:08:27Z")
Duckdns: ![duckdns](https://global.discourse-cdn.com/letsencrypt/original/3X/3/5/35518cbd16d73bc55d9fee0b3bd29cf96cc13f52.jpeg) ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:08pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/4 "2025-11-13T15:08:58Z")
docker setup: ![dockersetup](https://global.discourse-cdn.com/letsencrypt/original/3X/0/6/066672ece986e632eb7e307de3e889358e0602a0.jpeg) ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:15pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/5 "2025-11-13T15:15:48Z")
domain forward setup: ![domainforward](https://global.discourse-cdn.com/letsencrypt/original/3X/1/3/135a9b67978fe54a4acbe8a84b0e7421b7b283ed.jpeg) ---
**Author:** ![linkp](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/linkp/32/60089_2.png) [@linkp](https://community.letsencrypt.org/u/linkp)\ **Post date:** [November 13, 2025, 3:34pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/6 "2025-11-13T15:34:42Z")
Welcome to the Let's Encrypt Community. Try running the FQDN through Let's Debug. You will see that you are returning an HTTP 401. That is going to break your ACME challenge. > **[Test result for overseerr.lucynet.org: Warning](https://letsdebug.net/overseerr.lucynet.org/2620995)** > > 1 unique issue(s) detected (UnexpectedHttpResponse) Your DNSviz report doesn't look great, either, but focus on eliminating that HTTP 401 response first. > **[overseerr.lucynet.org | DNSViz](https://dnsviz.net/d/overseerr.lucynet.org/dnssec/)** ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 3:43pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/8 "2025-11-13T15:43:49Z")
Thanks for looking into things. What should I be looking at to eliminate the 401 response? Additionally, since originally posting, I added some CNAME records shown below and the letsencrypt server was able to start > Using Let's Encrypt as the cert provider > SUBDOMAINS entered, processing > Sub-domains processed are: [overseerr.lucynet.org](http://overseerr.lucynet.org) > E-mail address entered: [redacted > http validation is selected > Certificate exists; parameters unchanged; starting nginx > The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am). > [custom-init] No custom files found, skipping... > [ls.io-init] done. > Server ready ---
**Author:** ![linkp](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/linkp/32/60089_2.png) [@linkp](https://community.letsencrypt.org/u/linkp)\ **Post date:** [November 13, 2025, 3:49pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/9 "2025-11-13T15:49:12Z")
> [@cbtiger](#): > > What should I be looking at to eliminate the 401 response? That question is best directed to the support channels for the server you are running that is returning that response. Presumably that is a swag container. I have no idea where you can find support for that, but you need a properly functioning server environment before you start trying to issue certificates. Did you configure firewall rules or other access restrictions on port 80? ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [November 13, 2025, 4:08pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/10 "2025-11-13T16:08:06Z")
> [@cbtiger](#): > > Certbot failed to authenticate some domains (authenticator: standalone) > [@cbtiger](#): > > My web server is (include version): unknown Your web server is `nginx`. At least that is the server currently replying to HTTP requests to your domain. You can tell by viewing the response headers in an HTTP request. The --standalone option is a poor choice when using a web server. You should be using --webroot or even the --nginx option instead. Where did you see instructions that said to use --standalone? ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 4:10pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/11 "2025-11-13T16:10:12Z")
So letsencrypt is issuing the certificates now that I added the CNAMEs. > Generating new certificate > Saving debug log to /config/log/letsencrypt/letsencrypt.log > Account registered. > Requesting a certificate for [overseerr.lucynet.org](http://overseerr.lucynet.org) > > Successfully received certificate. > Certificate is saved at: /config/etc/letsencrypt/live/overseerr.lucynet.org/fullchain.pem > Key is saved at: /config/etc/letsencrypt/live/overseerr.lucynet.org/privkey.pem > This certificate expires on 2026-02-11. > These files will be updated when the certificate renews. > NEXT STEPS: > > - The certificate will need to be renewed before it expires. Certbot can automatically renew the certificate in the background, but you may need to take steps to enable that functionality. See [User Guide — Certbot 5.2.0.dev0 documentation](https://certbot.org/renewal-setup) for instructions. > > * * * > > If you like Certbot, please consider supporting our work by: > > - Donating to ISRG / Let's Encrypt: [Support Encryption for Everyone - Let's Encrypt](https://letsencrypt.org/donate) > - Donating to EFF: [Support EFF's Work on Let's Encrypt | Electronic Frontier Foundation](https://eff.org/donate-le) > > * * * > > New certificate generated; starting nginx > The cert does not expire within the next day. Letting the cron script handle the renewal attempts overnight (2:08am). > [custom-init] No custom files found, skipping... > [ls.io-init] done. > Server ready What you're saying is that this is most likely an issue with my Unraid server config? I'll go post over on those forums. Appreciate the responses. As for port 80, I forwarded it to internal port 180 on my Unraid machine. My port forward setup is shown in a screenshot above. ---
**Author:** ![cbtiger](https://avatars.discourse-cdn.com/v4/letter/c/9de0a6/32.png) [@cbtiger](https://community.letsencrypt.org/u/cbtiger)\ **Post date:** [November 13, 2025, 4:22pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/12 "2025-11-13T16:22:45Z")
I figured out the 401 error - I had uncommented the highlighted lines in the config file while messing around earlier. Recommenting them fixed the issue and now I'm up and running. ![overseerrconf](https://global.discourse-cdn.com/letsencrypt/original/3X/f/0/f05251148745bc4c3ca52903d0c7f71cde9d47cc.jpeg) ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [December 13, 2025, 4:23pm UTC](https://community.letsencrypt.org/t/beginner-dns-problem-servfail-looking-up-a-for/242931/13 "2025-12-13T16:23:05Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.