CAA error on AWS for only one of two domains

Help
1

My domain is: delenta.xyz

I ran this command: I used a nodejs library to run against the API

It produced this output: DNS problem: SERVFAIL looking up CAA for delenta.xyz - the domain's nameservers may be malfunctioning

My web server is (include version): NodeJs 18

The operating system my web server runs on is (include version): Alpine Linux 3.15

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don't know): No

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Not using certbot

I am getting something weird with one of my test domains I use, it works fine with one but not the other and tbh DNS goes a little over my head at times.

I get the usual error of "DNS problem: SERVFAIL looking up CAA for delenta.xyz - the domain's nameservers may be malfunctioning" but AWS says everything is fine their side and this has suddenly stopped working, I have issued like 60 odd certs for this domain before.

To make it more confusing delenta.com works fine to issue certs against and it is hosted on same AWS account with same configuration.

Anyone here have any ideas?

2

Strangely enough unboundtest.com doesn't result in any error.

However, if I check delenta.xyz | DNSViz, I see a lot of errors with some nameservers refusing to answer for delenta.xyz. And if you check the warnings, there seems to be a discrepancy between the authoritative NS RRset and the delegation NS RRset. I have not checked if there's a correlation between this discrepancy and the nameservers responding with a REFUSED, but this might be the case.

1 Like
3

Ah interesting, yeah if I query delenta.com the chart comes out right, hmm, I should relay this back to AWS

4

Ok turns out AWS changed some of their NS server values and I was using old defunct ones, thanks for that it got them to come up with the solution

4 Likes
5

A post was split to a new topic: CAA errors in AWS DNS

6

The same for me, I'm going crazy... going to check NS as stated above...

1 Like
7

2 posts were merged into an existing topic: CAA errors in AWS DNS

9

God bless you mates, problem solved!

2 Likes