Cert-manager challenge hangs at "Waiting for dns-01 challenge propagation: DNS record

[skg]

Hi All,

i am not sure if this is the right forum for this question. I am stuck, so trying to see if someone has any idea about this issue.

My domain is:
skgtestk8s.com its registered with google domains

I ran this command:
kubectl get challenge

Kubernetes yaml files

–Issuer
apiVersion: cert-manager.io/v1alpha3
kind: Issuer
metadata:
name: letsencrypt-staging
spec:
acme:
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: sgk@gmail.com
privateKeySecretRef:
name: letsencrypt-staging
solvers:
- dns01:
clouddns:
project: white-ci-273105
serviceAccountSecretRef:
name: clouddns-dns01-solver-svc-acct
key: key.json

–certificate
apiVersion: cert-manager.io/v1alpha3
kind: Certificate
metadata:
name: test
namespace: default
spec:
secretName: test-tls
issuerRef:
name: letsencrypt-staging
dnsNames:

• www.skgtestk8s.com

It produced this output:

My web server is (include version):
i don't have web server

The operating system my web server runs on is (include version):
* Kubernetes version: v1.16.13-gke.1
* Cloud-provider/provisioner: GKE
* cert-manager version: v0.16.1
* Install method (e.g. helm or static manifests):
helm3 install cert-manager --namespace cert-manager --version v0.16.1 jetstack/cert-manager --set installCRDs=true --set 'extraArgs={--dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53,ns-cloud-a1.googledomains.com:53}'

My hosting provider, if applicable, is:
Google 


I can login to a root shell on my machine (yes or no, or I don't know):
Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Google Console

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):
Kubernetes version: v1.16.13-gke.1


Issue:
Cert manager challenge hangs with following message.
"Waiting for dns-01 challenge propagation: DNS record for "skgtestk8s.com" not yet propagated"

kubectl get challenge

Status:
Presented: true
Processing: true
Reason: Waiting for dns-01 challenge propagation: DNS record for “skgtestk8s.com” not yet propagated
State: pending
Events:
Type Reason Age From Message

---

Normal Started 46m cert-manager Challenge scheduled for processing
Normal Presented 46m cert-manager Presented challenge using dns-01 challenge mechanism

CloudDNS shows challenge records

![image|690x57](upload://AcvvVhYiaArbp6I5rmztB8Ydka0.png)

[_az]

Just so the screenshot isn’t hidden in a code block:

It doesn’t seem that the records are actually visible, though. Google Cloud nameservers are a giving me a NXDOMAIN response for those records.

Is it definitely the correct Google Cloud DNS account that owns the DNS zone, being updated? And definitely the right nameservers (ns-cloud-c{1,2,3,4}.googledomains.com)?

I know with some DNS providers it’s (confusingly) possible to add a single domain to many accounts, but only one actually really controls it after verifying it.

[skg]

Sorry, I deleted the certificate which also deleted those records.

Please try now. I tried creating a certificate those records should be visible. i can see them in CloudDNS

[_az]

This is definitely the wrong Google Cloud account, or the wrong DNS zone.

Look at the nameserver list: it’s ns-cloud-a{1,2,3,4}.googledomains.com.

However, at your domain registrar, you have these NS configured:

skgtestk8s.com.         172800  IN      NS      ns-cloud-c1.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c2.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c3.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c4.googledomains.com.

Note the difference - a vs c.

If you want to use this Google Cloud DNS Zone, you’ll have to update your domain registrar to use the a nameservers.

[skg]

sorry, i had to bump the TTL. Here is the latest ones created

[skg]

Thanks!!, a lot. i will try changing and let you know results

[freessltools.com]

@skg

Glad to see you got your domain registered today

[skg]

Thanks a lot!!! that was THE problem. i really appreciate your help!

I am new, learning setting up a domain and a dns zone. It’s so confusing to really distinguish roles of domain and dnz done servers