Certbot failing when correct dns txt records added

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: clubhelp.com.au

I ran this command:
sudo certbot certonly --cert-name CERTNAME --server https://acme-v02.api.letsencrypt.org/directory --manual --preferred-challenges dns -d 'clubhelp.com.au, *.clubhelp.com.au'
It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for clubhelp.com.au and *.clubhelp.com.au


Please deploy a DNS TXT record under the name:

_acme-challenge.clubhelp.com.au.

with the following value:

Fbs37N1Nbs12Z40znny15wEU4aE4054511icdfMfpmI


Press Enter to Continue


Please deploy a DNS TXT record under the name:

_acme-challenge.clubhelp.com.au.

with the following value:

2-oJ_ivXHMbheSQ716TocNvTc6PffE_iJHfZcYj1SOA

(This must be set up in addition to the previous challenges; do not remove,
replace, or undo the previous challenge tasks yet. Note that you might be
asked to create multiple distinct TXT records with the same name. This is
permitted by DNS standards.)

Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: Dig (DNS lookup).
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.


Press Enter to Continue

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
Domain: clubhelp.com.au
Type: unauthorized
Detail: Incorrect TXT record "Fbs37N1Nbs12Z40znny15wEU4aE4054511icdfMfpmI" found at _acme-challenge.clubhelp.com.au

Hint: The Certificate Authority failed to verify the manually created DNS TXT records. Ensure that you created these in the correct location, or try waiting longer for DNS propagation on the next attempt.

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): nginx latest

The operating system my web server runs on is (include version): ubuntu 24.04

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 1.21.0

Note that the failure is because I added the record it asked for and that certbot told me not to delete.

Why not simply use certbot-dns-route53 instead of the manual plugin?

By the way, probably not related to your issue, but something isn't correct with the authorative nameserver settings for your domain in the .au. TLD nameservers:

clubhelp.com.au.	3600	IN	NS	ns25.digicertdns.com.
clubhelp.com.au.	3600	IN	NS	ns24.digicertdns.com.
clubhelp.com.au.	3600	IN	NS	ns21.digicertdns.com.
clubhelp.com.au.	3600	IN	NS	ns22.digicertdns.com.
clubhelp.com.au.	3600	IN	NS	ns23.digicertdns.com.
clubhelp.com.au.	3600	IN	NS	ns20.digicertdns.com.
md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 3600 IN NSEC3 1 1 1 D399EAAB MDA0OUT18H69C95KQ61AL5Q3216MU6ME NS SOA RRSIG DNSKEY NSEC3PARAM
md9i9voubqb55nj87e5v632qbmvr5iou.com.au. 3600 IN RRSIG NSEC3 8 3 3600 20250514064229 20250423054229 58863 com.au. J3mzIGfnhflWXymDwY0xgljtLTeCpcuiR8NIsWl0Ul32KLuJ82Ikmfk1 jCHIEDvH4whqtSRFcpOxvw9yIrnGELPtalM5c2ij8gMlUOxrBoEhHEVK 9ZYHre2paMtrfsBZNzbDIzg7WX++rKdpQ7T4NZDzj+PpA71QHmuXqNxQ LaA=
e2n52gif1q9e1ne65rivop2l1lrflcku.com.au. 3600 IN NSEC3 1 1 1 D399EAAB E2NT6DCQBF7R81P5H4VRRCOHJURSE2HJ NS DS RRSIG
e2n52gif1q9e1ne65rivop2l1lrflcku.com.au. 3600 IN RRSIG NSEC3 8 3 3600 20250508151706 20250417141706 58863 com.au. XCbNBi46SO8ohaDAFd3NVY3mvFltacQyjSw8EhNX+3u80G5F2Zjcsx3u dVdNwJh/PSbmbj5MR23OYnSvCUJvHvta5nlSLhqKsbS9HC/BKnisZ9HV Gl5A/zzl7s0y7Yvx++emP8OfcmhlNOeka/lZ+b6/+AvpaY017LXMFwW+ CMs=
couldn't get address for 'ns25.digicertdns.com': not found
couldn't get address for 'ns24.digicertdns.com': not found
couldn't get address for 'ns23.digicertdns.com': not found
;; Received 688 bytes from 65.22.196.1#53(q.au) in 16 ms

Notice the three "couldn't get address for" for configured three nameservers.

1 Like

I didn't use route53 because I'm set up on dnsmadeeasy.

Thanks for the catch on the address lookup failures. I've fixed that.

Randomly retrying renewal another time... and it just worked. However I certainly need to have it working automatically.

What about this: Welcome to certbot-dns-dnsmadeeasy’s documentation! — certbot-dns-dnsmadeeasy 0 documentation

3 Likes