I ran this command:
certbot certonly --dns-rfc2136 --dns-rfc2136-credentials -v
It produced this output:
Certbot failed to authenticate some domains (authenticator: dns-rfc2136). The Certificate Authority reported these problems:
Domain: dashboard.panorama9.com
Type: dns
Detail: During secondary validation: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.dashboard.panorama9.com - check that a DNS record exists for this domain
while renewal is ongoing i can validate that the TXT record is there with dig, whether using our primary, secondary dns or the public google dns
dig @ns1.panorama9.com _acme-challenge.dashboard.panorama9.com TXT +short
but i get the output from above that the secondary validation failed
Is this related to Multi-Perspective Validation ? that some or multiple validation from some regions failed ?
I have used --dns-rfc2136-propagation-seconds to increase time up to 3 hours, i still get the same error.
right, it says NXDOMAIN, but when i dig the TXT record from any server i get NOERROR along side the value of the record. is the certficate authority querying some dns that have yet to be propoganded ? as i mentioned before, i did wait for 3 hours. And i can't think of anything on how to further debug this
com to panorama9.com: The following NS name(s) were found in the authoritative NS RRset, but not in the delegation NS RRset (i.e., in the com zone): ns2.panorama9.org, ns1.panorama9.org
com to panorama9.com: The following NS name(s) were found in the delegation NS RRset (i.e., in the com zone), but not in the authoritative NS RRset: ns1.panorama9.com, ns2.panorama9.com
That is, the .com zone says your nameservers end in .com:
I can't say either, but afaik, until recently the dns servers were helping validating tokens correctly, and there was no change there.
the .org servers are the one registered as NS on the hosting provider while .com are alias they both point to the same servers
this is more interesting, could it be geo related ? i've tried query on different laptops and i get the token correctly(can you please make the query again ? it'll be there for couple minutes)
Query results for TXT _acme-challenge.dashboard.panorama9.com
Response:
;; opcode: QUERY, status: NXDOMAIN, id: 11351
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;_acme-challenge.dashboard.panorama9.com. IN TXT
;; AUTHORITY SECTION:
panorama9.com. 0 IN SOA ns1.panorama9.com. dns.jomax.net. 2016114767 28800 7200 604800 86400
All just saying NXDOMAIN. Are you sure you're updating the DNS servers that the outside world sees, and not some sort of visibly-internal-only server? Though the fact that you see a "secondary validation" message implies that the primary validation did see the record. Hmm…
yes, 79.125.105.180 and 46.51.187.235 are both aws bind servers registered as NS, and as you said the primary validation passed, but one or more of the validation from different regions didn't, which may mean that those dns weren't propagated with new records, hence why i did try to wait from 10 minutes to couple hours to no avail
And yet I do see the record when querying 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google), even after their TTL expires, but I get NXDOMAIN via 64.6.64.6 (Verisign) or 208.67.222.222 (OpenDNS) (or when I try to check the authoritative servers myself).
So it does look like your DNS servers are giving different responses to different parts of the Internet, somehow.
So are you saying that your DNS server intentionally gives different answers for different regions for some queries? Because if that's the case, then definitely check that your TXT update is updating the responses for all regions.
Sorry for late reply(just got access to the server)
So, yes that was it, we do have multiple zones, one for US regions, and the other zone for the rest, we were always updating the us one, and it was working file until recently(idk if Multi-Perspective Validation was implemented recently hence why validating from multiple regions ?)
Using certbot, is it possible to do the dns-challenge by adding the record simultaneously to the two zones ? or must we configure one zone to transfer data to the other ?
