Thanks for letting me know! I tried adding IPv6 support and restarting, but it still seems to be having some troubles. I’ll give it another shot later - please ping me if I forget. 
I did some testing on my end, and while my monitoring probing the nameservers directly doesn’t show any errors, I added some monitoring which goes through Google’s resolvers, which does return a quite high error rate. So I’m starting to suspect a paranoid DDoS system, or some other malfunction in the namesever stack is the issue.
The error rate is not big enough to have a really noticeable impact on normal browsing, but if you do multiple TXT and CAA lookups from multiple locations, and one failed query fails the entire validation, then it’s not really surprising many certificate requests fail.
I’m already trying to contact the nameserver operators to get more info about this.
Thanks all for the help so far!
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.