# Dns-01 use cached reply from own letsencrypt ns

**URL:** <https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317>\
**Category:** Help\
**Created:** [May 30, 2020, 6:25pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317 "2020-05-30T18:25:51Z")\
**Posts on this page:** 17\
**Page:** 1

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 30, 2020, 6:25pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/1 "2020-05-30T18:25:51Z")

</div>

My domain is: [starline.ru](http://starline.ru)

I ran this command: dehydrated -c

It produced this output:

```auto
    # dehydrated -c
    # INFO: Using main config file /etc/dehydrated/config
    Processing *.starline.ru
    Unknown hook 
     + Signing domains...
     + Generating private key...
     + Generating signing request...
     + Requesting new certificate order from CA...
     + Received 1 authorizations URLs from the CA
     + Handling authorization for starline.ru
     + 1 pending challenge(s)
     + Deploying challenge tokens...
    deploy_challenge: deploy_challenge
    deploy_challenge: starline.ru
    deploy_challenge: qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58
    deploy_challenge: iAyiNX-npIVn9wdFy8I1L09fqNHJUWrDhHdsrFHvd6k
    /etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
    zone starline.ru/IN: loaded serial 2020053021
    OK
     + Responding to challenge for starline.ru authorization...
    Unknown hook "invalid_challenge"
     + Cleaning challenge tokens...
    clean_challenge: clean_challenge
    clean_challenge: starline.ru
    clean_challenge: qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58
    clean_challenge: iAyiNX-npIVn9wdFy8I1L09fqNHJUWrDhHdsrFHvd6k
    /etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
    zone starline.ru/IN: loaded serial 2020053021
    OK
     + Challenge validation has failed :(
    ERROR: Challenge is invalid! (returned: invalid) (result: {
      "type": "dns-01",
      "status": "invalid",
      "error": {
        "type": "urn:ietf:params:acme:error:unauthorized",
        "detail": "Incorrect TXT record \"8fEexLsOf5dT6GJ3_RDsgeg5auOfIe9quW4QWqgP9Hw\" found at _acme-challenge.starline.ru",
        "status": 403
      },
      "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4913816243/5oW-5w",
      "token": "qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58"
    })
    exit_hook: exit_hook
    exit_hook: Challenge
    exit_hook: is
    exit_hook: invalid!
    exit_hook: (returned:
    exit_hook: invalid)
    exit_hook: (result:
    exit_hook: {
    exit_hook: "type":
    exit_hook: "dns-01",
    exit_hook: "status":
    exit_hook: "invalid",
    exit_hook: "error":
    exit_hook: {
    exit_hook: "type":
    exit_hook: "urn:ietf:params:acme:error:unauthorized",
    exit_hook: "detail":
    exit_hook: "Incorrect
    exit_hook: TXT
    exit_hook: record
    exit_hook: \"8fEexLsOf5dT6GJ3_RDsgeg5auOfIe9quW4QWqgP9Hw\"
    exit_hook: found
    exit_hook: at
    exit_hook: _acme-challenge.starline.ru",
    exit_hook: "status":
    exit_hook: 403
    exit_hook: },
    exit_hook: "url":
    exit_hook: "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4913816243/5oW-5w",
    exit_hook: "token":
    exit_hook: "qaaRC3ntFSPRZTIATXV34ws03WkbR2anG6KakDc3h58"
    exit_hook: })

```

Record 8fEexLsOf5dT6GJ3\_RDsgeg5auOfIe9quW4QWqgP9Hw is old, TTL is only 1 minute, but letsencrypt use it after hour later. This is repeatable case and this does not allow get a certificate - letsencrypt every challenge use previous record instead current.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 30, 2020, 6:43pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/2 "2020-05-30T18:43:31Z")

</div>

Hi @rnz

> [@rnz](#):
>
> My domain is: [starline.ru](http://starline.ru)

your name servers are buggy - [https://check-your-website.server-daten.de/?q=starline.ru](https://check-your-website.server-daten.de/?q=starline.ru)

No TCP-connections:

| X | Fatal error: Nameserver doesn't support TCP connection: [ns2.ultrastar.ru](http://ns2.ultrastar.ru) / 87.248.231.171: Timeout |
| --- | --- |
| X | Fatal error: Nameserver doesn't support TCP connection: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 80.73.202.138: Timeout |
| X | Fatal error: Nameserver doesn't support TCP connection: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 87.248.244.66: Timeout |

Timeouts checking Echo capitalization and EDNS512:

| X | Nameserver Timeout checking Echo Capitalization: [ns2.ultrastar.ru](http://ns2.ultrastar.ru) / 87.248.231.171 |
| --- | --- |
| X | Nameserver Timeout checking Echo Capitalization: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 80.73.202.138 |
| X | Nameserver Timeout checking Echo Capitalization: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 87.248.244.66 |
| X | Nameserver Timeout checking EDNS512: [ns2.ultrastar.ru](http://ns2.ultrastar.ru) / 87.248.231.171 |
| X | Nameserver Timeout checking EDNS512: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 80.73.202.138 |
| X | Nameserver Timeout checking EDNS512: [ns3.ultrastar.ru](http://ns3.ultrastar.ru) / 87.248.244.66 |

Same with Unboundtest - there is a complete timeout - [https://unboundtest.com/m/TXT/\_acme-challenge.starline.ru/SCC7AU2V](https://unboundtest.com/m/TXT/_acme-challenge.starline.ru/SCC7AU2V)

Letsencrypt uses an unbound with the same configuration, so that's critical.

Curious: Your error says: No timeout, instead the old value.

PS: You have a lot of name servers. The ultrastars are bad, the others are good.

Perhaps change your dns setup, so ultrastars isn't used.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 30, 2020, 6:43pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/3 "2020-05-30T18:43:59Z")

</div>

Unbound result was too long. Second:

> **Summary**
>
> Query results for TXT \_acme-challenge.starline.ru  
> ----- Unbound logs -----  
> May 30 18:32:34 unbound[3687:0] notice: init module 0: validator  
> May 30 18:32:34 unbound[3687:0] notice: init module 1: iterator  
> May 30 18:32:34 unbound[3687:0] info: start of service (unbound 1.10.1).  
> May 30 18:32:35 unbound[3687:0] info: 127.0.0.1 \_acme-challenge.starline.ru. TXT IN  
> May 30 18:32:35 unbound[3687:0] info: resolving \_acme-challenge.starline.ru. TXT IN  
> May 30 18:32:35 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:35 unbound[3687:0] info: response for . NS IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 193.0.14.129#53  
> May 30 18:32:35 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:35 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:35 unbound[3687:0] info: response for \_acme-challenge.starline.ru. TXT IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 2001:503:c27::2:30#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:35 unbound[3687:0] info: resolving [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: resolving [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: resolving [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:35 unbound[3687:0] info: resolving [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:35 unbound[3687:0] info: resolving [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: resolving [d.dns.ripn.net](http://d.dns.ripn.net). A IN  
> May 30 18:32:35 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 2001:500:a8::e#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:35 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). A IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 2001:503:c27::2:30#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:35 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 2001:dc3::35#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:35 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<net.\> 2001:500:d937::30#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:35 unbound[3687:0] info: resolving [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:35 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:35 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:35 unbound[3687:0] info: reply from \<.\> 199.7.83.42#53  
> May 30 18:32:35 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<net.\> 192.31.80.30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<net.\> 192.5.6.30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: resolving [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 2001:500:200::b#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 2001:7fd::1#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:17:0:193:232:128:6#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<net.\> 2001:502:7094::30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<net.\> 192.54.112.30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<net.\> 2001:502:8cc::30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:15:0:193:232:142:17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for \_acme-challenge.starline.ru. TXT IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ru.\> 193.232.128.6#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns2.ultrastar.ru](http://ns2.ultrastar.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns.ultrastar.ru](http://ns.ultrastar.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns4-l2.nic.ru](http://ns4-l2.nic.ru). A IN  
> May 30 18:32:36 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns4-l2.nic.ru](http://ns4-l2.nic.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.156.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for . NS IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 199.7.91.13#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:36 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:36 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:36 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:36 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 192.203.230.10#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 192.58.128.30#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [ns2.ultrastar.ru](http://ns2.ultrastar.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 2001:500:12::d0d#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for [ns.ultrastar.ru](http://ns.ultrastar.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<.\> 2001:500:12::d0d#53  
> May 30 18:32:36 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:36 unbound[3687:0] info: response for \_acme-challenge.starline.ru. TXT IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<starline.ru.\> 2a01:3f1:862::53#53  
> May 30 18:32:36 unbound[3687:0] info: query response was NXDOMAIN ANSWER  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns3.ultrastar.ru](http://ns3.ultrastar.ru). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: resolving \_acme-challenge.starline.ru. A IN  
> May 30 18:32:36 unbound[3687:0] info: resolving [ns8-l2.nic.ru](http://ns8-l2.nic.ru). A IN  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.156.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:16:0:194:85:252:62#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:17:0:193:232:128:6#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). A IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:36 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:36 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:36 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:16:0:194:85:252:62#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.156.17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:15:0:193:232:142:17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 2001:678:16:0:194:85:252:62#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.128.6#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 193.232.128.6#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns3.ultrastar.ru](http://ns3.ultrastar.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 193.232.156.17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns2.ultrastar.ru](http://ns2.ultrastar.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 193.232.128.6#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns.ultrastar.ru](http://ns.ultrastar.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 2001:678:18:0:194:190:124:17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 2001:678:17:0:193:232:128:6#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e800:9000:31:177:67:100#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e800:9000:31:177:67:100#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for [ns4-l2.nic.ru](http://ns4-l2.nic.ru). AAAA IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e800:9000:31:177:67:100#53  
> May 30 18:32:37 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for \_acme-challenge.starline.ru. A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<starline.ru.\> 194.58.196.62#53  
> May 30 18:32:37 unbound[3687:0] info: query response was NXDOMAIN ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for \_acme-challenge.starline.ru. A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<starline.ru.\> 185.42.137.111#53  
> May 30 18:32:37 unbound[3687:0] info: query response was NXDOMAIN ANSWER  
> May 30 18:32:37 unbound[3687:0] info: prime trust anchor  
> May 30 18:32:37 unbound[3687:0] info: generate keytag query \_ta-4f66. NULL IN  
> May 30 18:32:37 unbound[3687:0] info: resolving . DNSKEY IN  
> May 30 18:32:37 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:37 unbound[3687:0] info: resolving \_ta-4f66. NULL IN  
> May 30 18:32:37 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:37 unbound[3687:0] info: response for . NS IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<.\> 2001:503:ba3e::2:30#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:37 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:37 unbound[3687:0] info: response for . DNSKEY IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<.\> 192.58.128.30#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: validate keys with anchor(DS): sec\_status\_secure  
> May 30 18:32:37 unbound[3687:0] info: Successfully primed trust anchor . DNSKEY IN  
> May 30 18:32:37 unbound[3687:0] info: resolving ru. DS IN  
> May 30 18:32:37 unbound[3687:0] info: response for \_ta-4f66. NULL IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<.\> 2001:500:2f::f#53  
> May 30 18:32:37 unbound[3687:0] info: query response was NXDOMAIN ANSWER  
> May 30 18:32:37 unbound[3687:0] info: response for ru. DS IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<.\> 2001:500:2f::f#53  
> May 30 18:32:37 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:37 unbound[3687:0] info: validated DS ru. DS IN  
> May 30 18:32:37 unbound[3687:0] info: resolving ru. DNSKEY IN  
> May 30 18:32:37 unbound[3687:0] info: response for ru. DNSKEY IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<.\> 2001:7fe::53#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:37 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). A IN  
> May 30 18:32:37 unbound[3687:0] info: reply from \<ru.\> 193.232.156.17#53  
> May 30 18:32:37 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:38 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). A IN  
> May 30 18:32:38 unbound[3687:0] info: reply from \<nic.ru.\> 185.42.137.111#53  
> May 30 18:32:38 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:38 unbound[3687:0] info: response for ru. DNSKEY IN  
> May 30 18:32:38 unbound[3687:0] info: reply from \<ru.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:38 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:38 unbound[3687:0] info: Capsforid: timeouts, starting fallback  
> May 30 18:32:39 unbound[3687:0] info: response for ru. DNSKEY IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ru.\> 193.232.128.6#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: validated DNSKEY ru. DNSKEY IN  
> May 30 18:32:39 unbound[3687:0] info: resolving [starline.ru](http://starline.ru). DS IN  
> May 30 18:32:39 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:39 unbound[3687:0] info: response for . NS IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 2001:dc3::35#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:39 unbound[3687:0] info: response for [starline.ru](http://starline.ru). DS IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 199.9.14.201#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: resolving [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: resolving [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: resolving [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: resolving [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:39 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 192.5.5.241#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 2001:503:c27::2:30#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<net.\> 192.52.178.30#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: resolving [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 192.33.4.12#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<.\> 198.97.190.53#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<net.\> 192.26.92.30#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<net.\> 192.5.6.30#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:15:0:193:232:142:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:15:0:193:232:142:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.128.6#53  
> May 30 18:32:39 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<net.\> 2001:502:8cc::30#53  
> May 30 18:32:39 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:15:0:193:232:142:17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [f.dns.ripn.net](http://f.dns.ripn.net). A IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:39 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:39 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:39 unbound[3687:0] info: Capsforid: timeouts, starting fallback  
> May 30 18:32:40 unbound[3687:0] info: Capsforid: timeouts, starting fallback  
> May 30 18:32:40 unbound[3687:0] info: Capsforid: timeouts, starting fallback  
> May 30 18:32:40 unbound[3687:0] info: Capsforid: timeouts, starting fallback  
> May 30 18:32:40 unbound[3687:0] info: resolving [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:40 unbound[3687:0] info: resolving [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:40 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:40 unbound[3687:0] info: resolving [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: priming . IN NS  
> May 30 18:32:40 unbound[3687:0] info: response for . NS IN  
> May 30 18:32:40 unbound[3687:0] info: reply from \<.\> 192.33.4.12#53  
> May 30 18:32:40 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:40 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:40 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:40 unbound[3687:0] info: priming successful for . NS IN  
> May 30 18:32:40 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: reply from \<.\> 2001:500:2d::d#53  
> May 30 18:32:40 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:40 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: reply from \<.\> 2001:dc3::35#53  
> May 30 18:32:40 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:40 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:40 unbound[3687:0] info: reply from \<.\> 199.9.14.201#53  
> May 30 18:32:40 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:40 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: reply from \<net.\> 192.26.92.30#53  
> May 30 18:32:40 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:40 unbound[3687:0] info: resolving [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:40 unbound[3687:0] info: resolving [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<net.\> 192.35.51.30#53  
> May 30 18:32:41 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [b.dns.ripn.net](http://b.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [d.dns.ripn.net](http://d.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [a.dns.ripn.net](http://a.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:14:0:193:232:156:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:ec00:9040:31:177:74:100#53  
> May 30 18:32:41 unbound[3687:0] info: Capsforid: starting fallback  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [starline.ru](http://starline.ru). DS IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ru.\> 2001:678:18:0:194:190:124:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:ec00:9040:31:177:74:100#53  
> May 30 18:32:41 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<net.\> 2001:503:231d::2:30#53  
> May 30 18:32:41 unbound[3687:0] info: query response was REFERRAL  
> May 30 18:32:41 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<nic.ru.\> 2a01:3f1:862::53#53  
> May 30 18:32:41 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 193.232.142.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e800:9000:31:177:67:100#53  
> May 30 18:32:41 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:41 unbound[3687:0] info: response for [e.dns.ripn.net](http://e.dns.ripn.net). A IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ripn.net.\> 2001:678:18:0:194:190:124:17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was ANSWER  
> May 30 18:32:41 unbound[3687:0] info: response for [starline.ru](http://starline.ru). DS IN  
> May 30 18:32:41 unbound[3687:0] info: reply from \<ru.\> 193.232.156.17#53  
> May 30 18:32:41 unbound[3687:0] info: query response was nodata ANSWER  
> May 30 18:32:41 unbound[3687:0] info: NSEC3s for the referral proved no DS.  
> May 30 18:32:41 unbound[3687:0] info: Verified that unsigned response is INSECURE  
> May 30 18:32:43 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:43 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e800:9000:31:177:67:100#53  
> May 30 18:32:43 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:43 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:43 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e400:7000:31:177:85:186#53  
> May 30 18:32:43 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:43 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:43 unbound[3687:0] info: reply from \<nic.ru.\> 2a01:3f0:400::62#53  
> May 30 18:32:43 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:44 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:44 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:ec00:9040:31:177:74:100#53  
> May 30 18:32:44 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:44 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:44 unbound[3687:0] info: reply from \<nic.ru.\> 194.58.196.62#53  
> May 30 18:32:44 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:44 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:44 unbound[3687:0] info: reply from \<nic.ru.\> 2a01:3f1:862::53#53  
> May 30 18:32:44 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:44 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:44 unbound[3687:0] info: reply from \<nic.ru.\> 2a02:2090:e400:7000:31:177:85:186#53  
> May 30 18:32:44 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback  
> May 30 18:32:44 unbound[3687:0] info: response for [ns8-l2.nic.ru](http://ns8-l2.nic.ru). AAAA IN  
> May 30 18:32:44 unbound[3687:0] info: reply from \<nic.ru.\> 2a01:3f1:862::53#53  
> May 30 18:32:44 unbound[3687:0] info: Capsforid: reply is equal. go to next fallback
> 
> Error running query: read udp 127.0.0.1:51636-\>127.0.0.1:1053: i/o timeout

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 30, 2020, 6:52pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/4 "2020-05-30T18:52:44Z")

</div>

Thank you! This ns have very old and overmisconfigured configuration…

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 30, 2020, 7:27pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/5 "2020-05-30T19:27:34Z")

</div>

I fix this timeout, but steel see same status - letsencrypt use cached status and not get current \_acme record:

```auto
# dehydrated -c
# INFO: Using main config file /etc/dehydrated/config
Unknown hook "startup_hook"
Processing *.starline.ru
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for starline.ru
 + 1 pending challenge(s)
 + Deploying challenge tokens...
deploy_challenge: deploy_challenge
deploy_challenge: starline.ru
deploy_challenge: kVBNg8AS1kPTWq41v3ObymhyJz2uhuVV0eSkrv54n2c
deploy_challenge: WkHHXgrYDRJYe5Y0EjbolrXQ4KCFjRPooCsr9dxw714
/etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
zone starline.ru/IN: loaded serial 2020053022
OK
 + Responding to challenge for starline.ru authorization...
Unknown hook "invalid_challenge"
 + Cleaning challenge tokens...
clean_challenge: clean_challenge
clean_challenge: starline.ru
clean_challenge: kVBNg8AS1kPTWq41v3ObymhyJz2uhuVV0eSkrv54n2c
clean_challenge: WkHHXgrYDRJYe5Y0EjbolrXQ4KCFjRPooCsr9dxw714
/etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
zone starline.ru/IN: loaded serial 2020053022
OK
 + Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:dns",
    "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.starline.ru - check that a DNS record exists for this domain",
    "status": 400
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4914972807/19UHtA",
  "token": "kVBNg8AS1kPTWq41v3ObymhyJz2uhuVV0eSkrv54n2c"
})
exit_hook: exit_hook
exit_hook: Challenge
exit_hook: is
exit_hook: invalid!
exit_hook: (returned:
exit_hook: invalid)
exit_hook: (result:
exit_hook: {
exit_hook: "type":
exit_hook: "dns-01",
exit_hook: "status":
exit_hook: "invalid",
exit_hook: "error":
exit_hook: {
exit_hook: "type":
exit_hook: "urn:ietf:params:acme:error:dns",
exit_hook: "detail":
exit_hook: "DNS
exit_hook: problem:
exit_hook: NXDOMAIN
exit_hook: looking
exit_hook: up
exit_hook: TXT
exit_hook: for
exit_hook: _acme-challenge.starline.ru
exit_hook: -
exit_hook: check
exit_hook: that
exit_hook: a
exit_hook: DNS
exit_hook: record
exit_hook: exists
exit_hook: for
exit_hook: this
exit_hook: domain",
exit_hook: "status":
exit_hook: 400
exit_hook: },
exit_hook: "url":
exit_hook: "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4914972807/19UHtA",
exit_hook: "token":
exit_hook: "kVBNg8AS1kPTWq41v3ObymhyJz2uhuVV0eSkrv54n2c"
exit_hook: })

```

---

<div class="post-metadata">

**Author:** ![orangepizza](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/orangepizza/32/19597_2.png) [@orangepizza](https://community.letsencrypt.org/u/orangepizza)\
**Post date:** [May 30, 2020, 8:33pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/6 "2020-05-30T20:33:45Z")

</div>

[https://www.whatsmydns.net/#TXT/\_acme-challenge.starline.ru](https://www.whatsmydns.net/#TXT/_acme-challenge.starline.ru)

most dns servers can’t see (but some can) your txt record

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 30, 2020, 9:47pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/7 "2020-05-30T21:47:48Z")

</div>

In my hook, i remove \_acme-challenge record before and after challenge:

```auto
...
case "$1" in
    "deploy_challenge")
        for a in $@; do echo "${1}: ${a}"; done

        sed -i.bak "s/.*; serial/$(printf '%.0s ' {0..13}) $(date +%Y%m%d%H) ; serial/g" $ZFILE
        sed -i "/^_acme-challenge .*/d" $ZFILE
        echo "_acme-challenge ${TTL} IN TXT \"${4}\"" >> $ZFILE

        $CHECKZONE $ZONE $ZFILE
        if [$? -ne 0]; then
          echo 'Error'
          exit
        fi

        $SYSTEMCTL reload bind9.service
        sleep 10;
        ;;

    "clean_challenge")
        for a in $@; do echo "${1}: ${a}"; done

        sed -i "s/.*; serial/$(printf '%.0s ' {0..13}) $(date +%Y%m%d%H) ; serial/g" $ZFILE
        sed -i "/^_acme-challenge .*${4}/d" $ZFILE

        $CHECKZONE $ZONE $ZFILE
        if [$? -ne 0]; then
          echo 'Error'
          exit
        fi

        $SYSTEMCTL reload bind9.service
        ;;
...

```

Also this record “lDJiRgdkykehHDcNpP00VRWekURF5fj3Ry1HLkdL-cY” is old (3 times ago before I post [this](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/5)) but some ns-servers still show it

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 30, 2020, 10:28pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/8 "2020-05-30T22:28:38Z")

</div>

Checking your ip addresses manual

`ns8-l2.nic.ru` has the old value:

> :~$ dig TXT \_acme-challenge.starline.ru. @91.217.21.1
> 
> ; \<\<\>\> DiG 9.11.3-1ubuntu1.11-Ubuntu \<\<\>\> TXT \_acme-challenge.starline.ru. @91.217.21.1  
> ;; global options: +cmd  
> ;; Got answer:  
> ;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 9205  
> ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 7, ADDITIONAL: 1  
> ;; WARNING: recursion requested but not available
> 
> ;; OPT PSEUDOSECTION:  
> ; EDNS: version: 0, flags:; udp: 4096  
> ;; QUESTION SECTION:  
> ;\_acme-challenge.starline.ru. IN TXT
> 
> ;; ANSWER SECTION:  
> _[acme-challenge.starline.ru](http://acme-challenge.starline.ru). 60 IN TXT "iTW56_-Etrv3MrqjwHZgReswRqrIh\_3rYpsuIMz636I"
> 
> ;; AUTHORITY SECTION:  
> [starline.ru](http://starline.ru). 3600 IN NS [ns8-l2.nic.ru](http://ns8-l2.nic.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns3.ultrastar.ru](http://ns3.ultrastar.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns.ultrastar.ru](http://ns.ultrastar.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns4-cloud.nic.ru](http://ns4-cloud.nic.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns2.ultrastar.ru](http://ns2.ultrastar.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns4-l2.nic.ru](http://ns4-l2.nic.ru).  
> [starline.ru](http://starline.ru). 3600 IN NS [ns8-cloud.nic.ru](http://ns8-cloud.nic.ru).
> 
> ;; Query time: 60 msec  
> ;; SERVER: 91.217.21.1#53(91.217.21.1)  
> ;; WHEN: Sun May 31 00:25:56 CEST 2020  
> ;; MSG SIZE rcvd: 269

Looks like your name server updates don't work.

And both T-adresses (87.248.236.18, 80.73.202.138) don't answer again.

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 30, 2020, 11:36pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/9 "2020-05-30T23:36:33Z")

</div>

> [@JuergenAuer](#):
>
> Looks like your name server updates don’t work.

I do not think so.

```nohighlight
$ dig TXT starline.ru. @ns3.ultrastar.ru.

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> TXT starline.ru. @ns3.ultrastar.ru.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39728
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 5
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;starline.ru. IN	TXT

;; ANSWER SECTION:
starline.ru. 3600	IN	TXT	"v=spf1 a mx ip4:185.129.96.76 ip4:185.129.96.77 include:smtp.userecho.com ~all"
starline.ru. 3600	IN	TXT	"yandex-verification: 26c3108f3d61e2cc"

;; AUTHORITY SECTION:
starline.ru. 3600	IN	NS	ns4-l2.nic.ru.
starline.ru. 3600	IN	NS	ns.ultrastar.ru.
starline.ru. 3600	IN	NS	ns4-cloud.nic.ru.
starline.ru. 3600	IN	NS	ns2.ultrastar.ru.
starline.ru. 3600	IN	NS	ns3.ultrastar.ru.
starline.ru. 3600	IN	NS	ns8-l2.nic.ru.
starline.ru. 3600	IN	NS	ns8-cloud.nic.ru.

;; ADDITIONAL SECTION:
ns.ultrastar.ru.	86400	IN	A	185.129.96.4
ns2.ultrastar.ru.	86400	IN	A	185.129.96.4
ns3.ultrastar.ru.	86400	IN	A	185.129.96.4
ns4-cloud.NIC.ru.	5093	IN	A	185.42.137.111

;; Query time: 39 msec
;; SERVER: 185.129.96.4#53(185.129.96.4)
;; WHEN: Sat May 30 23:31:59 UTC 2020
;; MSG SIZE rcvd: 416

```

```nohighlight
$ dig TXT starline.ru. @ns8-l2.nic.ru.

; <<>> DiG 9.11.3-1ubuntu1.7-Ubuntu <<>> TXT starline.ru. @ns8-l2.nic.ru.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20669
;; flags: qr aa rd; QUERY: 1, ANSWER: 2, AUTHORITY: 7, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;starline.ru. IN	TXT

;; ANSWER SECTION:
starline.ru. 3600	IN	TXT	"yandex-verification: 26c3108f3d61e2cc"
starline.ru. 3600	IN	TXT	"v=spf1 a mx ip4:185.129.96.76 ip4:185.129.96.77 include:smtp.userecho.com ~all"

;; AUTHORITY SECTION:
starline.ru. 3600	IN	NS	ns4-l2.nic.ru.
starline.ru. 3600	IN	NS	ns8-cloud.nic.ru.
starline.ru. 3600	IN	NS	ns.ultrastar.ru.
starline.ru. 3600	IN	NS	ns3.ultrastar.ru.
starline.ru. 3600	IN	NS	ns2.ultrastar.ru.
starline.ru. 3600	IN	NS	ns4-cloud.nic.ru.
starline.ru. 3600	IN	NS	ns8-l2.nic.ru.

;; Query time: 65 msec
;; SERVER: 91.217.21.1#53(91.217.21.1)
;; WHEN: Sat May 30 23:34:27 UTC 2020
;; MSG SIZE rcvd: 338

```

> [@JuergenAuer](#):
>
> And both T-adresses (87.248.236.18, 80.73.202.138) don’t answer again.

May be big TTL (86400 ) is affects...

But in [this post](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/5) you can see - as letsencrypt not get any one \_acme-challenge record, despite the fact that record present on the first ns ([ns.ultrastar.ru](http://ns.ultrastar.ru))

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 30, 2020, 11:45pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/10 "2020-05-30T23:45:41Z")

</div>

> [@rnz](#):
>
> ```nohighlight
> $ dig TXT starline.ru. @ns3.ultrastar.ru.
> 
> ```

> [@rnz](#):
>
> ```nohighlight
> $ dig TXT starline.ru. @ns8-l2.nic.ru.
> 
> ```

You have to query for `_acme-challenge.starline.ru` to get the ACME validation records.

> [@rnz](#):
>
> But in [this post](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/5) you can see - as letsencrypt not get any one \_acme-challenge record, despite the fact that record present on the first ns ([ns.ultrastar.ru](http://ns.ultrastar.ru))

Let's Encrypt can query any of your authoritative nameservers, though.

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 31, 2020, 12:09am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/11 "2020-05-31T00:09:46Z")

</div>

> [@mnordhoff](#):
>
> You have to query for `_acme-challenge.starline.ru` to get the ACME validation records.

I did - I see name server updates is worked  
For example I skip "clean\_challenge":

```nohighlight
# dehydrated -c
# INFO: Using main config file /etc/dehydrated/config
Unknown hook "this_hookscript_is_broken __dehydrated_is_working_fine__ please_ignore_unknown_hooks_in_your_script"
Unknown hook "startup_hook"
Processing *.starline.ru
Unknown hook "this_hookscript_is_broken __dehydrated_is_working_fine__ please_ignore_unknown_hooks_in_your_script"
 + Signing domains...
 + Generating private key...
 + Generating signing request...
 + Requesting new certificate order from CA...
 + Received 1 authorizations URLs from the CA
 + Handling authorization for starline.ru
 + 1 pending challenge(s)
 + Deploying challenge tokens...
deploy_challenge: deploy_challenge
deploy_challenge: starline.ru
deploy_challenge: q6ZUOKHlWFIyzN5nyKMDC5mO_jzrGCwNyLEU8bApbTI
deploy_challenge: h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI
/etc/bind/zones/starline.ru:8: using RFC1035 TTL semantics
zone starline.ru/IN: loaded serial 2020053102
OK
 + Responding to challenge for starline.ru authorization...
Unknown hook "invalid_challenge"
 + Cleaning challenge tokens...
clean_challenge: clean_challenge
clean_challenge: starline.ru
clean_challenge: q6ZUOKHlWFIyzN5nyKMDC5mO_jzrGCwNyLEU8bApbTI
clean_challenge: h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI
 + Challenge validation has failed :(
ERROR: Challenge is invalid! (returned: invalid) (result: {
  "type": "dns-01",
  "status": "invalid",
  "error": {
    "type": "urn:ietf:params:acme:error:dns",
    "detail": "DNS problem: NXDOMAIN looking up TXT for _acme-challenge.starline.ru - check that a DNS record exists for this domain",
    "status": 400
  },
  "url": "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4919149486/QuWH_A",
  "token": "q6ZUOKHlWFIyzN5nyKMDC5mO_jzrGCwNyLEU8bApbTI"
})
exit_hook: exit_hook
exit_hook: Challenge
exit_hook: is
exit_hook: invalid!
exit_hook: (returned:
exit_hook: invalid)
exit_hook: (result:
exit_hook: {
exit_hook: "type":
exit_hook: "dns-01",
exit_hook: "status":
exit_hook: "invalid",
exit_hook: "error":
exit_hook: {
exit_hook: "type":
exit_hook: "urn:ietf:params:acme:error:dns",
exit_hook: "detail":
exit_hook: "DNS
exit_hook: problem:
exit_hook: NXDOMAIN
exit_hook: looking
exit_hook: up
exit_hook: TXT
exit_hook: for
exit_hook: _acme-challenge.starline.ru
exit_hook: -
exit_hook: check
exit_hook: that
exit_hook: a
exit_hook: DNS
exit_hook: record
exit_hook: exists
exit_hook: for
exit_hook: this
exit_hook: domain",
exit_hook: "status":
exit_hook: 400
exit_hook: },
exit_hook: "url":
exit_hook: "https://acme-v02.api.letsencrypt.org/acme/chall-v3/4919149486/QuWH_A",
exit_hook: "token":
exit_hook: "q6ZUOKHlWFIyzN5nyKMDC5mO_jzrGCwNyLEU8bApbTI"
exit_hook: })

```

As can see - status "invalid"  
But record is present on all authoritative ns:

```nohighlight
$ cat ./check-challenge.sh
#!/usr/bin/env bash

nslist="ns8-l2.nic.ru.
ns3.ultrastar.ru.
ns.ultrastar.ru.
ns4-cloud.nic.ru.
ns2.ultrastar.ru.
ns4-l2.nic.ru.
ns8-cloud.nic.ru."

while (true); do
	echo "-- check _acme-challenge --"
	for ns in $nslist; do 
		echo -en "$ns:\t\t"
		dig +noall +answer -t TXT _acme-challenge.starline.ru @${ns}
	done
	sleep 5;
done	

$ ./check-challenge.sh
-- check _acme-challenge --
ns8-l2.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns3.ultrastar.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns.ultrastar.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns4-cloud.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns2.ultrastar.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns4-l2.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"
ns8-cloud.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"h8mJSiCEuipttSCQMltOrZvCCnf2n9PC8TD6I-syFLI"

```

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 31, 2020, 12:18am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/12 "2020-05-31T00:18:48Z")

</div>

I don’t know. My two best guesses are that:

- Maybe some of the nameservers take a few seconds too long to update?

- Maybe the ACME client’s logic is wrong and it’s reusing an invalid authorization instead of creating a new one?

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 31, 2020, 12:40am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/13 "2020-05-31T00:40:41Z")

</div>

> [@mnordhoff](#):
>
> Maybe some of the nameservers take a few seconds too long to update?

Apparently it is [Ubuntu Pastebin](https://paste.ubuntu.com/p/M8GXZznrt2/)  
Two servers have long TTL in fact

```nohighlight
ns4-cloud.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"T-ApV85P_fUlbOLB6AgIEUucajA5eSn2Ultg82RifpE"
ns8-cloud.nic.ru.: _acme-challenge.starline.ru. 60	IN	TXT	"T-ApV85P_fUlbOLB6AgIEUucajA5eSn2Ultg82RifpE"

```

---

<div class="post-metadata">

**Author:** ![ski192man](https://avatars.discourse-cdn.com/v4/letter/s/3da27b/32.png) [@ski192man](https://community.letsencrypt.org/u/ski192man)\
**Post date:** [May 31, 2020, 5:15am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/14 "2020-05-31T05:15:11Z")

</div>

Let’s Encrypt’s recursive resolvers don’t follow the TTL. They only hold onto old records for a few minutes.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [May 31, 2020, 7:42am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/15 "2020-05-31T07:42:19Z")

</div>

> [@rnz](#):
>
> May be big TTL (86400 ) is affects…

If I have (now again)

> :~$ dig TXT \_acme-challenge.starline.ru. @87.247.236.18
> 
> ; \<\<\>\> DiG 9.11.3-1ubuntu1.11-Ubuntu \<\<\>\> TXT \_acme-challenge.starline.ru. @87.247.236.18  
> ;; global options: +cmd  
> ;; connection timed out; no servers could be reached

it's impossible to talk with that name server.

Not-answering name servers are always bad.

---

<div class="post-metadata">

**Author:** ![rnz](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rnz/32/40044_2.png) [@rnz](https://community.letsencrypt.org/u/rnz)\
**Post date:** [May 31, 2020, 3:12pm UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/16 "2020-05-31T15:12:44Z")

</div>

All important issues with name servers fixed, wildcard certificate recieved and already deployed

Thanks comrades!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [July 2, 2020, 5:44am UTC](https://community.letsencrypt.org/t/dns-01-use-cached-reply-from-own-letsencrypt-ns/124317/18 "2020-07-02T05:44:13Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.