I’m using the letsencrypt.sh challenge with a hook script that I’ve written myself to implement DNS challenges using the following steps: Get challenge token ( letsencrypt.sh ) Upload DNS data (bash script which rsyncs the data to my authoritative DNS provider). Poll the domain’s authoritative names…

My understanding is they always do a fresh check of your authoritative DNS servers.

Is that documented anywhere? I’m struggling to find much information about DNS challenges on the website.

It may be in the acme documentation - https://github.com/ietf-wg-acme/acme/blob/master/draft-ietf-acme-acme.md I wrote my own bash script ( getssl ), and I’m just going on experience that it doesn’t cache but does a fresh check from lots of testing and cert generation using the DNS-01 challenge.

There doesn’t appear to be anything in the documentation which requires the query skip any resolver cache, the closest I can find about the process is: "To validate a DNS challenge, the server performs the following steps: Compute the SHA-256 digest of the key authorization Query for TXT records …

Yes, That's why my comment was based on experience rather than written documentation. There is a comment on this forum [image] DNS Verification FWIW, Let's Encrypt always does authoritative resolution, so it's mainly about whether your authoritative NS has the record updated.

Thanks, I was looking for a definitive answer, which that other comment provides.

I actually made an experiment which went like this: setting up a TXT record for the challenge making sure it gets propagated (so for example Google public DNS would start returning it too) deliberately failing the challenge changing the TXT record to a new value making sure that authoritative serv…

I had also done some testing and reached the same conclusion, but “I’ve run some tests and it seems to work in this way” isn’t really good enough for software that will be released to others and used for clients. :slight_smile:

Indeed, I’m not saying that black box testing is supposed to make you sure that certain things work in a certain way, but some additional confirmation through testing that something works they way it’s said it should … - that never hurts :slight_smile:

DNS challenge and caching

Client dev

serverco June 10, 2016, 2:17pm 6

Yes, That's why my comment was based on experience rather than written documentation. There is a comment on this forum

Topic		Replies	Views
How Let's Encrypt checks DNS Challenges Client dev	3	1088	August 31, 2018
Concurrent issuances with DNS-01 challenge Issuance Tech	14	333	May 10, 2025
LE Using Chached DNS lookups during DV process Issuance Tech	24	11874	March 26, 2021
DNS Servers used by LetsEncrypt for Challenges Server	18	34942	May 23, 2017
DNS challenge questions Help	13	895	June 20, 2024

DNS challenge and caching

Related topics