Hi guys, I’m having an issue while testing dns-01 challenges Here’s the response I’m getting from Letsencrypt: ERROR: Challenge is invalid! (returned: invalid) (result: {"type":"dns-01","status":"invalid","error":{"type":"urn:acme:error:connection","detail":"DNS problem: NXDOMAIN looking up TXT f…

How long did you leave it after checking the the primary name servers were providing the correct txt response, and asking LE to confirm it was valid ? is it possible you asked LE to confirm before they were responding properly ?

I tried adding a 5 second wait, but it didn’t help. I’ll try a 2 minute delay and see if that helps.

It depends if that’s a 5 second wait after setting it at cloudflare … or a 5 second wait after testing and confirming that the cloudflare servers are providing the correct answer :wink: In my experience it typically takes cloudflare servers about 10 seconds to provide the correct response after upd…

It’s essential that the challenge record be visible at all of the nameservers for a zone before proceeding. I have an example of how to do this programmatically here , part of a larger example of using nsupdate. Although come to think of it, even that may not be an adequate guarantee if we’re talkin…

I put in a 30 second delay and everything started working :slight_smile: Thanks guys

May I take over this topic since I have the same problem: Requesting a certificate with multiple names, a few challenges do work and then suddenly I get “NIXDOMAIN” back from the LE server. I use nsupdate in a hook script to publish the challenge RR on my bind9 DNS Servers (1 master, two slaves), c…

Ideally I’d say that rather than just check if the NS returns some value, you need to confirm that it returns the correct token.

…indeed that helps. My assumption was too naive. Thank you. I will post my hook script somewhere, as soon as I am sure it works and give a hint here.

Maybe somebody finds this useful: https://ente.limmat.ch/ftp/pub/software/bash/letsencrypt/letsencrypt_acme_dns-01_challenge_hook It is a first version of a dns hook script to use with bind and letsencrypt.sh to run in a GNU userland. Because “new users are limited to three replies” (how stupid i…

DNS challenge failing: NXDOMAIN looking up TXT

Issuance Tech

dasp February 4, 2016, 12:11am 5

Topic		Replies	Views
DNS-01 challenge failing Help	4	7109	December 8, 2017
DNS-01 challenge fails Server	22	5232	March 17, 2019
_acme-challenge cname (as per acme-dns) broken Help	21	3965	June 9, 2021
DNS problem: NXDOMAIN looking up TXT for _acme-challenge.vadim.com.ru - check that a DNS record exists for this domain Help	27	7555	September 22, 2022
DNS challenge is in staging Feature Requests	48	28414	February 10, 2016

DNS challenge failing: NXDOMAIN looking up TXT

Related topics