DNS/DNSSEC error signal

Thank you @Bruce5051 !
As you can see, nothing prevents the correct DNS resolution (no response from the gTLD nameserver is outside of my scope).

So what's wrong with LE certificate issuance?

2 Likes

I see this with nslookup; it seems like your DNS Name Servers are a bit slow in responding.

$ nslookup kamchatka.spb.ru ns1.net-art.cz.
Server:         ns1.net-art.cz.
Address:        80.211.210.60#53

Name:   kamchatka.spb.ru
Address: 195.211.53.80
;; communications error to 80.211.210.60#53: timed out

This run with nslookup -q=any kamchatka.spb.ru ns1.net-art.cz., a bit longer than I typically see.

$ nslookup -q=any kamchatka.spb.ru ns1.net-art.cz.
Server:         ns1.net-art.cz.
Address:        80.211.210.60#53

kamchatka.spb.ru
        origin = ns1.net-art.cz
        mail addr = hostmaster.kaa.ru
        serial = 2015052593
        refresh = 7200
        retry = 3600
        expire = 604800
        minimum = 86400
kamchatka.spb.ru        rdata_46 = SOA 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. X4/d+bzLyaAzHBsfBwZvDBwI8VBfWTZZCaaWl+LPLIGQKU6jskH9dCzQ xA93rO8YLkpcm/csm/tM2yyEG2Osog==
kamchatka.spb.ru        nameserver = ns1.net-art.cz.
kamchatka.spb.ru        nameserver = ns3.net-art.cz.
kamchatka.spb.ru        rdata_46 = NS 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. 28HbBRVpSM8wr8zX/JGMHhZz+sbCPN1h3PurugkwmkRC89z/wvDkxaJp FhFl+kYTTORXvQ06haeBf1ZrT02oOg==
Name:   kamchatka.spb.ru
Address: 195.211.53.80
kamchatka.spb.ru        rdata_46 = A 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. 1okB+7hedt9oKSlAbKZx9UcZXqZV7DwwGq2V6X8L4Tn6MWsO8Soe5o6i Ux4U/UCR6r3XC3unPU1vfsV6Astj2w==
kamchatka.spb.ru        mail exchanger = 5 reindeer.net-art.cz.
kamchatka.spb.ru        rdata_46 = MX 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. hY6leHzhDFlA83PRyGrwnMS1ZrxtYwb383hzFQBJtRGu3hIFbdHeOYxf ta6o5B275Dm0J97bEXagh0nFnox6Tw==
kamchatka.spb.ru        text = "v=spf1 mx a:smtp-out.net-art.cz -all"
kamchatka.spb.ru        rdata_46 = TXT 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. KWxUWzy1r2m8kDpVWEewgLZud2uqHpS0PCLkAtxAwtPdCR7Yqmp2IjPP YFSUpY1QLZJ2x2Ix+fI4+XdeNSkWgw==
kamchatka.spb.ru        rdata_48 = 257 3 13 +H1A93qEUjTo8zXqYHfSFg2vBd0pkksqJg2o9i7qBa5kqfiBzReEZkcr b89KLQoxGMqeEK498CN9c5RerXH6Sw==
kamchatka.spb.ru        rdata_48 = 256 3 13 QR1QOOw6rWYf9wIQ8a4JP2GP/de/OiHYqoZpB5dhJY9GU3GR7aZZoBbm 5FCaDooEPErb38bfJ3w8XPBGhBr43w==
kamchatka.spb.ru        rdata_46 = DNSKEY 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. Na8hbJi3NRtNNQT7x8un5jVqZI3jCkEs3XYJBUC6rwGV/tVk8spy11jA QdEBjeqiGk8YCmGjESl4ncT8SYYtRg==
kamchatka.spb.ru        rdata_46 = DNSKEY 13 3 86400 20230826012142 20230627012142 45147 kamchatka.spb.ru. uXnNxVAteT3I/E/TRvLewIsZZLcnWUFggIpU9rnr34n/TukLLwh1j/nl kg4fFuNQtbtyN0P7VkESRjcUy4M+5A==
kamchatka.spb.ru        rdata_51 = 1 0 10 C0DE
kamchatka.spb.ru        rdata_46 = NSEC3PARAM 13 3 0 20230826012142 20230627012142 11148 kamchatka.spb.ru. g2xAHjx8k38a/T4lY+0RA5xQ1CHl7L9voFdBRAejpIe1SQw5tJKNi/ax P2HHQ6jPryn0beUfUUy64GJhmMRYGw==
kamchatka.spb.ru        rdata_99 = "v=spf1 mx a:smtp-out.net-art.cz -all"
kamchatka.spb.ru        rdata_46 = SPF 13 3 86400 20230826012142 20230627012142 11148 kamchatka.spb.ru. FetmUqfhQbzIdr3TxZLKDTZKn2WdaJzdidqrwgPUiwhrhq7PopnKNQTa R7YohRzehLuVSeEh63Y4g96lrcdMqQ==

1 Like

This is quite strange, while other domains are resolving well. Where did you get this timeout, in which region? I'll start RIPE Atlas test from this location.

Thank you for this. I think ANY requests shouldn't be used for LE. But slow response is okay, as response to ANY should have more time to switch to TCP and proceed with 3-way handshake.

1 Like

Got an error this time with Let's Debug https://letsdebug.net/kamchatka.spb.ru/1530979?debug=y
(partial image)

1 Like

Yes, I see this. Timeouts for A and AAAA records. Can't understand what is wrong here.

Maybe there is something up with the higher domain spb.ru

Maybe Geo-Location blocking?
Edit: possibly even intermittently Geo-Location blocking?

1 Like

Seems to be working now.

2 Likes

Same issue now:
20230627044951 [INFO] acmetool.solver: unsuccessful challenge: authorization "https://acme-v02.api.letsencrypt.org/acme/authz-v3/240370637247" challenge "https://acme-v02.api.letsencrypt.org/acme/chall-v3/240370637247/gStGSQ" failed into final non-valid status invalid [due to inner error: (problem (type "urn:ietf:params:acme:error:dns") (instance "") (id ) (title ""): (detail "DNS problem: looking up A for kamchatka.spb.ru: DNSSEC: Bogus; DNS problem: looking up AAAA for kamchatka.spb.ru: DNSSEC: Bogus"))]

I can't recognize it. My NSes are not blocking, and domain registries don't seem to block anything.

DNS Propagation Checker - Global DNS Testing Tool is showing not all locations are getting responses from the Authoritative DNS Name Servers

2 Likes

That's interesting. Now I see every server marked with a green check. Except Auckland NZ. With the fact that NSes aren't multihomed and located in Italy and Czech Republic, and other people from spb.ru domains are complaining about DNS... one might need to check whether LE's addresses are not blocked.

What IP addresses does Let’s Encrypt use to validate my web server?
Let’s Encrypt does not publish a list of IP addresses we use to validate,
and these IP addresses may change at any time.

Let's Encrypt uses Multi-Perspective Validation Improves Domain Validation Security - Let's Encrypt

1 Like

Thank you, I've read this article. Obviously there is no problem on my side, nameservers/webserver are reachable. Lots of online tools are an additional proof of that.

1 Like

And likely not on the LE side, but most likely something between them.

2 Likes

I've done what I can, so
Kindly wait to see if there are more knowledgeable Let's Encrypt community volunteers willing to assist. :slight_smile:

2 Likes

Thank you @Bruce5051 !

3 Likes

I see the problem was localized in DNS problem: query timed out looking up A - #30 by letsuser

Now the problem is solved, certificate reissued. Thanks @schors !

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.