# DNS error while renewing certificates

**URL:** <https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091>\
**Category:** Help\
**Created:** [March 3, 2020, 8:40pm UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091 "2020-03-03T20:40:02Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![tribedigital](https://avatars.discourse-cdn.com/v4/letter/t/f1d935/32.png) [@tribedigital](https://community.letsencrypt.org/u/tribedigital)\
**Post date:** [March 3, 2020, 8:40pm UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/1 "2020-03-03T20:40:02Z")

</div>

Same issue here:

cmd ran:

```
[root@otisspunkmeyer ~]# certbot renew --force-renewal

Attempting to renew cert (otisspunkmeyer.eu) from /etc/letsencrypt/renewal/otisspunkmeyer.eu.conf produced an unexpected error: Failed authorization procedure. www.otisspunkmeyer.eu (http-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A for www.otisspunkmeyer.eu - the domain's nameservers may be malfunctioning, otisspunkmeyer.eu (http-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A for otisspunkmeyer.eu - the domain's nameservers may be malfunctioning. Skipping.

**Attempting to renew cert (www.otisspunkmeyer.eu) from /etc/letsencrypt/renewal/www.otisspunkmeyer.eu.conf produced an unexpected error: Failed authorization procedure. www.otisspunkmeyer.eu (http-01): urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up A for www.otisspunkmeyer.eu - the domain's nameservers may be malfunctioning. Skipping.
All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/otisspunkmeyer.eu/fullchain.pem (failure)
  /etc/letsencrypt/live/www.otisspunkmeyer.eu/fullchain.pem (failure)**

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: www.otisspunkmeyer.eu
   Type: None
   Detail: DNS problem: SERVFAIL looking up A for
   www.otisspunkmeyer.eu - the domain's nameservers may be
   malfunctioning
 - The following errors were reported by the server:

   Domain: www.otisspunkmeyer.eu
   Type: None
   Detail: DNS problem: SERVFAIL looking up A for
   www.otisspunkmeyer.eu - the domain's nameservers may be
   malfunctioning

   Domain: otisspunkmeyer.eu
   Type: None
   Detail: DNS problem: SERVFAIL looking up A for otisspunkmeyer.eu -
   the domain's nameservers may be malfunctioning

```

but DNS works as expected:

```
octav@Octavs-MacBook-Pro  ~  dig any otisspunkmeyer.eu  ✔  3528  22:38:17

; <<>> DiG 9.10.6 <<>> any otisspunkmeyer.eu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8372
;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;otisspunkmeyer.eu. IN	ANY

;; ANSWER SECTION:
otisspunkmeyer.eu.	6182	IN	NS	ns24.worldnic.com.
otisspunkmeyer.eu.	6182	IN	NS	ns23.worldnic.com.
otisspunkmeyer.eu.	2582	IN	A	63.33.153.47
otisspunkmeyer.eu.	6182	IN	SOA	ns23.worldnic.com. namehost.worldnic.com. 119021209 10800 3600 604800 3600

;; Query time: 52 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Mar 03 22:38:19 EET 2020
;; MSG SIZE rcvd: 157

 octav@Octavs-MacBook-Pro  ~  dig any www.otisspunkmeyer.eu  ✔  3528  22:38:19

; <<>> DiG 9.10.6 <<>> any www.otisspunkmeyer.eu
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20313
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;www.otisspunkmeyer.eu. IN	ANY

;; ANSWER SECTION:
www.otisspunkmeyer.eu.	3599	IN	A	63.33.153.47

;; Query time: 168 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Tue Mar 03 22:38:23 EET 2020
;; MSG SIZE rcvd: 66
```

---

<div class="post-metadata">

**Author:** ![yuriks](https://avatars.discourse-cdn.com/v4/letter/y/f17d59/32.png) [@yuriks](https://community.letsencrypt.org/u/yuriks)\
**Post date:** [March 3, 2020, 8:56pm UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/2 "2020-03-03T20:56:35Z")

</div>

@tribedigital I ran a quick test and it seems that while it usually works, sometimes your server times out serving the query. It seems to just be unreliable. I’d check to see if whatever is hosting that DNS is having issues, or just try again later.

---

<div class="post-metadata">

**Author:** ![yuriks](https://avatars.discourse-cdn.com/v4/letter/y/f17d59/32.png) [@yuriks](https://community.letsencrypt.org/u/yuriks)\
**Post date:** [March 3, 2020, 8:58pm UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/3 "2020-03-03T20:58:15Z")

</div>

I moved these posts to a new topic because the issues don’t seem to be related.

---

<div class="post-metadata">

**Author:** ![cc024947515](https://avatars.discourse-cdn.com/v4/letter/c/77aa72/32.png) [@cc024947515](https://community.letsencrypt.org/u/cc024947515)\
**Post date:** [March 3, 2020, 9:55pm UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/4 "2020-03-03T21:55:09Z")

</div>

This exact problem is happening to me too right now (March 3rd, 2020). I'm also on "worldnic" name servers from network solutions. So you're probably affected by the issue being discussed in the thread below, where for some reason LetsEncrypt can't get valid DNS responses from our DNS provider. All seems related to [web.com/networksolutions.com/register.com](http://web.com/networksolutions.com/register.com) which all tend to use these "[worldnic.com](http://worldnic.com)" name servers.

> [@DNS failures (SERVFAIL, timeout) for domains using Network Solutions/Web.com/worldnic.com nameservers](https://community.letsencrypt.org/t/numerous-inexplicable-challenge-failures-across-disparate-domains-with-unreproducable-servfails/113235):
>
> E…

> [@Network Solutions DNS problem: SERVFAIL looking up A for](https://community.letsencrypt.org/t/network-solutions-dns-problem-servfail-looking-up-a-for/114622):
>
> P…

I'm planning to move away from NetworkSolutions for many reasons, this is just the icing on the cake; they seemingly are blocking LetsEncrypt datacenters from querying your DNS records. I'd rather not have my DNS provider decide who can query my public name records.

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [March 4, 2020, 6:19am UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/5 "2020-03-04T06:19:15Z")

</div>

FYI, the other threads say that the issue has apparently been fixed a few hours ago.

---

<div class="post-metadata">

**Author:** ![tribedigital](https://avatars.discourse-cdn.com/v4/letter/t/f1d935/32.png) [@tribedigital](https://community.letsencrypt.org/u/tribedigital)\
**Post date:** [March 4, 2020, 9:36am UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/6 "2020-03-04T09:36:11Z")

</div>

HI, yes, can confirm that certificate was renewed.  
Thank you!!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [April 3, 2020, 9:36am UTC](https://community.letsencrypt.org/t/dns-error-while-renewing-certificates/115091/7 "2020-04-03T09:36:15Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.