# DNS problem: NXDOMAIN looking up TXT for \_acme-challenge. - check that a DNS record exists for this domain **URL:** \ **Category:** Help\ **Created:** [July 12, 2023, 9:08am UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672 "2023-07-12T09:08:51Z")\ **Posts on this page:** 11\ **Page:** 2
**Author:** ![yannickk](https://avatars.discourse-cdn.com/v4/letter/y/ee59a6/32.png) [@yannickk](https://community.letsencrypt.org/u/yannickk)\ **Post date:** [July 12, 2023, 4:11pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/21 "2023-07-12T16:11:46Z")
yep still paused ---
**Author:** ![MikeMcQ](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mikemcq/32/52772_2.png) [@MikeMcQ](https://community.letsencrypt.org/u/MikeMcQ)\ **Post date:** [July 12, 2023, 4:13pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/22 "2023-07-12T16:13:48Z")
I see your root domain is using CloudFront. But, I don't see any A/AAAA records for it on that screen snap. Did you just not show them or are they in a different account maybe? ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 12, 2023, 4:14pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/23 "2023-07-12T16:14:42Z")
Yeah, if that zone only has an NS/SOA, and TXT you've added, then it's clearly not the one being used for actual DNS. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [July 12, 2023, 4:15pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/24 "2023-07-12T16:15:58Z")
Even when quering the AWS nameservers directly I'm not seeing any TXT RR. Also, maybe there's a logical explanation for this, but when I do a `dig +trace` for the domain, the NS RR for your domain are _different_ in my results than shown in the screenshot of your Route53 DNS zone? Although when querying _those_ NS, I'm also getting a NXDOMAIN result.. And the SOA RRs are different too. ---
**Author:** ![yannickk](https://avatars.discourse-cdn.com/v4/letter/y/ee59a6/32.png) [@yannickk](https://community.letsencrypt.org/u/yannickk)\ **Post date:** [July 12, 2023, 4:21pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/25 "2023-07-12T16:21:35Z")
Did I incorrectly configure the hosted zone in Route 53 ? ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 12, 2023, 4:28pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/26 "2023-07-12T16:28:48Z")
There's some AWS account (which isn't the same account that certbot is using) which has a Route 53 hosted zone which is what's actually being used. It looks like the account you're using just created its own hosted zone for some reason, but nothing is actually pointing to it. You need to either 1. If you want to use this new hosted zone instead of the one that's currently being used, then put whatever other records you need the domain to have here, change the registrar configuration to point to this new zone's NS records, and delete the current zone from whatever other account currently has it, or 2. Have certbot use credentials for the account which has the zone which is currently actually being used (and delete the hosted zone that isn't actually being used), or 3. Create a new hosted zone in the account certbot is using for `configuration.wildlifetracking.net`, delete the hosted zone in this account for `wildlifetracking.net`, and have the actual production account's `wildlifetracking.net` set up NS records for your subdomain to point to the certbot's account's hosted zone. But I feel like you don't know what account is actually being used. Are you in some sort of test account, rather than your organization's production account, or something like that? ---
**Author:** ![yannickk](https://avatars.discourse-cdn.com/v4/letter/y/ee59a6/32.png) [@yannickk](https://community.letsencrypt.org/u/yannickk)\ **Post date:** [July 12, 2023, 4:36pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/27 "2023-07-12T16:36:19Z")
> [@petercooperjr](#): > > But I feel like you don't know what account is actually being used. Are you in some sort of test account, rather than your organization's production account, or something like that? Indeed, several of us are using this domain to configure a software, so it's possible that there is indeed such an issue. I'm very sorry but I will have to leave now (the real wildlife is waiting for me), and I will pick this up again tomorrow. Thank you all for your help. I will try Peter's suggestion tomorrow. Have a good rest of the day, and thanks again. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 12, 2023, 4:50pm UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/28 "2023-07-12T16:50:06Z")
Also, depending on what exactly you're trying to use the certificate for, you might be able to just use Amazon's AWS Certificate Manager certificates, which they'll handle issuing and renewing and configuring all for you, rather than trying to involve Certbot and Let's Encrypt at all. (And it's one of the few things AWS doesn't charge extra for, unlike many things where you pay by the byte 😉) > [@yannickk](#): > > the real wildlife is waiting for me Be careful out there, my wife saw a coyote crossing the road on her way home last night. ---
**Author:** ![yannickk](https://avatars.discourse-cdn.com/v4/letter/y/ee59a6/32.png) [@yannickk](https://community.letsencrypt.org/u/yannickk)\ **Post date:** [July 17, 2023, 9:32am UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/29 "2023-07-17T09:32:16Z")
Hi Peter, I deleted the hosted zone [wildlifetracking.net](http://wildlifetracking.net) in route 53 and created the zone [configuration.wildlifetracking.net](http://configuration.wildlifetracking.net) and added to it all the NS records tested by [unbundtest.com](http://unbundtest.com), but I'm still getting NXDOMAIN and CERTBOT return Some Challenge have failed. ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/5/6/56301d8ec01de593789b37b9f3cc3c6f2d588f0f.png) ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [July 17, 2023, 10:48am UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/30 "2023-07-17T10:48:50Z")
You don't add the NS records to the zone you have, they need to get added to the public zone which is actually serving `wildlifetracking.net`. You need to figure out which account is serving that and have it added there. AWS has pretty decent documentation; you're trying to "Create a hosted zone for the subdomain, and create records in the new hosted zone": > **[Routing traffic for subdomains - Amazon Route 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-routing-traffic-for-subdomains.html)** > > When you want to route traffic to your resources for a subdomain, such as acme.example.com or zenith.example.com, you have two options: ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [August 16, 2023, 10:49am UTC](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672/31 "2023-08-16T10:49:33Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed. [Previous page](https://community.letsencrypt.org/t/dns-problem-nxdomain-looking-up-txt-for-acme-challenge-check-that-a-dns-record-exists-for-this-domain/201672.md?page=1)