DNS problem: query timed out looking up A for hostname that otherwise seems fine

Help
1

I'm having problems issuing a certificate for this domain mkt.lxpack.pt, even though on DNS checker it shows as propagated all around the world, and even in Let's Debug it shows just fine, but when issuing the certificate it's returning this error:
mkt.lxpack.pt:Verify error:DNS problem: query timed out looking up A for mkt.lxpack.pt

If I curl the acme-challenge URL from an external source I can get the challenge just fine, it's seems it's just let's encrypt servers that can't.

Can anyone help with this issue?

Also we generate certificates for several other domains, this problem only seems to be happening on this one.

My domain is: mkt.lxpack.pt

I ran this command: /root/.acme.sh/acme.sh --issue --debug --stateless --key-file /etc/pki/tls/private/test_mkt.lxpack.pt.key --fullchain-file /etc/pki/tls/certs/test_mkt.lxpack.pt.crt -d mkt.lxpack.pt

It produced this output: mkt.lxpack.pt:Verify error:DNS problem: query timed out looking up A for mkt.lxpack.pt

My web server is (include version): nginx/1.20.1

The operating system my web server runs on is (include version): CentOS release 6.9

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): acme.sh v2.8.9

2

There are a few DNS errors present when testing your hostname. See for details:

https://dnsviz.net/d/mkt.lxpack.pt/dnssec/

Also, when running the test, it was very slow. Probably due to timeouts.

2 Likes
3

I'm guessing the problem lies here then:

lxpack.pt/DNSKEY: No response was received from the server over UDP (tried 12 times). (94.46.135.14, 94.46.135.27, 94.46.135.88, 94.46.135.114, UDP_-_NOEDNS_)
lxpack.pt/DNSKEY: No response was received from the server over UDP (tried 4 times). (94.46.135.114, UDP_-_EDNS0_512_D_KN)

Because the other warnings lie on our own NS (as this is a CNAME pointing to one of our domains), and all other certificates get issued just fine. I'll try to get in contact with the owner of the lxpack.pt domain.

Thanks

4

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.