DNS problem: query timed out looking up TXT

Help
82

So it's a "register on the third level" situation, ok. Understood.

4 Likes
83

Yeah, something like this. Both spb.ru and msk.ru having now troubles which are like two major regional subdomains. No offence to nsk.ru and ekb.ru! Will move to .xyz.

84

Good point. Thanks!

Just checked - same issue

3 Likes
86

So here's an interesting data point: spb.ru and msk.ru are DNSSEC-signed, whereas nsk.ru and ekb.ru aren't. So the problem people are seeing seems to related to that, though it could just be that DNSSEC signatures make for larger packets and more chances for things to go wrong.

6 Likes
87

When I used manual mode certbot for renew certificate in .spb.ru zone

Certbot failed to authenticate some domains (authenticator: manual). The Certificate Authority reported these problems:
  Domain: acu-docs.iac.spb.ru
  Type:   dns
  Detail: DNS problem: looking up CAA for spb.ru: DNSSEC: Bogus
1 Like
88

Could you try to run dnssec-analyzer.verisignlabs.com against your domain name?
for mine it says All Queries to d.dns.ripn.net for spb.ru/DS timed out or failed on the spb.ru stage.

2 Likes
89

image
I do not have dnssec set for my domain, though

91

Certificate renewal is working now.
I checked on acu-docs.iac.spb.ru.
The problem was related to protection against DDOS attacks.

4 Likes
92

My domain names have also been renewed. It's great that the problem is gone.

2 Likes
93

Yes, things are good now.

2 Likes
94

confirm - renewal's now working! thanks all of you!

3 Likes
95

I'm still seeing the inconsistent case echoing from the .ru name server.

If so, I'm guessing that what was happening was that the logic in Unbound to deal with servers that don't always echo the case does in fact work for these servers, but when some queries got dropped by whatever this protection was, that it would try some other fallback and so that's what we'd see in the logs, when the real problem was just that the queries weren't being responded to.

I'm certainly glad that whatever the server configuration was that was blocking queries got sorted out for you, though.

6 Likes
96

I can confirm on a successful renewal as well.
thanks everyone for cooperation and support.

4 Likes