DNS Problem: Records exist, but query timed out looking up TXT record

Help
1

As this is my first post and I have restrictions on my account, I have placed commands, results and additional information in: https://pastebin.com/n2Qxq9Pb

Primary issue: Unable to issue SSL cert due to DNS challenge unable to access correctly added TXT records.

My domain is: workcover.nsw.gov.au

I ran this command:
certbot --csr workcover_csr.pem certonly --manual -d centreforwhs.nsw.gov.au,mentalhealthatwork.nsw.gov.au,workcover.nsw.gov.au,www.centreforwhs.nsw.gov.au,www.mentalhealthatwork.nsw.gov.au,www.workcover.nsw.gov.au --preferred-challenges=dns --email=someone@example.com --agree-tos --manual-public-ip-logging-ok --server https://acme-v02.api.letsencrypt.org/directory

It produced this output: Output in pastebin

My web server is (include version): Not relevant as issue is DNS based

The operating system my web server runs on is (include version): Not relevant as issue is DNS based

My hosting provider, if applicable, is: Squiz

I can login to a root shell on my machine (yes or no, or I don’t know): No

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): certbot 0.31.0

2

It seems there is some DNS accessibility problem with your domain:
[2 of 4 tests failed]
C:>nslookup -q=txt _acme-challenge.mentalhealthatwork.nsw.gov.au 8.8.8.8
Server: dns.google
Address: 8.8.8.8
Non-authoritative answer:
_acme-challenge.mentalhealthatwork.nsw.gov.au text =
“lHL8joAs2FrQxwH9RRxp3nHQESRTRKXBTFwdiWVPqCs”

C:>nslookup -q=txt _acme-challenge.mentalhealthatwork.nsw.gov.au 1.0.0.1
Server: one.one.one.one
Address: 1.0.0.1
Non-authoritative answer:
_acme-challenge.mentalhealthatwork.nsw.gov.au text =
“lHL8joAs2FrQxwH9RRxp3nHQESRTRKXBTFwdiWVPqCs”

C:>nslookup -q=txt _acme-challenge.mentalhealthatwork.nsw.gov.au 4.2.2.2
Server: b.resolvers.Level3.net
Address: 4.2.2.2
*** b.resolvers.Level3.net can’t find _acme-challenge.mentalhealthatwork.nsw.gov.au: Server failed

C:>nslookup -q=txt _acme-challenge.mentalhealthatwork.nsw.gov.au 208.67.222.123
Server: resolver1-fs.opendns.com
Address: 208.67.222.123
DNS request timed out.
timeout was 2 seconds.
DNS request timed out.
timeout was 2 seconds.
*** Request to resolver1-fs.opendns.com timed-out

3

The root of the problem is the lack of a proper DNS system (in use for your domain):
See: https://dnsspy.io/scan/mentalhealthatwork.nsw.gov.au

I would recommend adding some redundancy to your DNS configuration.
I can recommend two DNS services that provide FREE (and paid) DNS:
CloudNS
1984

4

Thanks for that.

It’s a bit sad when our DNS provider (Telstra) is the largest telco in Australia, and still can’t quite get it right. :slight_smile:

I’ll have to place a support call with them.

2 Likes
5

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.