# DNS problem: SERVFAIL looking up CAA **URL:** \ **Category:** Help\ **Created:** [February 24, 2022, 3:50pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666 "2022-02-24T15:50:51Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [February 24, 2022, 3:50pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/1 "2022-02-24T15:50:51Z")
My domain is: [novamold.com](http://novamold.com) I ran this command: sudo certbot --apache, then certbot --expand -d [novamold.com](http://novamold.com),[www.novamold.com](http://www.novamold.com) It produced this output: Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems: Domain: [www.novamold.com](http://www.novamold.com) Type: dns Detail: DNS problem: SERVFAIL looking up CAA for [www.novamold.com](http://www.novamold.com) - the domain's nameservers may be malfunctioning My web server is (include version): Server version: Apache/2.4.48 (Ubuntu) Server built: 2022-01-05T14:29:15 The operating system my web server runs on is (include version): Ubuntu 21.10 My hosting provider, if applicable, is: N/A, [networksolutions.com](http://networksolutions.com) is the registrar I can login to a root shell on my machine (yes or no, or I don't know): yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.23.0 I know I'm getting this error because the CAA record I added is for the root domain and not the www. But it does not seem possible to add a CAA record for the www domain on Network Solutions website (unless I'm missing something, which is quite possible). When I generate the cert for the root domain certbot completes successfully but browsing the website using HTTPS results in SSL\_ERROR\_BAD\_CERT\_DOMAIN error. I've sent a ticket to Network Solutions but it's going on day 3 and I haven't received a response yet. Am I being to overly optimistic in thinking they can do something from their end? Presumably going with the wildcard cert would solve this issue and I've looked at the instructions but due to the complexity I'd like to keep that as a last resort. Moving to a different registrar is also on the table but I have yet to research the options. Any suggestions would be appreciated. ---
**Author:** ![xiaohuilam](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/xiaohuilam/32/33226_2.png) [@xiaohuilam](https://community.letsencrypt.org/u/xiaohuilam)\ **Post date:** [February 24, 2022, 4:19pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/2 "2022-02-24T16:19:05Z")
The SERVFAIL looking up CAA is mostly caused by DNSSEC error. You may try 1. Disable DNSSEC for your domain name 2. Correct warnings or errors in [dnsviz](https://dnsviz.net/d/novamold.com/dnssec/) 3. Update the `novamold.com. 3600 IN CAA 0 issuewild "novamold.com"` CAA record below ```nohighlight ➜ ~ dig novamold.com caa ; <<>> DiG 9.10.6 <<>> novamold.com caa ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 40798 ;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 4096 ;; QUESTION SECTION: ;novamold.com. IN CAA ;; ANSWER SECTION: novamold.com. 3600 IN CAA 0 issuewild "novamold.com" novamold.com. 43200 IN CAA 0 issue "letsencrypt.org" ``` ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 24, 2022, 4:22pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/3 "2022-02-24T16:22:43Z")
> [@Raquel](#): > > [networksolutions.com](http://networksolutions.com) Change your dns hosting. Your dns cannot SERVFAIL when asked a CAA record that isn't there. > [@Raquel](#): > > I know I'm getting this error because the CAA record I added is for the root domain and not the www. Yes, and it's half wrong, remove the issuewild one. ---
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [February 24, 2022, 4:30pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/4 "2022-02-24T16:30:01Z")
I wasn't sure if I needed a CAA record for our internal CA which generates the cert for our Exchange server. I added it just to be safe but I've deleted now. ---
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [February 24, 2022, 4:55pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/5 "2022-02-24T16:55:44Z")
I re-ran the "certbot --expand -d [novamold.com](http://novamold.com),[www.novamold.com](http://www.novamold.com)" command after deleting the CAA issuewild record for [novamold.com](http://novamold.com) root domain just to see what would happen but still same error. I only waited a few minutes so I'll try again later but I can't figure how that record itself would be an issue. I've looked at the output from DNSVIS and all that comes up are some warnings: Warnings: DNSSEC specification prohibits signing with DS records that use digest algorithm 1 (SHA-1). DS records with digest type 1 (SHA-1) are ignored when DS records with digest type 2 (SHA-256) exist in the same RRset. In the spirit of RFC 4509, DS records with digest type 1 (SHA-1) might be ignored when DS records with digest type 4 (SHA-384) exist in the same RRset. I'm not really sure what this error means or if it can be resolved without disabling DNSSEC completely. At this point, I'm trying to recall if it was enabled for a specific purpose but if not I will disable it and test again, assuming turning it off won't disrupt any of the other services. ---
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [February 24, 2022, 5:00pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/6 "2022-02-24T17:00:53Z")
If I turn off DNSSEC should I delete the CAA record as well? ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 24, 2022, 5:17pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/7 "2022-02-24T17:17:25Z")
No, that't not the issue. It's that `issuewild` overwrites `issue`. So you might want to use two `issue` CAA records. But this isn't the problem you are encountering. The problem you are encountering is a shitty DNS server. Switch providers. ---
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [February 24, 2022, 5:26pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/8 "2022-02-24T17:26:06Z")
Well I was hoping someone else who is using Network Solutions might jump in and say whether or not they were able to get it to work, and I'll probably wait another day or two to see if they respond to my ticket. But the domain is up for renewal this year so likely I'll just move it, would be nice if I can get a Canadian registrar this time. Though at this point I'll take any that isn't too overpriced and is on the Certbot compatible list. ---
**Author:** ![9peppe](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/9peppe/32/31596_2.png) [@9peppe](https://community.letsencrypt.org/u/9peppe)\ **Post date:** [February 24, 2022, 5:54pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/9 "2022-02-24T17:54:08Z")
They weren't. It's not a new issue. [https://community.letsencrypt.org/search?context=topic&context\_id=172666&q=Network%20solutions%20&skip\_context=true](https://community.letsencrypt.org/search?context=topic&context_id=172666&q=Network%20solutions%20&skip_context=true) You don't need to use your registrar as an authoritative DNS, you can separate the two functions. As for price, cloudflare is free. (Has a free plan) ---
**Author:** ![Raquel](https://avatars.discourse-cdn.com/v4/letter/r/779978/32.png) [@Raquel](https://community.letsencrypt.org/u/Raquel)\ **Post date:** [March 1, 2022, 2:14pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/10 "2022-03-01T14:14:57Z")
Someone from Network Solutions responded finally to my ticket to confirm details of the CAA record. I went to check it and it appeared on their site same as it did before but dig command came back with NOERROR instead of SERVFAIL this time. I tried the certificate generation again using "certbot --expand -d [novamold.com](http://novamold.com),[www.novamold.com](http://www.novamold.com)" to add the www domain and this time it worked. The person who responded to my ticket did not say they changed anything so I do not know why it suddenly worked. The only thing I did on my end was create a cloudflare account to use their name servers but I never got around to completing the setup. Dig still only shows the [Worldnic.com](http://Worldnic.com) servers. My website is now loading [https://www.novamold.com](https://www.novamold.com) as it should. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 31, 2022, 2:15pm UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/172666/11 "2022-03-31T14:15:07Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.