# DNS problem: SERVFAIL looking up CAA

**URL:** <https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457>\
**Category:** Help\
**Created:** [January 3, 2019, 6:45am UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457 "2019-01-03T06:45:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![lala](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@lala](https://community.letsencrypt.org/u/lala)\
**Post date:** [January 3, 2019, 6:45am UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457/1 "2019-01-03T06:45:12Z")

</div>

I didn’t setup any restrict on CAA , and seems my DNS server do response caa requirements , I reviewed the similar topics but didn’t find a situation that suit my case , can anyone help ? Appreciate it .

$ dig @8.8.8.8 [logana.daikin.net.cn](http://logana.daikin.net.cn) caa

; \<\<\>\> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.el6 \<\<\>\> @8.8.8.8 [logana.daikin.net.cn](http://logana.daikin.net.cn) caa  
; (1 server found)  
;; global options: +cmd  
;; Got answer:  
;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 44829  
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:  
;[logana.daikin.net.cn](http://logana.daikin.net.cn). IN CAA

;; AUTHORITY SECTION:  
[daikin.net.cn](http://daikin.net.cn). 599 IN SOA [ce1.dns.com](http://ce1.dns.com). [admin.dns.com](http://admin.dns.com). 1545897019 7200 3600 1209600 1800

;; Query time: 286 msec  
;; SERVER: 8.8.8.8#53(8.8.8.8)  
;; WHEN: Thu Jan 3 14:39:20 2019  
;; MSG SIZE rcvd: 91

My domain is: [logana.daikin.net.cn](http://logana.daikin.net.cn)

I ran this command: /certbot-auto renew

It produced this output: IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): nginx-1.12.1-1.33

The operating system my web server runs on is (include version): Amazon Linux AMI release 2018.03

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

---

<div class="post-metadata">

**Author:** ![stevenzhu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/stevenzhu/32/18864_2.png) [@stevenzhu](https://community.letsencrypt.org/u/stevenzhu)\
**Post date:** [January 3, 2019, 6:59am UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457/2 "2019-01-03T06:59:00Z")

</div>

Hi,

According to unbound test, it seems that there are some issues with your DNS provider (provide different responses per dns server)  
[https://unboundtest.com/m/CAA/Logana.daikin.net.cn/4HHKK4CI](https://unboundtest.com/m/CAA/Logana.daikin.net.cn/4HHKK4CI)

Thank you

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [January 3, 2019, 7:05am UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457/3 "2019-01-03T07:05:14Z")

</div>

Some of the reasons change over time, but [dns.com](http://dns.com) and Let’s Encrypt don’t get along.

[https://community.letsencrypt.org/search?q=dns.com%20order%3Alatest](https://community.letsencrypt.org/search?q=dns.com%20order%3Alatest)

In general, [dns.com](http://dns.com) is buggy and unreliable.

[https://ednscomp.isc.org/ednscomp/d3245ed1ee](https://ednscomp.isc.org/ednscomp/d3245ed1ee)  
[http://dnsviz.net/d/logana.daikin.net.cn/XC2yeQ/dnssec/](http://dnsviz.net/d/logana.daikin.net.cn/XC2yeQ/dnssec/)

For most resolvers, that’s okay.

Let’s Encrypt sends DNS queries with [random capitalization](https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00). [dns.com](http://dns.com) doesn’t support it, which is perfectly valid. The resolver enters a fallback mode, where it sends queries to each of [dns.com](http://dns.com)’s nameservers, and compares the responses. If they don’t match, the resolver returns a `SERVFAIL` error.

For some reason, [dns.com](http://dns.com)’s responses often don’t match.

[https://unboundtest.com/m/CAA/logana.daikin.net.cn/LIMIJT77](https://unboundtest.com/m/CAA/logana.daikin.net.cn/LIMIJT77)  
[https://unboundtest.com/m/CAA/logana.daikin.net.cn/AUV7CH5B](https://unboundtest.com/m/CAA/logana.daikin.net.cn/AUV7CH5B)

I’m not sure what’s happening with your domain right now. It might be because the nameservers return different serial numbers in the `SOA` record. If that’s the issue, waiting for a while, or adding `CAA` records for `daikin.net.cn` and `logana.daikin.net.cn` might resolve it.

If there’s another issue, trying again or waiting might help, or it might not.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 2, 2019, 7:05am UTC](https://community.letsencrypt.org/t/dns-problem-servfail-looking-up-caa/81457/4 "2019-02-02T07:05:16Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.