DNS Servers used by LetsEncrypt for Challenges

One is picked randomly from the set of authoritative servers. Edit: updated to clarify, we pick a recursive resolver from a set that we run in our environment with a low max TTL (60s presently) at random. This is what the code I linked is responsible for.

The recursive resolver (Unbound in this case) picks an authoritative nameserver based on the delegations in place in the relevant zones. I believe this determination is made at random initially and then later by latency/reliability but I'm not positive.

1 Like