The error seems to be quite random. In the screenshot you can see that pretty much all the lookups are failing consistently right now even for different records. However, I’m unable to reproduce it as querying the same records/zones via dig (using Google Public DNS) works like a charm.
Let me know if you need more debug info privately. I’ve removed the zone names for privacy.
Sorry to use this thread (@cpu let me know if I should open a new one for my case), but it’s not clear to me if the issue seems to be on LE side, or @rickjanssen side.
I am experiencing the same issue, and I can’t really reproduce it right now. Running a dig against a name that is reported to fail from LE is succeeding to me. We don’t use PowerDNS, we wrote our NS in house.
Is there any way I can get some more details on how is the query performed on your side @cpu? Or should I send you the hostnames so that you can help me to trace them down?
I wonder if something has changed recently at LE resolver. This is the very first time I see this issue happening.
I don’t think its clear yet whether this is a problem with our Unbound configuration or the remote server.</s.
EDIT: In this case I’m fairly confident it is not our Unbound configuration/server.
I shared an Unbound configuration in the original thread this was split from that can be used to try and replicate locally. The OP in that thread seems to have success with that. It’s not the exact configuration we run in production but seems sufficient for replicating the issue in so much as I understand it presently. Can you give that a shot? I can also provide some logs & pcaps if you share an affected domain name.
For folks that might stumble upon this issue and wonder what the resolution was: There was a DNSimple bug and it has since been fixed. If you experience a CAA error and are a DNSimple customer it is not caused by this bug. Please open a new forum thread / bug report and we would be happy to help you diagnose the problem