DNSimple CAA SERVFAIL

[cpu]

@weppos

Sorry to use this thread (@cpu let me know if I should open a new one for my case), but it's not clear to me if the issue seems to be on LE side, or @rickjanssen side.

I don't think its clear yet whether this is a problem with our Unbound configuration or the remote server.</s.
EDIT: In this case I'm fairly confident it is not our Unbound configuration/server.

@weppos

I am experiencing the same issue, and I can't really reproduce it right now. Running a dig against a name that is reported to fail from LE is succeeding to me. We don't use PowerDNS, we wrote our NS in house.
Is there any way I can get some more details on how is the query performed on your side @cpu? Or should I send you the hostnames so that you can help me to trace them down?

I shared an Unbound configuration in the original thread this was split from that can be used to try and replicate locally. The OP in that thread seems to have success with that. It's not the exact configuration we run in production but seems sufficient for replicating the issue in so much as I understand it presently. Can you give that a shot? I can also provide some logs & pcaps if you share an affected domain name.

@weppos

I wonder if something has changed recently at LE resolver. This is the very first time I see this issue happening.

I think this was likely always a problem but was masked until our CAA SERVFAIL change.