# During secondary validation - DNS problem: networking error looking up A **URL:** \ **Category:** Help\ **Created:** [August 10, 2020, 11:19am UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636 "2020-08-10T11:19:42Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![claas](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@claas](https://community.letsencrypt.org/u/claas)\ **Post date:** [August 10, 2020, 11:19am UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/1 "2020-08-10T11:19:42Z")
> [@Increase in renewal DNS failures](https://community.letsencrypt.org/t/increase-in-renewal-dns-failures/130460/5): > > This type of error seems [very rare](https://community.letsencrypt.org/search?q=%22DNS%20problem%3A%20networking%20error%22) and I believe it could only be raised of there was an internal networking problem on Let’s Encrypt’s side, where Boulder can’t communicate with Unbound. Maybe a server in the pool died and you got unlucky. We have issues with one specific (sub)domain only, although other domains with the same name servers (NS: `robotns3.second-ns.com`, `robotns2.second-ns.de`, `ns1.first-ns.de`) renew without problems: ```plaintext 2020/07/20 09:00:50 Domain verification results for 'www.lsp.net': error. During secondary validation: DNS problem: query timed out looking up A for www.lsp.net 2020/07/27 09:00:48 Domain verification results for 'www.lsp.net': error. During secondary validation: No valid IP addresses found for www.lsp.net 2020/08/03 09:00:48 Domain verification results for 'www.lsp.net': error. During secondary validation: DNS problem: SERVFAIL looking up A for www.lsp.net - the domain's nameservers may be malfunctioning 2020/08/10 09:00:48 Domain verification results for 'www.lsp.net': error. During secondary validation: DNS problem: networking error looking up A for www.lsp.net ``` (Source: Logs of a weekly cronjob running [Crypt-LE 0.35](https://github.com/do-know/Crypt-LE/tree/0.35) on Windows Server 2016) **Edit** : I was able to renew the certificate by running the cronjob manually again. ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 10, 2020, 11:28am UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/2 "2020-08-10T11:28:05Z")
Hi @claas your problem looks different. So I've moved it to a new topic. That > [@claas](#): > > `During secondary validation` says: The primary Letsencrypt servers are able to check your domain. The secondary are not. Looks like a regional firewall / blocking. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [August 10, 2020, 11:38am UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/3 "2020-08-10T11:38:54Z")
> [@JuergenAuer](#): > > Looks like a regional firewall / blocking. I'm not sure. The fact that one of the errors is "networking error" is suspicious :(, added to the circumstances of the original report. I really don't want to speculate but it could be that something is up with the remote VAs. Might be time to ask [@lestaff](https://community.letsencrypt.org/groups/lestaff) ([link to the original report](https://community.letsencrypt.org/t/increase-in-renewal-dns-failures/130460)). ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [August 10, 2020, 11:42am UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/4 "2020-08-10T11:42:00Z")
> [@\_az](#): > > I’m not sure. The fact that one of the errors is “networking error” is suspicious Yes, sorry, my error. Read the first three results, then moved it. Time that Letsencrypt should check it. ---
**Author:** ![Phil](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/phil/32/76801_2.png) [@Phil](https://community.letsencrypt.org/u/Phil)\ **Post date:** [August 10, 2020, 2:18pm UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/5 "2020-08-10T14:18:14Z")
Thanks for the heads up. I’m going to dig in and take a look. ---
**Author:** ![Phil](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/phil/32/76801_2.png) [@Phil](https://community.letsencrypt.org/u/Phil)\ **Post date:** [August 10, 2020, 3:15pm UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/6 "2020-08-10T15:15:51Z")
Digging into the logs I found the following information: There were two issuance attempts for `www.lsp.net`. During the first issuance attempt we received the following errors from a random selection of [RVA](https://letsencrypt.org/2020/02/19/multi-perspective-validation.html) nodes ```auto 2020-08-10T07:00:36.679916+00:00 boulder-va[5016]: useHwQo Remote VA "xxx".PerformValidation returned problem: dns :: No valid IP addresses found for www.lsp.net 2020-08-10T07:00:46.720078+00:00 boulder-va[5016]: qqjOgA0 Remote VA "yyy".PerformValidation returned problem: dns :: DNS problem: networking error looking up CAA for www.lsp.net ``` During the second issuance attempt several hours later DNS had propagated, we were able to successfully validate the domain, and issue a certificate. [https://crt.sh/?id=3216017655](https://crt.sh/?id=3216017655) ```auto 2020-08-10T11:21:50.680184+00:00 boulder-va[13370]: uofTDgA [AUDIT] Checked CAA records for www.lsp.net, [Present: true, Account ID: xxxxx, Challenge: http-01, Valid for issuance: true] 2020-08-10T11:21:53.548219+00:00 boulder-ca[25045]: ieCyiQ0 [AUDIT] Signing success: serial=[04f3665528260d3637a7c2e6c60fc28753f8] names=[lsp.net, www.lsp.net] certificate=... ``` I noticed that Hetzner has been having some infrastructure maintenance today, perhaps the first issuance attempt occurred at the worst possible time? [https://twitter.com/hetznerstats?lang=en](https://twitter.com/hetznerstats?lang=en) * * * **Edit:** I’m taking another look at the initial report from [Increase in renewal DNS failures](https://community.letsencrypt.org/t/increase-in-renewal-dns-failures/130460) ---
**Author:** ![claas](https://avatars.discourse-cdn.com/v4/letter/c/919ad9/32.png) [@claas](https://community.letsencrypt.org/u/claas)\ **Post date:** [August 10, 2020, 3:30pm UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/7 "2020-08-10T15:30:13Z")
> [@Phil](#): > > Digging into the logs I found the following information: Thanks for looking into this. > [@Phil](#): > > During the second issuance attempt several hours later DNS had propagated, we were able to successfully validate the domain, and issue a certificate. Indeed this second (manual) execution of our cronjob (after posting my reply in the forum) succeeded. > [@Phil](#): > > I noticed that Hetzner has been having some infrastructure maintenance today I looked into the maintenance announcements and DNS does _not_ seem to have been affected by it. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [August 10, 2020, 8:01pm UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/8 "2020-08-10T20:01:49Z")
> [@Phil](#): > > `2020-08-10T07:00:46.720078+00:00 boulder-va[5016]: qqjOgA0 Remote VA "yyy".PerformValidation returned problem: dns :: DNS problem: networking error looking up CAA for www.lsp.net` Hi Phil, Thanks! Sorry for flagging you, but mainly I wanted to find out whether there is any indication of why the remote VAs themselves have begun reporting a "networking error" during the DNS exchange, as opposed to the actual rcode from the recursor or context timeout? It would be good to know whether to treat that as a normal timeout, or temporary condition, or something that needs attention. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [September 9, 2020, 8:01pm UTC](https://community.letsencrypt.org/t/during-secondary-validation-dns-problem-networking-error-looking-up-a/130636/9 "2020-09-09T20:01:50Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.