Error accepting authorization: acme: authorization error for tunafi.com: 400 urn:ietf:params:acme:error:dns: DNS problem: SERVFAIL looking up A for tunafi.com

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: tunafi.com

I ran this command:
kubectl describe challenge -n {ns} {app}

It produced this output: Error accepting authorization: acme: authorization error for tunafi.com: 400 urn:ietf:params:acme:error:dns: DNS problem: SERVFAIL looking up A for tunafi.com - the domain's nameservers may be malfunctioning

My web server is (include version): nginx

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

2

I have also look in others similar topics, so far didn't see an issue with DNSSEC, see here: tunafi.com - Make your website better - DNS, redirects, mixed content, certificates

3

DNSViz finds your DNSSEC isn't set up right at all:

https://dnsviz.net/d/tunafi.com/dnssec/

3 Likes
4

interesting, thanks for letting me know @petercooperjr. now how to sort this DNSSEC issue?

1 Like
6

There are only three authorized DNSSEC IDs, but none are being used:

AUTHORIZED     CONFIGURED
============== ==============
alg=8 id=39343
alg=8 id=54714
alg=1 id=20160

Q#1: Is your zone signed? (if so, with what IDs?)
Q#2: Have you made any significant DNS changes?

2 Likes
7

A#:1: I have switched from 2 different registrars, which the first one supported DNSSEC, the second one didn't. Now I moved again to another registrar that supports DNSSEC and activated DNSSEC via the current registrar and its signed and the DS record is being published which I expect within the next 48 hours.
A#2: Not really just hopping from one provider to another.

1 Like
8

Just wanted so say, thanks for pointing the answer to the correct direction for fixing it. Its all good now :slight_smile: @petercooperjr !

1 Like
9

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.