Yes, I see that now when Let's Encrypt looks up the (not required) CAA and AAAA it gets a SERVFAIL instead of a 'Not found'. That is certainly a problem.
And, it only affects the subdomains and not boboworld.com itself. Odd.
I don't see anything in the dnsspy.io report that would explain that. But, there are some warnings about DNSSEC which might (link here)
That said, I think we recently had a couple reports of this same problem (with subdomain lookups for optional DNS records). I don't recall enough of those details to find them though.
@kenhumphries I couldn't find any other thread with your DNS provider in past couple weeks. But, there is clearly something wrong and you should take it up with them. Perhaps the results below will help convince them of the problem. Also, see the Let's Encrypt docs about DNS errors (link here)
The summary is that for your subdomains the DNS lookup for records that are not present (CAA, AAAA) return a SERVFAIL. But, DNS lookups for your apex domain work fine (even CAA, AAAA that are not present)
I think if you disable DNSSEC it will work but that's a guess and if it helps then points to that as cause in your DNS config.
If you can't use dig use unboundtest.com to reproduce these results
dig CAA mail.boboworld.com
(fails w/SERVFAIL and so will AAAA as not present)
; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> CAA mail.boboworld.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 29423
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
============================
dig A mail.boboworld.com
(works fine)
; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> A mail.boboworld.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 61511
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; ANSWER SECTION:
mail.boboworld.com. 300 IN A 108.215.19.66
==========================
dig CAA boboworld.com
(works correctly by responding NOERROR with no ANSWER since no CAA)
; <<>> DiG 9.18.1-1ubuntu1.2-Ubuntu <<>> CAA boboworld.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 2573
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
I just do not get why nslookup will get the Authoritative Name Servers for boboworld.com but not for boboserverw.boboworld.com, yet the A Record is no problem.
This is not too strange.
It doesn't need to return nameservers for non-delegated [sub]domains, but it should have returned the SOA record in its' place.
