dig +tcp +norecurse stokkie.net@92.67.169.193 should work,
if this command is blocked, then its blocked by a third party upstream,
as the ISP KPN has unblocked it today. Access to 84.87.53.162
tcp port 53 is pending.
But this is what I saw for dig +tcp +norecurse stokkie.net@84.87.53.162
$ dig +tcp +norecurse stokkie.net @84.87.53.162
;; communications error to 84.87.53.162#53: end of file
;; communications error to 84.87.53.162#53: end of file
Right both are authoritative name servers and therefor should give the same responses.
But the SOA has the primary authoritative name server, so I typically start with the SOA's first and then find the remaining authoritative name servers from there.
Let's Encrypt accesses the Authoritative Name Servers. stokkie.net Authoritative Name Servers are not responding.
$ nslookup
> stokkie.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
Name: stokkie.net
Address: 84.87.53.162
> set q=aaaa
> stokkie.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
*** Can't find stokkie.net: No answer
> set q=soa
> stokkie.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
stokkie.net
origin = ns1.stokkie.net
mail addr = hostmaster.stokkie.net
serial = 2022091301
refresh = 43200
retry = 3600
expire = 1814400
minimum = 86400
Authoritative answers can be found from:
> set q=ns
> stokkie.net
Server: 127.0.0.53
Address: 127.0.0.53#53
Non-authoritative answer:
stokkie.net nameserver = ns2.stokkie.net.
stokkie.net nameserver = ns1.stokkie.net.
Authoritative answers can be found from:
> server ns1.stokkie.net.
Default server: ns1.stokkie.net.
Address: 84.87.53.162#53
> stokkie.net
;; connection timed out; no servers could be reached
> set q=soa
> stokkie.net
;; connection timed out; no servers could be reached
> set q=a
> stokkie.net
;; connection timed out; no servers could be reached
> set q=aaaa
> stokkie.net
;; connection timed out; no servers could be reached
> server ns2.stokkie.net.
Default server: ns2.stokkie.net.
Address: 92.67.169.193#53
> stokkie.net
;; connection timed out; no servers could be reached
> set q=a
> stokkie.net
;; connection timed out; no servers could be reached
> set q=soa
> stokkie.net
;; connection timed out; no servers could be reached
> set q=ns
> stokkie.net
;; connection timed out; no servers could be reached
>
You need solid working and accessible DNS Authoritative Name Servers.
Currently this is blocking issue.
Since these are Domain Validation (DV) certificates the Domain Name System (DNS) is used extensively in the validation process as well a allowing us to assist here on Let's Encrypt community.
DNS Queries need to give consistent results from any location on the Internet, all your authoritative DNS Servers for the Domain need to also give consistent results as well.
