“During secondary validation” may mean a few things:
- Your NSes have a geographic filter.
- Your NSes are not synced properly. When primary validator hits a NS that has proper records and secondary(es) hit the one(s) that do not.
More info here:
Additionally, when I do this query dig _acme-challenge.sor0.ru
, I get a different response from yours:
_acme-challenge.sor0.ru. 90 IN CNAME sor0.ru.
sor0.ru. 3600 IN A 95.143.188.120
;; AUTHORITY SECTION:
sor0.ru. 345600 IN NS ns1.sor0.ru.
sor0.ru. 345600 IN NS ns1.axelname.RU.
sor0.ru. 345600 IN NS ns2.axelname.RU.
When I query your NS directly from NL, I get connection refused:
$ dig _acme-challenge.sor0.ru @ns1.sor0.ru.
;; communications error to 95.143.188.120#53: connection refused
;; communications error to 95.143.188.120#53: connection refused
;; communications error to 95.143.188.120#53: connection refused