Over the past few days, I have run several test configurations with certbot (using --break-my-certs). Every time, ~2/10 subdomains fails the challenge. Running certbot again then gets succeeds with the remaining subdomains. What's odd is that the subdomains that fail are different every time. I've …

Hard to say. Intermittent SERVFAILs against Google Cloud DNS is not a good sign. On the other hand, we don't have any other user reports. Usually there are, for widespread problems. If Google is maybe rate-limiting the secondary VAs, it might help to actually create a CAA record for each of your …

The certbot error message lets you know which record lookup failed, but not which nameserver. Try the tools here: [image] NS Lookup - Lookup Nameserver of any Domain NS Lookup tool gets the ns record of any domain. Just enter a domain and lookup nameserver records. NS records are also es…

You could try DNSViz as well. [image] DNSViz | A DNS visualization tool It's going to be hard for people here to help if you don't want to reveal your domain names, though.

Thanks for the invite @griffin ... But without a real domain name there isn't much anyone can do. And I'm not about to attempt a careers' worth of knowledge transfer, so they can figure this thing out for themselves. [image] st0necraft: I get variable results without having made any changes to…

Ok yeah lol I guess it isn't really that top secret. Base domain name is mylittlestashbox.com I am using Google Domains and DigitalOcean. I will check out those tools and get back.

If that is one of the names that sometimes shows an intermittent problem. And that problem is ALWAYS the same: [image] st0necraft: DNS problem: SERVFAIL It would be a very strange and unique situation. So let's be perfectly clear about of those base assumptions. Please respond to each of …

I wasn't paying close attention the first few times, but SERVFAIL has appeared the last several tries. 1. All the domains that are having this unique problem use the exact same set of DNS servers: Yes, they all use the exact same name servers. Although the Google servers you listed are my "main…

Please explain this: [image] st0necraft: I also had to create A records on the Digitalocean side For #2, please show the entire file: [you can remove the account numbers] cat /etc/letsencrypt/renewal/mylittlestashbox.com.conf For #3, please show the output of: certbot --version

On the most recent run, I was able to create all the certs without error, but this is the file: Regarding the A records on Digitalocean, all I know is that I could not go to mylittlestashbox.com or any subdomains until I had created the record on the Digitalocean side. I have deleted them now and i…

Please show what you mean by this: [image] st0necraft: I had created the record on the Digitalocean side. I have deleted them now and it still seems to be working.

I simply mean that I can visit the site without a DNS error after deleting the A records from Digitalocean. Perhaps this is related to my issue in the OP though: [image]

How to debug intermittent challenge failures?

Help

Topic		Replies	Views
Intermittent SERVFAIL looking up CAA Help	50	4642	March 2, 2022
During secondary validation: DNS problem: SERVFAIL looking up A for - the domain's nameservers may be malfunctioning Help	44	9488	October 7, 2020
DNS problem SERVFAIL looking up A for sub.domain.de Help	26	4893	November 30, 2018
Error getting validation data Help	13	423	December 28, 2025
Certbot renew failing to renew my certificates - SERVFAIL looking up A for my site Help	46	2768	October 2, 2020

How to debug intermittent challenge failures?

Related topics