Update: Solution
Getting a SERVFAIL on LE does not mean that you will get a SERVFAIL through dig or unbound or other tools. However, here are some things to try:
- Use
dig -t type257 @ns1.your-nameserver.com yOuR-wEbSiTe.CoM - Check to make sure that your QUESTION section matches the wacky case (aka 0x20 bit casing). Many servers will naturally have matching ANSWER or AUTHORITY sections as well
- Use
dig +dnssec -t type257 @ns1.your-nameserver.com yOuR-wEbSiTe.CoM - Make sure that you’re not getting an error message that way either
- Use https://unboundtest.com and check for “wrong” and “fallback” in the logs
Most likely you will find that your DNS server is not responding correctly in one or more of those ways.
Original
Here’s the error message I’m getting:
DNS problem: SERVFAIL looking up CAA for tunnel.daplie.com
Here’s the command I run to try to reproduce the problem:
dig -t type257 @ns1.redirect-www.org tuNNel.daPLie.com
; <<>> DiG 9.8.3-P1 <<>> -t type257 @ns1.redirect-www.org tuNNel.daPLie.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 45917
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;tunnel.daplie.com. IN TYPE257
;; AUTHORITY SECTION:
daplie.com. 1 IN SOA ns1.redirect-www.org. hostmaster.daplie.com. 2017020100 10800 3600 1209600 1800
;; Query time: 34 msec
;; SERVER: 192.241.238.7#53(192.241.238.7)
;; WHEN: Mon Oct 2 13:55:26 2017
;; MSG SIZE rcvd: 102
I did a sanity check against yahoo.com and I see this:
dig -t type257 @ns1.yahoo.com yAHOo.com
; <<>> DiG 9.8.3-P1 <<>> -t type257 @ns1.yahoo.com yAHOo.com
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29455
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; WARNING: recursion requested but not available
;; QUESTION SECTION:
;yAHOo.com. IN TYPE257
;; AUTHORITY SECTION:
yahoo.com. 600 IN SOA ns1.yahoo.com. hostmaster.yahoo-inc.com. 2017100220 3600 300 1814400 600
;; Query time: 17 msec
;; SERVER: 68.180.131.16#53(68.180.131.16)
;; WHEN: Mon Oct 2 13:56:10 2017
;; MSG SIZE rcvd: 94
The nameservers that we’re using were built by us and they are still in the process of refinement (they work, but when something doesn’t work we go fix it).
I’d like to be able too see why LE doesn’t like our responses so that I can fix them (it’s probably our fault), but I haven’t been able to produce a query that fails in the way that LE is reporting the failure. Also, since yahoo’s nameserver responds the same as ours, it would seem to me that we’re not “doing it wrong” (unless they’re also doing it wrong, which I doubt).
Thank you! I'm afraid i don't have something set up, and i have too many beverages already. If you like, you could send something to Let's Encrypt, though.