# Incorrect TXT Record Error **URL:** \ **Category:** Help\ **Created:** [February 20, 2019, 3:33pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718 "2019-02-20T15:33:47Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 20, 2019, 3:33pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/1 "2019-02-20T15:33:47Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [crt.sh | example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: [infosecfor.me](http://infosecfor.me) I ran this command: sudo certbot -d $DOMAIN -d $WILDCARD --manual --preferred-chal lenges dns certonly It produced this output: The following errors were reported by the server: Domain: [infosecfor.me](http://infosecfor.me) Type: unauthorized Detail: Incorrect TXT record "2D3CexlsQjd33EGwOKC-\_2W7zPdyA7jklZYgqm20Lnw" found at \_acme-challenge.infosecfor.me To fix these errors, please make sure that your domain name was entered correctly and the DNS A/AAAA record(s) for that domain contain(s) the right IP address. bitnami@ip-172-26-12-217:~$ The client lacks sufficient authorization :: Incorrect TXT re cord "2D3CexlsQjd33E > GwOKC-\_2W7zPdyA7jklZYgqm20Lnw" found at \_acme-challenge.infosecfor.me My web server is (include version): Lightsail LAMP PHP 7.1 The operating system my web server runs on is (include version): Linux My hosting provider, if applicable, is: Amazon Lightsail I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): 0.28.0 ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 20, 2019, 3:50pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/2 "2019-02-20T15:50:21Z")
Hi @tychoash > [@tychoash](#): > > My domain is: [infosecfor.me](http://infosecfor.me) your TXT entries are good ( [infosecfor.me - Make your website better - DNS, redirects, mixed content, certificates](https://check-your-website.server-daten.de/?q=infosecfor.me) ): ### TXT - Entries | Domainname | TXT Entry | Status | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | | [infosecfor.me](http://infosecfor.me) | | ok | 1 | 0 | | \_acme-challenge.infosecfor.me | 2D3CexlsQjd33EGwOKC-\_2W7zPdyA7jklZYgqm20Lnw | looks good | 1 | 0 | | \_acme-challenge.infosecfor.me | mYo3scuxxHA6oo0ZVTCZOeTUd1HGtwTfSO9uEtwyMrY | looks good | 1 | 0 | But: You need two different txt entries with the same name and different values. So it looks that you have removed the wrong entry. At the end of your action, both txt entries must have correct (and different) values. So start new: - create the first entry - create the second entry - check, if both entries are visible - then confirm (next step using certbot) ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 20, 2019, 3:55pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/3 "2019-02-20T15:55:30Z")
Wow thanks for the prompt reply! I am using this guide to help me set it up. [https://lightsail.aws.amazon.com/ls/docs/en/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress](https://lightsail.aws.amazon.com/ls/docs/en/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress) What step do I need to go back to in order to correct my error? Thanks in advance for the help, Aaron ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 20, 2019, 3:58pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/4 "2019-02-20T15:58:34Z")
> [@tychoash](#): > > What step do I need to go back to in order to correct my error? Start a new order. I don't see really an error. Your entries are ok, so the only thing: You have added value 1. Then you have added value 2, but you overwrite value 1. So if Letsencrypt checks, one value is missing. Two domain names (`*.example.com + example.com`) -\> two different values, but both with the same domain name `_acme-challenge.example.com`. Letsencrypt must see both values (same time). ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [February 21, 2019, 1:57am UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/5 "2019-02-21T01:57:48Z")
STEP #4, Line 7. Says: “_Repeat steps 3 through 6 to add the second set of TXT records specified by the Let’s Encrypt certificate request._” But those instructions are not clear; In that it may not work as expected with all DNS systems. Some (menu driven) DNS systems will only allow for one TXT record to exist for any single FQDN. That said, you should be able to create entry one single with multiple lines. So you simple need to combine the two records with a carriage return (line break) into one entry: instead of: TXT = “textstring#1” TXT = “textstring#2” could be: TXT = “textstring#1 textstring#2” ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 27, 2019, 3:31pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/6 "2019-02-27T15:31:46Z")
Since you guys were awesome with helping with the other cert issue I am hoping you can help with me setting up my personal one. Failed authorization procedure. [bregg.com](http://bregg.com) (dns-01): urn:ietf:params:acme:error:unauthorize d :: The client lacks sufficient authorization :: Incorrect TXT record “3jvoE7-Ng4q1hayXzT \_pUtrLcU3gTPWjTq5HN9cBMpg” (and 1 more) found at \_acme-challenge.bregg.com IMPORTANT NOTES: - The following errors were reported by the server: I am getting this error even after I created an ‘A’ record for [www.bregg.com](http://www.bregg.com). I am not sure why I am getting this error after I corrected the mistake it told me to correct. Any help would be greatly appreciated! ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 27, 2019, 3:40pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/7 "2019-02-27T15:40:48Z")
Hi @tychoash > [@tychoash](#): > > Domain: [bregg.com](http://bregg.com) > Type: unauthorized > Detail: Incorrect TXT record > “3jvoE7-Ng4q1hayXzT\_pUtrLcU3gTPWjTq5HN9cBMpg” (and 1 more) found at > \_acme-challenge.bregg.com I see, you have already checked your domain via [https://check-your-website.server-daten.de/?q=bregg.com](https://check-your-website.server-daten.de/?q=bregg.com) There are two DNS TXT entries: ### XT - Entries | Domainname | TXT Entry | Status | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | | [bregg.com](http://bregg.com) | v=spf1 include:zoho.com ~all | ok | 1 | 0 | | [bregg.com](http://bregg.com) | [zoho-verification=zb15511938.zmverify.zoho.com](http://zoho-verification=zb15511938.zmverify.zoho.com) | ok | 1 | 0 | | [www.bregg.com](http://www.bregg.com) | | ok | 1 | 0 | | \_acme-challenge.bregg.com | 3jvoE7-Ng4q1hayXzT\_pUtrLcU3gTPWjTq5HN9cBMpg | looks good | 1 | 0 | | \_acme-challenge.bregg.com | zV8m62iNTw54ZOWfesh\_\_Xmo5C1-EGrNNk8yq-DRbZQ | looks good | 1 | 0 | What command did you used? If you want a wildcard certificate with `*.bregg.com + bregg.com`, then you have to create two different entries with the same name and different values. So start certbot again, replace these two values with new entries. Then recheck your domain. If you see the new values, do the next step. PS: Perhaps change both values in one step. Certbot shows first new value -\> copy it in a document Certbot shows second new value -\> copy it too -\> GoTo your DNS settings -\> change both values. Wait 3 - 5 minutes -\> recheck ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 27, 2019, 3:51pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/8 "2019-02-27T15:51:23Z")
Wow that was a fast response. I am following the instructions for using Let’s Encrypt with AWS Lightsail: [https://lightsail.aws.amazon.com/ls/docs/en/articles/amazon-lightsail-using-lets-encrypt-certificates-with-lamp](https://lightsail.aws.amazon.com/ls/docs/en/articles/amazon-lightsail-using-lets-encrypt-certificates-with-lamp) How do I replace the values so I can create the new entries? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 27, 2019, 3:57pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/9 "2019-02-27T15:57:01Z")
> [@tychoash](#): > > How do I replace the values The tutorial uses `--manual`, so use your DNS menu of your domain to change these two entries. ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 27, 2019, 4:08pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/10 "2019-02-27T16:08:01Z")
Ok if I am understanding you correctly I should create a new TXT record in my [bregg.com](http://bregg.com) DNS zone that would say \_acme-challenge.www.bregg.com (the .www would be the new part)? ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [February 27, 2019, 4:20pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/11 "2019-02-27T16:20:32Z")
Ah nevermind I understand what you mean now. That time it worked! Thanks and I will definitely have to make a donation. You rock! ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [February 27, 2019, 5:09pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/12 "2019-02-27T17:09:25Z")
> [@tychoash](#): > > That time it worked! Happy to read that. Yep, now there is a new wildcard certificate: ```nohighlight CN=bregg.com 27.02.2019 28.05.2019 expires in 90 days *.bregg.com, bregg.com - 2 entries ``` And you have created two new TXT entries: ### TXT - Entries | Domainname | TXT Entry | Status | ∑ Queries | ∑ Timeout | | --- | --- | --- | --- | --- | | [bregg.com](http://bregg.com) | v=spf1 include:zoho.com ~all | ok | 1 | 0 | | [bregg.com](http://bregg.com) | [zoho-verification=zb15511938.zmverify.zoho.com](http://zoho-verification=zb15511938.zmverify.zoho.com) | ok | 1 | 0 | | [www.bregg.com](http://www.bregg.com) | | ok | 1 | 0 | | \_acme-challenge.bregg.com | 3jvoE7-Ng4q1hayXzT\_pUtrLcU3gTPWjTq5HN9cBMpg | looks good | 1 | 0 | | \_acme-challenge.bregg.com | gddZ3cxz7Slml81MizSAPdA\_-gzYpn59g-OZaV2D6GY | looks good | 1 | 0 | `ns-1055.awsdns-03.org` is your nameserver, but I don't know if these nameservers support an API to automate that. ---
**Author:** ![tychoash](https://avatars.discourse-cdn.com/v4/letter/t/258eb7/32.png) [@tychoash](https://community.letsencrypt.org/u/tychoash)\ **Post date:** [March 1, 2019, 5:34pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/13 "2019-03-01T17:34:11Z")
Hi J-man! I was able to use the awesome server checking tool to finish my .htaccess and SSL changes. My score went from a ‘C’ to an ‘A’. Thanks!!! > **[Make your website better](https://check-your-website.server-daten.de/?q=bregg.com)** > > Check your redirects http - https, your preferred version (www vs. non-www), DNS, EDNS, Nameservers, certificates and connections. A ranking system shows, if your domain is A+ (no errors + preload), has errors (https - http) or loops ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [March 1, 2019, 6:03pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/14 "2019-03-01T18:03:14Z")
> [@tychoash](#): > > My score went from a ‘C’ to an ‘A’. Thanks!!! Happy to read that the tool is helpful. But: C is good. There are a lot of sites with a lot of errors 😉 Ok, A is better. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [March 31, 2019, 6:10pm UTC](https://community.letsencrypt.org/t/incorrect-txt-record-error/86718/15 "2019-03-31T18:10:16Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.