During the issuance process I ran into an issue verifying control of one of my domains, turns out I had DNS configured wrong, it was pointing at an individual Application Server instead of the load-balancer. The site was operational so I hadn't caught that this site wasn't being distributed by the l…

We’ve decreased the max TTL we use to a few minutes, so this should no longer be an issue.

Where is the problem to actually obey the TTL? Why do you need to violate standards? Edit: This is the same symptom as when you tried to do SMTP by hand and messed up the whole DNS part of it. Just stick to what the Internet agreed on and don’t try to do your own thing. The Internet is smarter.

@TCM : The issue is that folks would have the wrong entry in their DNS, would fix it, and then would be stuck until the TTL expired.

It definitely makes sense for certain types of services to overwrite minimum and/or maximum TTL. The former provides a good mitigation against DNS rebind attacks, while the latter increases UX for services that rely on DNS for verification purposes. As long as you know why you’re doing it, there’s n…

This makes no sense. How does an additional TTL help here? You are actually increasing their problem by increasing their effective TTL. Edit: I misunderstood here that the TTL now has a maximum. You need to stop trying to accomodate every mistake someone makes in completely unrelated scopes. If som…

You're misunderstanding: They're setting the maximum TTL to a few minutes, so that upstream changes in DNS are picked up faster. Let's say the first response has a TTL of 24 hours - now you'll have to wait 24 hours till Let's Encrypt picks up the new IP address. With a maximum TTL of a few minutes, …

That’s not what the OP is describing. He describes LE using the old record way past the expiration of the TTL.

OP ran into this issue almost 2 months ago. @jsha stated this was (probably recently?) changed, likely because of issues like this. As @joostrijneveld stated, DNS propagation of records with a TTL of 24 hours might actually take more than 24 hours, since other DNS servers between Let’s Encrypt and …

I understand my mistake and that the issue was fixed by (again) messing with the TTL. I’ll stand by it: Don’t mess with DNS or assume you know better. If you teach admins that it’s OK to mess up your TTLs during a migration, they won’t learn it. You learn best when you get bitten in the ass and ev…

LE Using Chached DNS lookups during DV process

Issuance Tech

Topic		Replies	Views
TTL and DNS server used by Lets Encrypt Help	8	9864	June 27, 2018
Concurrent issuances with DNS-01 challenge Issuance Tech	13	498	April 10, 2025
DNS resolution problem during issuance for one domain Help	4	1098	September 2, 2018
Let's Encrypt DNS lookups Help	8	3759	November 8, 2019
DNS01 validation timeouts Client dev	2	1514	March 20, 2020

LE Using Chached DNS lookups during DV process

Related topics