Is there a list of primary and secondary LE verification servers? I only found on MicroTik forums: outbound1d.letsencrypt.org and outbound1c.letsencrypt.org . I'm getting During secondary validation: DNS problem error.

[image] Serpher: I can't really do wildcard, Please explain what you mean by that. [image] Serpher: I observed thousands of bots hitting port 53. Looking for what?

I tried simple *.amazonaws.com (or just amazonaws.com ) but it doesn't work. I was looking for suspicious traffic. I read about many DNS attacks and our sysadmin wants acme-dns server access tighten up.

[image] Serpher: Is there a list of primary and secondary LE verification servers? No. What IP addresses does Let’s Encrypt use to validate my web server? Let’s Encrypt does not publish a list of IP addresses we use to validate, and these IP addresses may change at any time. Let's Encrypt…

[image] Serpher: manage firewall policy What firewall are you using? Also what ever firewall you are using you might get better support for this issue through their forums.

Fortigate. It's not firewall's problem but random servers that are used for validation.

[image] Serpher: It's not firewall's problem but random servers that are used for validation. No, this is a firewall issue as it the firewall cannot handle the design of Let's Encrypt random servers that are used for validation. Not a Let's Encrypts issue. Sorry! :frowning:

[image] Serpher: I tried simple *.amazonaws.com (or just amazonaws.com ) but it doesn't work. If you are going to use HTTP-01 authentication, you must leave port 80 open to the Internet. [image] Serpher: I read about many DNS attacks and our sysadmin wants acme-dns server access tighten u…

[image] rg305: Then the acme-dns server should be turned off when not needed. Never heard that one before.

How often is the acme-dns server in use? If "too often", then you might consider keeping it on behind a good IPS and/or behind a dedicated DNS proxy/relay. When the attack vector(s) are known, I simply deploy the most feasible known defense from each.

[image] Serpher: [image] rg305: Then the acme-dns server should be turned off when not needed. Never heard that one before. acme-dns can be left on if wanted. The common usage pattern, however, is to only enable acme-dns during certificate procurement. This can be done by using Certb…

LE verfication servers

Help

Bruce5051 January 19, 2023, 3:17pm 28

Please do yourself a favor and use a DNS Provider from this list:
(or find one that should be on the list but isn't)

Topic		Replies	Views
Problem with verification Issuance Tech	21	4276	April 29, 2020
Shouldn't verification via DNS record be a priority? Issuance Tech	61	40963	February 16, 2016
Renewal or new issue behind a firewall fails due to LE operation Issuance Tech	15	5275	October 8, 2020
Stuck due to recent changes -- using a Firewall and DNS-01 not possible Help	5	1407	February 12, 2018
DNS name for validation endpoints Feature Requests	12	384	September 1, 2025

LE verfication servers

Related topics