# Lightsail Certbot incorrect TXT record error

**URL:** <https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797>\
**Category:** Help\
**Created:** [February 21, 2021, 11:54am UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797 "2021-02-21T11:54:01Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 21, 2021, 11:54am UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/1 "2021-02-21T11:54:01Z")

</div>

Hello,

My domain is: www.wyn.ie

I ran this command: sudo certbot -d $DOMAIN -d $WILDCARD --manual --preferred-challenges dns certonly  
DOMAIN=wyn.ie  
WILDCARD=\*.$DOMAIN  
echo $DOMAIN && echo $WILDCARD  
wyn.ie  
\*.wyn.ie

It produced this output:

Press Enter to Continue  
Waiting for verification...  
Cleaning up challenges  
Failed authorization procedure. wyn.ie (dns-01): urn:ietf:params:acme:error:unautho  
rized :: The client lacks sufficient authorization :: Incorrect TXT record "3FDWn6c  
M90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ" (and 1 more) found at \_acme-challenge.wyn.ie,  
wyn.ie (dns-01): urn:ietf:params:acme:error:unauthorized :: The client lacks suffi  
cient authorization :: Incorrect TXT record "Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZ  
Lihsg" (and 1 more) found at \_acme-challenge.wyn.ie

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): Amazon Lightsail

The operating system my web server runs on is (include version): Linux

My hosting provider, if applicable, is: Amazon Lightsail

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 0.31.0

I checked my TXT records here: [Network Tools: DNS,IP,Email](https://mxtoolbox.com/SuperTool.aspx) using \_acme-challenge.wyn.ie and they look fine. I re-ran the steps and added the next TXT records but it didnt help.

I dont see a problem with my IP address or my domain records.

How can I resolve these errors?

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [February 21, 2021, 6:10pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/2 "2021-02-21T18:10:43Z")

</div>

Welcome to the Let's Encrypt Community, William 🙂

You might just need to wait longer to let the TXT records propagate through the DNS systems before hitting "enter" to verify. Say... 5 minutes.

Confirm here before hitting "enter":

[https://toolbox.googleapps.com/apps/dig/#TXT/](https://toolbox.googleapps.com/apps/dig/#TXT/)

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 21, 2021, 11:18pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/3 "2021-02-21T23:18:09Z")

</div>

I don't think time is the issue here.  
The two records found by LE:

> [@WilliamW](#):
>
> Domain: wyn.ie  
> Type: unauthorized  
> Detail: Incorrect TXT record  
> "3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ" (and 1 more) found at  
> \_acme-challenge.wyn.ie
> 
> Domain: wyn.ie  
> Type: unauthorized  
> Detail: Incorrect TXT record  
> "Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg" (and 1 more) found at  
> \_acme-challenge.wyn.ie

Are the same two that are seen there now.

```nohighlight
_acme-challenge.wyn.ie text = "3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ"
_acme-challenge.wyn.ie text = "Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg"

```

So waiting didn't change anything.

> [@WilliamW](#):
>
> --manual --preferred-challenges dns

Requires changing the TXT records to the new ones provided by `certbot`.  
**and waiting** until they are seen at **all** the authoritative DNS servers:

```nohighlight
wyn.ie nameserver = ns-152.awsdns-19.com
wyn.ie nameserver = ns-965.awsdns-56.net
wyn.ie nameserver = ns-1197.awsdns-21.org
wyn.ie nameserver = ns-1759.awsdns-27.co.uk

```

[I do like how they used four different TLDs - one brownie point for AWS]

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 22, 2021, 10:40am UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/4 "2021-02-22T10:40:42Z")

</div>

Hey all, thanks for the responses. In regards to:

Requires changing the TXT records to the new ones provided by `certbot` .  
**and waiting** until they are seen at **all** the authoritative DNS servers:

```nohighlight
wyn.ie nameserver = ns-152.awsdns-19.com
wyn.ie nameserver = ns-965.awsdns-56.net
wyn.ie nameserver = ns-1197.awsdns-21.org
wyn.ie nameserver = ns-1759.awsdns-27.co.uk

```

How can I confirm this has happened? Is it just a case of waiting 24-48 hours or is there someplace I can check? Apologies for the question, I'm a little new to this.

---

<div class="post-metadata">

**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\
**Post date:** [February 22, 2021, 10:48am UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/5 "2021-02-22T10:48:53Z")

</div>

Hello @WilliamW,

> [@WilliamW](#):
>
> How can I confirm this has happened? Is it just a case of waiting 24-48 hours or is there someplace I can check?

No need to wait so much time, just ask every of your authoritative dns servers for the txt records.

Something like this:

`for i in $(dig wyn.ie ns +short); do echo "Checking $i"; dig @$i _acme-challenge.wyn.ie txt +short;echo ""; done`

And you should get an output similar to this (of course, txt records will vary if you add/delete/modify them):

```
Checking ns-1197.awsdns-21.org.
"3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ"
"Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg"

Checking ns-152.awsdns-19.com.
"3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ"
"Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg"

Checking ns-1759.awsdns-27.co.uk.
"3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ"
"Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg"

Checking ns-965.awsdns-56.net.
"3FDWn6cM90VkdNSim3ZUUrwTrW05sbkShhScQTTA8SQ"
"Ad7tS9MG0Ct8qvV8t0hNldeJuR5hKMjndafhkZLihsg"

```

Cheers,  
sahsanu

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 22, 2021, 5:39pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/6 "2021-02-22T17:39:40Z")

</div>

Thanks for your reply. I tried what you suggested:

> [@sahsanu](#):
>
> `for i in $(dig wyn.ie ns +short); do echo "Checking $i"; dig @$i _acme-challenge.wyn.ie txt +short;echo ""; done`

and the output was:

Checking [ns-965.awsdns-56.net](http://ns-965.awsdns-56.net).  
dig: couldn't get address for '-challenge.wyn.ie': not found

Checking [ns-1197.awsdns-21.org](http://ns-1197.awsdns-21.org).  
dig: couldn't get address for '-challenge.wyn.ie': not found

Checking [ns-1759.awsdns-27.co.uk](http://ns-1759.awsdns-27.co.uk).  
dig: couldn't get address for '-challenge.wyn.ie': not found

Checking [ns-152.awsdns-19.com](http://ns-152.awsdns-19.com).  
dig: couldn't get address for '-challenge.wyn.ie': not found

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [February 22, 2021, 5:42pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/7 "2021-02-22T17:42:13Z")

</div>

I think you may need to wrap that part with single quotes, like:

```nohighlight
for i in $(dig wyn.ie ns +short); do echo "Checking $i"; dig @$i '_acme-challenge.wyn.ie' txt +short;echo ""; done

```

Or perhaps double quotes:

```nohighlight
for i in $(dig wyn.ie ns +short); do echo "Checking $i"; dig @$i "_acme-challenge.wyn.ie" txt +short;echo ""; done

```

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [February 22, 2021, 6:40pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/8 "2021-02-22T18:40:16Z")

</div>

If you're using AWS Route 53 for your DNS, you might want to explore using the Certbot Route 53 [DNS plugin](https://certbot.eff.org/docs/using.html#dns-plugins) rather than manually updating TXT records. I've found challenges having it installed on the same system is the AWS CLI tools, since they seem to want different version of Python, but having _some_ sort of automated DNS update lets you have certificates renew automatically rather than needing to manually update the DNS to get a new certificate every couple months.

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 23, 2021, 10:20am UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/9 "2021-02-23T10:20:28Z")

</div>

I confirmed that the TXT records are now there. What command can I run to get back to the verification step so I can confirm with certbot that the TXT files are there? Sorry for the continued questions, very very new to all this. I really appreciate everyone's help though.

---

<div class="post-metadata">

**Author:** ![griffin](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/griffin/32/50204_2.png) [@griffin](https://community.letsencrypt.org/u/griffin)\
**Post date:** [February 23, 2021, 1:24pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/10 "2021-02-23T13:24:20Z")

</div>

The problem you're likely facing is that the TXT records will change each time when validation fails. This is why delaying some time after setting up the TXT records (whether manually or programmatically) before telling Let's Encrypt to validate them is often necessary to ensure proper propagation to all of your nameservers. How long depends upon the performance of your nameservers. I usually find 5 minutes to be far more than sufficient. As @sahsanu and I both mentioned, you can always check each nameserver via [dig](https://toolbox.googleapps.com/apps/dig/) to ensure everything is ready. If only some nameservers have the correct TXT records, there is a chance that validation will succeed, but it's a gamble. You should seriously consider the wise advice given by @petercooperjr. It will simplify your life considerably.

---

<div class="post-metadata">

**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\
**Post date:** [February 23, 2021, 1:54pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/11 "2021-02-23T13:54:22Z")

</div>

In particular, the Route 53 API allows one to determine when all the AWS servers are in sync with the change that's requested. While I haven't used the Certbot Route 53 plugin myself (like I said, I had problems having it installed the same time as the AWS CLI due to some python version conflicts I never figured out), I'm assuming that it uses that to help know when the TXT records are ready for the Let's Encrypt servers to check.

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 23, 2021, 3:42pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/12 "2021-02-23T15:42:49Z")

</div>

Thanks all, I will give this a go again. I will also look at the plugins you suggested as they look useful.

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 24, 2021, 2:17pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/13 "2021-02-24T14:17:19Z")

</div>

I tried this again and it still failed. I confirmed using the command:

```nohighlight
for i in $(dig wyn.ie ns +short); do echo "Checking $i"; dig @$i '_acme-challenge.wyn.ie' txt +short;echo ""; done

```

that the TXT files were present and I still waited an extra 60 minutes to be sure. The error I got back is:

IMPORTANT NOTES:

- The following errors were reported by the server:

---

<div class="post-metadata">

**Author:** ![WilliamW](https://avatars.discourse-cdn.com/v4/letter/w/c2a13f/32.png) [@WilliamW](https://community.letsencrypt.org/u/WilliamW)\
**Post date:** [February 24, 2021, 2:33pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/14 "2021-02-24T14:33:43Z")

</div>

Hey all, you can ignore this as I tried again and it worked. Im good for now. Thanks all.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 26, 2021, 2:34pm UTC](https://community.letsencrypt.org/t/lightsail-certbot-incorrect-txt-record-error/145797/15 "2021-03-26T14:34:30Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.