Max 10 domains in DNS verification

Help
4

I'm failing to see how this is a certbot issue. I've tested certbot just now:

server ~ # DOMAINS=$(echo le-dns-test-{1..20}.example.com | tr ' ' ,)
server ~ # echo $DOMAINS
le-dns-test-1.example.com,le-dns-test-2.example.com,le-dns-test-3.example.com,le-dns-test-4.example.com,le-dns-test-5.example.com,le-dns-test-6.example.com,le-dns-test-7.example.com,le-dns-test-8.example.com,le-dns-test-9.example.com,le-dns-test-10.example.com,le-dns-test-11.example.com,le-dns-test-12.example.com,le-dns-test-13.example.com,le-dns-test-14.example.com,le-dns-test-15.example.com,le-dns-test-16.example.com,le-dns-test-17.example.com,le-dns-test-18.example.com,le-dns-test-19.example.com,le-dns-test-20.example.com
server ~ # certbot certonly --staging --dns-rfc2136 --dns-rfc2136-credentials /etc/letsencrypt/rfc-2136.ini --dns-rfc2136-propagation-seconds 2 -d $DOMAINS
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for le-dns-test-1.example.com and 19 more domains
Waiting 2 seconds for DNS changes to propagate

Certbot failed to authenticate some domains (authenticator: dns-rfc2136). The Certificate Authority reported these problems:
  Domain: le-dns-test-13.example.com
  Type:   dns
  Detail: During secondary validation: DNS problem: query timed out looking up TXT for _acme-challenge.le-dns-test-13.example.com

  Domain: le-dns-test-17.example.com
  Type:   dns
  Detail: During secondary validation: DNS problem: query timed out looking up CAA for le-dns-test-17.example.com

Hint: The Certificate Authority failed to verify the DNS TXT records created by --dns-rfc2136. Ensure the above domains are hosted by this DNS provider, or try increasing --dns-rfc2136-propagation-seconds (currently 2 seconds).

Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
server ~ #

Note that while I did had two failing challenges due to separate issues, 18 out of the 20 challenges were succesful! (And a second run succesfully validated the two remaining challenges.)

I think it's more likely this is a limitation of your DNS servers method of adding TXT records to your DNS zone.

3 Likes