# NO TXT record found

**URL:** <https://community.letsencrypt.org/t/no-txt-record-found/159951>\
**Category:** Help\
**Created:** [September 17, 2021, 4:09am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951 "2021-09-17T04:09:15Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 17, 2021, 4:09am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/1 "2021-09-17T04:09:15Z")

</div>

i'm trying to renew a wildcard certificate using dns-01，and i comfirmed that I created the TXT in the dns configuration with TTL = 180 seconds， after i wait for 600 seconds i got this:  
order status: invalid  
error status: 403  
error type: urn:ietf:params:acme:error:unauthorized  
error detail: No TXT record found at \_acme-challenge.cloud.st.meituan.com

but the record exists

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/cacd8bfb0989a2bb5a805f95569542e8904e34a5.png)

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [September 17, 2021, 4:14am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/2 "2021-09-17T04:14:58Z")

</div>

For me ` dig -t TXT _acme-challenge.cloud.st.meituan.com` says:

```nohighlight
 dig -t TXT _acme-challenge.cloud.st.meituan.com

; <<>> DiG 9.16.1-Ubuntu <<>> -t TXT _acme-challenge.cloud.st.meituan.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 56079
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;_acme-challenge.cloud.st.meituan.com. IN TXT

;; ANSWER SECTION:
_acme-challenge.cloud.st.meituan.com. 120 IN CNAME hlb.st.sankuai.com.
hlb.st.sankuai.com. 120 IN CNAME offlinebeijing-bj.st.vip.sankuai.com.

;; AUTHORITY SECTION:
sankuai.com. 135 IN SOA dns1.sankuai.com. hostmaster.sankuai.com. 2016104917 18000 400 72000 1800

;; Query time: 400 msec
;; SERVER: 172.30.96.1#53(172.30.96.1)
;; WHEN: Fri Sep 17 12:11:31 AWST 2021
;; MSG SIZE rcvd: 185

```

Your DNS is not returning the TXT record. What command did you use to get your results in your screenshot, it's obviously different to mine, because those are not your actual authoritative name servers.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 17, 2021, 4:26am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/3 "2021-09-17T04:26:02Z")

</div>

> [@webprofusion](#):
>
> Your DNS is not returning the TXT record.  
> `;; SERVER: 172.30.96.1#53(172.30.96.1)`

I think you may need to ask the actual authoritative nameservers to be sure of the response.

I get:

```nohighlight
dig -t TXT _acme-challenge.cloud.st.meituan.com @ns3.dnsv5.com

; <<>> DiG 9.11.3-1ubuntu1.15-Ubuntu <<>> -t TXT _acme-challenge.cloud.st.meituan.com @ns3.dnsv5.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 51263
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;_acme-challenge.cloud.st.meituan.com. IN TXT

;; ANSWER SECTION:
_acme-challenge.cloud.st.meituan.com. 180 IN TXT "8d3bar2L-NLT_cZOY1pJaEtUqmUTMePhFDzpIFI9rFw"

;; AUTHORITY SECTION:
meituan.com. 86400 IN NS ns4.dnsv5.com.
meituan.com. 86400 IN NS ns3.dnsv5.com.

;; Query time: 236 msec
;; SERVER: 129.211.176.212#53(129.211.176.212)
;; WHEN: Fri Sep 17 04:25:32 UTC 2021
;; MSG SIZE rcvd: 175

```

That said, they may employ some type of global anycast IP system (who knows).  
And depending on where you are on the Internet, you might have to wait longer for the synchronization to be visible.

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 17, 2021, 4:42am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/4 "2021-09-17T04:42:48Z")

</div>

OK, there is (always) more than meets the eye!

Depending on _who_ you ask, you get a different set of authoritative nameservers.

`nslookup -q=ns meituan.com e.gtld-servers.net`  
Shows four:

```nohighlight
meituan.com nameserver = ns3.dnsv5.com
meituan.com nameserver = ns4.dnsv5.com
meituan.com nameserver = edns1.sankuai.com
meituan.com nameserver = edns2.sankuai.com

```

But...  
`nslookup -q=ns meituan.com ns3.dnsv5.com`  
Shows only two:

```nohighlight
meituan.com nameserver = ns3.dnsv5.com
meituan.com nameserver = ns4.dnsv5.com

```

Long story short: **Your DNS is in a bad state.**  
Go to your registrar and ensure they only list the nameservers that are expected.

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 17, 2021, 6:15am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/5 "2021-09-17T06:15:30Z")

</div>

> [@webprofusion](#):
>
> Your DNS is not returning the TXT record. What command did you use to get your results in your screenshot, it's obviously different to mine, because those are not your actual authoritative name servers.

i got TXT record:[DNS Checker - DNS Check Propagation Tool](https://dnschecker.org/#TXT/_acme-challenge.cloud.st.meituan.com)

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [September 17, 2021, 6:31am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/6 "2021-09-17T06:31:19Z")

</div>

Yes, it works for me now as well, so maybe you have fixed it, or maybe you have really slow DNS propagation across your nameservers. You'll find out when you next have to change that value.

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 17, 2021, 6:41am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/7 "2021-09-17T06:41:38Z")

</div>

> [@rg305](#):
>
> nslookup -q=ns [meituan.com](http://meituan.com) [ns3.dnsv5.com](http://ns3.dnsv5.com)

why the number of nameserver lead to certficate failure？

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 17, 2021, 6:49am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/8 "2021-09-17T06:49:55Z")

</div>

I haven't solved fixed it，maybe DNS propagation is really slow

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 17, 2021, 7:01am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/9 "2021-09-17T07:01:23Z")

</div>

> [@amber](#):
>
> Why the number of nameservers lead to certificate failure？

The number of nameservers isn't the problem.  
It fails, because LE will _walk the DNS tree_ and find **four** _authoritative_ nameservers.  
Two of which _work_ and two that _fail_.  
All nameservers must _work_.

I repeat:

> [@rg305](#):
>
> Go to your registrar and ensure they only list the nameservers that are expected.

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 18, 2021, 3:15am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/11 "2021-09-18T03:15:07Z")

</div>

I contacted the registrar to solve this problem,thanks 😀  
but Why does LE require all nameservers to work properly?

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 18, 2021, 5:42am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/12 "2021-09-18T05:42:09Z")

</div>

> [@amber](#):
>
> Why does LE require all nameservers to work properly?

I can't say with certainty that all nameservers **must** work properly.  
So I dare say that is NOT a requirement.  
But I can say that for each failing system in a four nameserver configuration, the odds of success are reduced by at least 37/64 (or 57.8%).  
And when two systems are failing (as in your case) the odds of failure are at least 7/8 (or 87.5%).

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 18, 2021, 8:35am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/13 "2021-09-18T08:35:19Z")

</div>

After registrar solves this problem, it still returns "No TXT Record found"  
domain:\_acme-challenge.cloud.st.sankuai.com

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 18, 2021, 5:10pm UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/14 "2021-09-18T17:10:34Z")

</div>

> [@amber](#):
>
> After registrar solves this problem

I don't see any change with the authoritative nameservers.

> [@amber](#):
>
> still returns "No TXT Record found"  
> domain:\_acme-challenge.cloud.st.sankuai.com

Why are you checking against domain "[sankuai.com](http://sankuai.com)" ?  
[when the cert request is on domain "[meituan.com](http://meituan.com)"]

---

<div class="post-metadata">

**Author:** ![webprofusion](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/webprofusion/32/85310_2.png) [@webprofusion](https://community.letsencrypt.org/u/webprofusion)\
**Post date:** [September 20, 2021, 3:10am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/15 "2021-09-20T03:10:03Z")

</div>

> [@amber](#):
>
> \_acme-challenge.cloud.st.sankuai.com

I think you have a wildcard CNAME record which is taking priority over the TXT record and redirecting everything to `hlb.st.sankuai.com` which in turns points to `offlinebeijing-bj.st.vip.sankuai.com`:

[https://dnsviz.net/d/\_acme-challenge.cloud.st.sankuai.com/dnssec/](https://dnsviz.net/d/_acme-challenge.cloud.st.sankuai.com/dnssec/)  
[https://unboundtest.com/m/TXT/\_acme-challenge.cloud.st.sankuai.com/2DLZAVEP](https://unboundtest.com/m/TXT/_acme-challenge.cloud.st.sankuai.com/2DLZAVEP)

So if you specifically query for TXT records only, you get your value, but if you query for CNAME _or_ TXT, then you get the CNAME

---

<div class="post-metadata">

**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\
**Post date:** [September 20, 2021, 3:22am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/16 "2021-09-20T03:22:19Z")

</div>

> [@rg305](#):
>
> Depending on _who_ you ask, you get a different set of authoritative nameservers.
> 
> `nslookup -q=ns meituan.com e.gtld-servers.net`  
> Shows four:
> 
> ```nohighlight
> meituan.com nameserver = ns3.dnsv5.com
> meituan.com nameserver = ns4.dnsv5.com
> meituan.com nameserver = edns1.sankuai.com
> meituan.com nameserver = edns2.sankuai.com
> 
> ```
> 
> But...  
> `nslookup -q=ns meituan.com ns3.dnsv5.com`  
> Shows only two:
> 
> ```nohighlight
> meituan.com nameserver = ns3.dnsv5.com
> meituan.com nameserver = ns4.dnsv5.com
> 
> ```
> 
> Long story short: **Your DNS is in a bad state.**  
> Go to your registrar and ensure they only list the nameservers that are expected.

They are not synchronized:

```nohighlight
nslookup -q=soa meituan.com ns3.dnsv5.com
Server: UnKnown
Address: 59.36.120.148
meituan.com
        primary name server = ns3.dnsv5.com
        responsible mail addr = enterprise3dnsadmin.dnspod.com
        serial = 1631950111

nslookup -q=soa meituan.com edns1.sankuai.com
Server: UnKnown
Address: 103.37.136.254
meituan.com
        primary name server = edns1.sankuai.com
        responsible mail addr = edp.networkrd.meituan.com
        serial = 1

```

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [September 20, 2021, 5:48am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/17 "2021-09-20T05:48:16Z")

</div>

> [@webprofusion](#):
>
> I think you have a wildcard CNAME record which is taking priority over the TXT record (…)

You're not allowed to combine CNAMEs with other DNS resource records according to the RFCs (I once learned.)

---

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\
**Post date:** [September 20, 2021, 8:01am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/18 "2021-09-20T08:01:59Z")

</div>

Fatal: Inconsistency between delegation and zone.

The set of NS records served by the authoritative name servers must match those proposed for the delegation in the parent zone.: [ns3.dnsv5.com](http://ns3.dnsv5.com) (129.211.176.212):

Delegation: [edns1.sankuai.com](http://edns1.sankuai.com), [edns2.sankuai.com](http://edns2.sankuai.com), [ns3.dnsv5.com](http://ns3.dnsv5.com), [ns4.dnsv5.com](http://ns4.dnsv5.com),

Zone: [ns3.dnsv5.com](http://ns3.dnsv5.com), [ns4.dnsv5.com](http://ns4.dnsv5.com).

Name Servers defined in Delegation, missing in Zone: [edns1.sankuai.com](http://edns1.sankuai.com), [edns2.sankuai.com](http://edns2.sankuai.com).

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 22, 2021, 8:00am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/19 "2021-09-22T08:00:07Z")

</div>

> [@webprofusion](#):
>
> wildcard

i try to issue a Multi Domain Wildcard certificate，this certificate contains [[sankuai.com](http://sankuai.com)] and [[meituan.com](http://meituan.com)]。

---

<div class="post-metadata">

**Author:** ![amber](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@amber](https://community.letsencrypt.org/u/amber)\
**Post date:** [September 22, 2021, 9:07am UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/20 "2021-09-22T09:07:19Z")

</div>

I solved this problem，The cause of the problem is TTL。  
It works when i touch off the challenge after 2TTL，I guess DNS propagation is really slow  
Thanks All 😁

---

<div class="post-metadata">

**Author:** ![JimPas](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/jimpas/32/33270_2.png) [@JimPas](https://community.letsencrypt.org/u/JimPas)\
**Post date:** [September 22, 2021, 6:41pm UTC](https://community.letsencrypt.org/t/no-txt-record-found/159951/21 "2021-09-22T18:41:01Z")

</div>

Hi @amber, Just want to point out you have mixed content on your site - some images are being over http through your two subdomains of [p0.meituan.net](http://p0.meituan.net) and [p1.meituan.net](http://p1.meituan.net) sites. Either change those to https or force https and you'll be all set. 😃  
[s0.meituan.net](http://s0.meituan.net) seems to be serving all images over https. 👍

[Next page](https://community.letsencrypt.org/t/no-txt-record-found/159951.md?page=2)