[root@server~]# dig CAA mail.x.nl @ns1.x.nl. +dnssec ; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.el6_9.2 <<>> CAA mail.x.nl @ns1.x.nl. +dnssec ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18077 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 4, …

Suddenly it works again. Hope to hear what could have been wrong

Indeed, the problem is back. Anyone can check for example this domain? domain: pcvaardig.nl

It seems to flap on and off, due to the maintenance?

Can you tell us more about the exact problem you are seeing? Are you trying to renew your certificate and getting a “SERVFAIL looking up CAA” error? On staging, or production, or both? Can you print the full error? When you say it’s flapping, are you seeing flapping results from attemtps to issue wi…

@pfg do you see any reason why pop.gwvanpelt.nl would fail on CAA servfail?

I’m trying to recreate a certificate using the DirectAdmin Let’s Encrypt script. I thought it was because of DNSSEC since it worked after I disabled it, but other domains are not working either. After some time I retry the request and it suddenly works. The result is different every time I request …

Another one fails: for num in {1…3}; do for flag in “” “+noadflag” ; do for type in A AAAA TYPE257 TXT ; do echo -n $flag $type ; dig $flag -t $type pop.gwvanpelt.nl @ns$ num.zxcs.nl | grep status: ; done ; done ; done A;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26211 AAAA;; ->>HEADER<<- …

I think your issue is with IPV6 records do you IPV6 records currently point to your servers? Andrei

@ahaw021 , I think that’s not the problem in this case because I looked at the site in both IPv4 and IPv6 and it seems to have the same content! @jsha , I did some very preliminary tests here and seemed not to get the SERVFAIL myself (either via IPv4 or IPv6 DNS queries!)—can you get any more informa…

[image] schoen: @jsha , I did some very preliminary tests here and seemed not to get the SERVFAIL myself (either via IPv4 or IPv6 DNS queries!) That's interesting. From my home connection, I reproduced the SERVFAIL result right away. @rickjanssen , are you able to file a ticket with your DNS p…

PowerDNS: Can't find why CAA servfails

Help

Topic		Replies	Views
SERVFAIL looking up CAA, but I see NOERROR myself Help	25	7401	September 7, 2017
Help diagnosing CAA failures `ns1.cyso.nl` Help	14	3674	August 23, 2017
DNS problem: SERVFAIL looking up CAA Help	16	4354	May 8, 2021
CAA requests resulting in SERVFAIL since Dec 12th Help	22	1310	January 19, 2024
False CAA failure when issuing certs Issuance Tech	35	4293	August 9, 2018

PowerDNS: Can't find why CAA servfails

Related topics