My domain is: onoma.yocto.com I ran this command: docker exec -it certbot certbot renew --dns-yocdns-propagation-seconds 120 It produced this output: Waiting 120 seconds for DNS changes to propagate Certbot failed to authenticate some domains (authenticator: dns-yocdns). The Certificate Authorit…

Okay, I found the issue and fixed it. It was indeed something with case-sensitivity, @petercooperjr , but not in the way you think. My DNS server is written in Java. I have a function (checkRecordBetweenNSEC) that adds NSEC records to the response based on the state (NXDOMAIN or NODATA/NOERROR). How…

Full disclosure, I am even less skilled at DNS than Peter :slight_smile: But, thought I'd pass along the results of below tool in hopes it makes sense to you (I learned of this tool from Peter in fact). In the past I have seen problems from this testing tool for domains that worked fine. So, I a…

[image] MikeMcQ: I have never seen the TooBig failure shown with yocto before though. Seems interesting. Oh, I'll agree that looks interesting. Let's Encrypt queries with the equivalent of dig's +bufsize=1232 (which was a change last year from 512 ), and DNSSEC-including responses are more lik…

I have never seen the TooBig failure shown with yocto before though. Seems interesting. I think you confuse my Yocto with a Yocto from somebody else; however I will check if I can fix those things. I didn't spend that much time on EDNS when implementing my DNS server.

[image] ben221199: I think you confuse my Yocto with a Yocto from somebody else I looked at the apex zone, yes. But, note the CAA checks query each level of your domain name. The CAA record at or "closest to" your subdomain prevails. If none found the query proceeds to the apex name. Actu…

[image] MikeMcQ: I just remembered that an LE person has said if you add a CAA record at your subdomain you can reduce the total number of CAA queries made. When was that? I think they may have changed how they've done this over time, the most recent post I can find (from last year) says that…

[image] petercooperjr: When was that? It was some time ago. I saw it mentioned on several threads when we used to see more frequent problems with DNS servers that rate limited inbound queries. Here is one example that explicitly says LE starts at the deepest level and works up. Although it…

I fixed the edns@512=toobig,notc error. If I check all servers, there is only one server that gives errors because it is unreachable. [image] However, the Unbound Test still gives me no NSEC records in the response: May 05 20:53:54 unbound[22821:0] info: incoming scrubbed packet: ;; ->>HEADER<<-…

[image] aarongable: We do all CAA lookups in parallel ... for 8+ years Thanks for clarity. I guess I misunderstood what mcpherrinm said. Do you have any insight into this thread's problem? Isn't a Secondary Validation error of this nature unusual?

I don't have much insight, sorry. I basically only have one guess, which is that the two authoritative nameservers (mentioned in Comment #3) don't actually agree with each other. One is serving the NSEC and RRSIG records, and the other isn't. That's the best explanation I have for why this failure …

Problems with CAA records only with Google and Let's Encrypt

Help

aarongable May 5, 2025, 9:13pm 14

(We do all CAA lookups in parallel, and have done so for 8+ years.)

Repeated SERVFAIL errors when Let's Encrypt looks up CAA for .net TLD

Topic		Replies	Views
CAA servfail with register.com Help	29	2129	February 2, 2023
DNS problem: SERVFAIL looking up CAA Help	16	4354	May 8, 2021
Help diagnosing CAA failures `ns1.cyso.nl` Help	14	3674	August 23, 2017
DNS problem: query timed out looking up CAA (using Netregistry) Help	29	13671	June 20, 2017
SERVFAIL looking up CAA, but I see NOERROR myself Help	25	7401	September 7, 2017

Problems with CAA records only with Google and Let's Encrypt

Related topics