Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
I similarly don't see any problems, using DNSViz as well as dig +trace from my own server. Hmm…
Have you actually tried issuing a certificate (using --dry-run or equivalent to try the staging server) and are getting the same problem?
Is there any kind of firewall in front of your DNS servers, seti.gobiernodecanarias.org & acatife.gobiernodecanarias.org, that might lead to them blocking queries from certain regions or IP ranges?
Yes, we tried using —dry-run and with manual option, but we had the same problem.
We have a firewall, but all the queries from sites like https://dnschecker.org/ are working ok. We’ll contact the security team to see if there are any problems there.
The security team found the outbound2.letsencrypt.org ip address (64.78.149.164) inside a list of 'malicious ips' that they use. They comment that it comes from ThreatRadar.
Well, yeah, if you don't let the requests from Let's Encrypt's servers get to your DNS server then it won't work.
The core idea here is that in order to verify that you own a name, you need to prove you own it as seen from everywhere on the Internet. So they check, from several places on the Internet, what your DNS resolves to (and for the typical case of using HTTP-01 challenges, also whether they can get to your actual server). So you need to have your system visible from everywhere in order to get a certificate.
For some people, it's easier to do DNS-01 challenges instead (if you can automate updating your DNS) since their security folks feel better about allowing "anybody" access DNS than they do about letting "anybody" access their web server. But even if you go that way, you can't block traffic to your DNS server or you won't get your certificate.
Some people, who really like firewalling off traffic that they're not expecting, go so far as to automate firewall update rules, so that the firewall allows all traffic to come in while they're doing the challenges for a certificate issuance or renewal, and then puts the firewall back to being more restrictive again afterward. That's not usually an easy approach, though.
