Hello,
Our Let's Encrypt certificate renewal is failing with "rejectedIdentifier:
forbidden by policy" for the following subdomains:
- autoconfig.kbvalkyrie.ru
- autodiscover.kbvalkyrie.ru
These are mail auto-discovery subdomains (CNAME to mail.new-world.group,
IP 31.128.40.220). The parent domain kbvalkyrie.ru has valid DNS and is
actively used for email hosting.
The error prevents renewal of our multi-domain certificate that includes
many other .ru domains which work fine (annaryzanova.ru, grano-coaching.ru,
raevskyschool.ru, etc.).
We believe this block may be erroneous. Could someone from the LE team
please investigate why these specific subdomains are blocked and help
us get them unblocked?
Account ID: https://acme-v02.api.letsencrypt.org/acme/acct/987793376
Thank you!
Update: I now understand the block is on the base domain kbvalkyrie.ru,
not just the subdomains. The domain kbvalkyrie.ru is a legitimate
Russian business domain (registered until Nov 2026), actively used
for email hosting with 30+ mailboxes.
It uses ddos-guard for DDoS protection. If this is triggering the
block, please let us know what steps we can take to verify domain
ownership and get it unblocked.
We are the domain owners and can provide any verification needed.
The error message isn't from failing to validate a domain, it's because Let's Encrypt has specifically prohibited issuing certificates for that domain. In this case, it might be because LIMITED LIABILITY COMPANY KONSTRUKTORSKOE BYURO VALKIRIYA a.k.a KB VALKIRIYA is currently sanctioned by the US government. (Sanctions List Search)