RFC2136 with Bind 9.20.23 and Certbot 5.6.0 on Archlinux errors

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: arenns.com

I ran this command: sudo certbot certonly --dry-run -v --dns-rfc2136 --dns-rfc2136-credentials /etc/letsencrypt/arenns.com.ini -d arenns.com -d *.arenns.com

It produced this output:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-rfc2136, Installer None
Simulating a certificate request for arenns.com and *.arenns.com
Performing the following challenges:
dns-01 challenge for Identifier(typ=IdentifierType(dns), value='arenns.com')
dns-01 challenge for Identifier(typ=IdentifierType(dns), value='arenns.com')
Cleaning up challenges
Received response from server: SERVFAIL
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

My web server is (include version): Apache httpd 2.4.67-1

The operating system my web server runs on is (include version): Archlinux 7.0.11-arch1-1

My hosting provider, if applicable, is: ARP Networks

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): 5.6.0

The Bind 9.20.23 warning log shows:
07-Jun-2026 21:36:57.417 error: client @0x7f7d3d273400 127.0.0.1#59630/key arenns.com: updating zone 'arenns.com/IN': could not get zone keys for secure dynamic update
07-Jun-2026 21:36:57.417 error: client @0x7f7d3d273400 127.0.0.1#59630/key arenns.com: updating zone 'arenns.com/IN': RRSIG/NSEC/NSEC3 update failed: not found

I'm wondering if it's because I have DNSSEC signed zones or something. If so, I have no idea how to fix that.

2

How are you doing DNSSEC? Does Bind have your keys or are you using an external signer?

3

dnssec-signzone -a -S -d /var/named/keys/arenns.com -o arenns.com -K /var/named/keys/arenns.com -t /var/named/arenns.com

If there's a more automated way to do that (look, I started all this web crap before HTML 4) I'd be happy to set it up.

4

The current recommended way using bind is to setup a "Key and Signing Policy" (5. DNSSEC — BIND 9 9.20.23 documentation), this will update and maintain the DNSSEC records automatically allowing for dynamic DNS updates.

5

That does look like the DNSSEC side rather than Certbot itself. With a manually signed zone, BIND can accept the RFC2136 update but then cannot create/update the needed DNSSEC records for the dynamic change, which matches the could not get zone keys / RRSIG/NSEC/NSEC3 update failed messages.

I would move this zone to BIND’s automatic DNSSEC signing (dnssec-policy / inline signing) as Max suggested, then test a small _acme-challenge update with nsupdate before retrying Certbot. Once BIND owns the signing keys and can maintain the signatures itself, the RFC2136 plugin should not need any special Certbot-side workaround.