# Secondary validation has been failing for almost a week now

**URL:** <https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744>\
**Category:** Help\
**Created:** [February 7, 2021, 11:49am UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744 "2021-02-07T11:49:18Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![holobolo0815](https://avatars.discourse-cdn.com/v4/letter/h/ecc23a/32.png) [@holobolo0815](https://community.letsencrypt.org/u/holobolo0815)\
**Post date:** [February 7, 2021, 11:49am UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744/1 "2021-02-07T11:49:18Z")

</div>

We changed nothing on our side.  
It's been failing with all kinds of errors.

Verify error:During secondary validation: DNS problem: networking error looking up A for  
Verify error:During secondary validation: No valid IP addresses found for  
Verify error:During secondary validation: DNS problem: query timed out looking up CAA

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [February 7, 2021, 11:58am UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744/2 "2021-02-07T11:58:59Z")

</div>

Hi @holobolo0815

your domain name is required if you want help.

Secondary validation fails -\> you may block some ip addresses.

---

<div class="post-metadata">

**Author:** ![holobolo0815](https://avatars.discourse-cdn.com/v4/letter/h/ecc23a/32.png) [@holobolo0815](https://community.letsencrypt.org/u/holobolo0815)\
**Post date:** [February 7, 2021, 2:18pm UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744/3 "2021-02-07T14:18:10Z")

</div>

I should have said that our scripted renewal at 03:01AM (CEST = UTC+0100) failed for the last 8 days.

Our ISP is doing DNS for us. They are not blocking anything.

I've ran the validation right now manually with success.

We have now moved our schedule from 03:01AM to some other time.

---

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [February 7, 2021, 2:41pm UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744/4 "2021-02-07T14:41:01Z")

</div>

It's better to include a randomized delay for renewals. If everybody keeps renewing at `xx:00` or `yy:01`, the peak in load on the Let's Encrypt servers could lead to such things.

Please include a randomized delay between 5 and 55 minutes for the renewal cronjob. (I think it's better to randomize from 5 minutes, as unfortunately most people probably don't include such a delay at all, so it's best to _not_ use the minutes around the whole hour mark at all.)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [March 9, 2021, 2:41pm UTC](https://community.letsencrypt.org/t/secondary-validation-has-been-failing-for-almost-a-week-now/144744/5 "2021-03-09T14:41:53Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.