Hi team, we’re seeing issues and we’re not sure if it’s related to the incident or not. The status page says “monitoring” and that the root cause has been fixed. LE is giving us: 403 urn:acme:error:caa: Error creating new cert :: Rechecking CAA: While processing CAA for brightgen.com: DNS…

[image] kf6nux: staffs-wildlife.org.uk This could potentially be an IPv4 vs. IPv6 problem; the www subdomain has an IPv6 entry but the base domain doesn't, and the IPv6 www subdomain and the IPv4 base domain return different content in HTTP.

[image] schoen: This could potentially be an IPv4 vs. IPv6 problem; the www subdomain has an IPv6 entry but the base domain doesn’t, and the IPv6 www subdomain and the IPv4 base domain return different content in HTTP. Production Let's Encrypt legitimately can't resolve it: https://acme-v02.a…

Thanks for the reply @schoen . I can’t reproduce different content being served based upon IPv4 vs IPv6. Test I used: ~ curl staffs-wildlife.org.uk/.well-known/acme-challenge/randomtext && echo randomtext.vKGSnNTMm-njyWJQYjhmPuIovGcwxiduMtzbURl4_Yc ~ curl -4 www.staffs-wildlife.org.uk/.well-known/…

[image] _az: The last couple of days seem to have introduced some invisible hoop that nameservers need to jump through but nobody can identify This matches our experience as well.

Another one: "detail": "DNS problem: SERVFAIL looking up A for www.northarrowpartners.com",

[image] _az: That said, OP did post about this a few weeks ago, so it could just be their specific nameservers still suffering from the same problems they did in the past. It's unlikely because we don't control our customer's nameservers or DNS settings, and there are a wide range of domains …

Another: SERVFAIL looking up CAA for jrudman.com

Another 403 urn:acme:error:caa: Error creating new cert :: Rechecking CAA: While processing CAA for awhitepondparadise.com: DNS problem: query timed out looking up CAA for awhitepondparadise.com, While processing CAA for www.awhitepondparadise.com: DNS problem: query timed out looking up CAA for T…

@marktheunissen @kf6nux I went through all of the domain names shared in this thread. The majority of them all displayed problems with 0x20 case randomization. Further, there is overlap with the authoritative nameservers in use by the problematic domains. The only one I’m currently stumped by is www…

[image] marktheunissen: It’s unlikely because we don’t control our customer’s nameservers or DNS settings, and there are a wide range of domains failing on completely different servers. Did you check the authoritative DNS servers? To me it looks like there is non-trivial overlap between faili…

SERVFAIL causing issuance failures, unable to reproduce in Unbound or locally

Help

Topic		Replies	Views
CAA requests resulting in SERVFAIL since Dec 12th Help	21	1341	December 20, 2023
Spurious CAA SERVFAIL responses during finalize Help	39	1934	December 5, 2023
DNS problem - SERVFAIL for (seemingly) correctly replied names Help	38	5602	December 7, 2021
False CAA failure when issuing certs Issuance Tech	34	4332	July 10, 2018
SERVFAIL looking up CAA, but I see NOERROR myself Help	24	7417	August 8, 2017

SERVFAIL causing issuance failures, unable to reproduce in Unbound or locally

Related topics