SERVFAIL looking up A for build.ascend4.org

[mnordhoff]

@jdpipe

So I understand from what you say that my DNS provider is timing out when a CAA record is requested, but instead it should be reporting that there is no CAA record for my domain (and hence that it is allowed for letsencrypt to issue a certificate for this domain). Is that right?

Just about. In another thread, @LeonA recently found that it sort of works (over TCP, which ordinary resolvers won't use without reason, so it doesn't help), there are more details from Let's Encrypt, and it seems to be actually working right... sometimes.

DNS problem: query timed out looking up CAA (using Netregistry)

W…