# SERVFAIL looking up CAA for {domain} **URL:** \ **Category:** Help\ **Created:** [November 11, 2017, 10:27am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098 "2017-11-11T10:27:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![marcel24](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@marcel24](https://community.letsencrypt.org/u/marcel24)\ **Post date:** [November 11, 2017, 10:27am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/1 "2017-11-11T10:27:25Z")
Im trying to add a certificate to a website: **My domain is:** [http://editor.fotoalbums-maken.nl](http://editor.fotoalbums-maken.nl) **I ran this command:** n -\> 1 -\> 9 -\> 4 so: Create new certificate -\> Single binding of an IIS site -\> [editor.fotoalbums-maken.nl](http://editor.fotoalbums-maken.nl) -\> Create temporary application in IIS **It produced this output:** Authorization result: invalid ACME server reported type urn:acme:error:connection ACME server reported type detail DNS problem: SERVFAIL looking up CAA for [editor.fotoalbums-maken.nl](http://editor.fotoalbums-maken.nl) ACME server reported status 400 **My web server is (include version):** IIS version 10.0.17393.0 **The operating system my web server runs on is (include version):** Windows server 2016 standard **I can login to a root shell on my machine (yes or no, or I don’t know):** yes **I’m using a control panel to manage my site (no, or provide the name and version of the control panel):** no **other:** It works for other domains on the same server. This site has multiple bindings from different domains Thanks! ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [November 11, 2017, 7:07pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/2 "2017-11-11T19:07:18Z")
Hi @marcel, Seems you are suffering this [PowerDNS bug](https://community.letsencrypt.org/t/caa-servfail-changes/38298/2?u=jsha) but it is strange because it only affects to PowerDNS versions 4.0.3 and below and seems the DNS servers you are using for your domain are version 4.0.4. ``` $ dig fotoalbums-maken.nl ns +short ns1.as31731.net. ns2.as31731.net. $ dig @ns1.as31731.net version.bind ch txt +short "PowerDNS Authoritative Server 4.0.4 (built Jun 22 2017 20:08:49 by root@6454203fd461)" $ dig @ns2.as31731.net version.bind ch txt +short "PowerDNS Authoritative Server 4.0.4 (built Jun 22 2017 20:08:49 by root@6454203fd461)" ``` But the error seems exactly the same as for versions 4.0.3 and below. If you check it on [unboundtest.com](https://unboundtest.com/m/CAA/editor.fotoalbums-maken.nl/LJ25K6DG) page you will see this error… `debug: NODATA response failed to prove NODATA status with NSEC/NSEC3` So seems PowerDNS is not signing the answer when there is no record defined (in this case CAA record for `editor.fotoalbums-maken.nl` domain). I don’t use PowerDNS with DNSSEC so I can’t help here but maybe you need to use `pdnsutil rectify-zone` command to solve this issue or maybe the fastest way to solve the issue is adding a CAA record to your domain, if the base problem is the PowerDNS bug, then your server won’t send an empty not signed response but will send a signed response. Just in case, this [site](https://sslmate.com/caa/) helps to know what is the data you need to add to a CAA record for your domain… that is basically this: `editor.fotoalbums-maken.nl. CAA 0 issue "letsencrypt.org"` Good luck, sahsanu ---
**Author:** ![marcel](https://avatars.discourse-cdn.com/v4/letter/m/71e660/32.png) [@marcel](https://community.letsencrypt.org/u/marcel)\ **Post date:** [November 11, 2017, 7:28pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/3 "2017-11-11T19:28:46Z")
Hi, Thats not one of my domains… ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [November 11, 2017, 7:32pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/4 "2017-11-11T19:32:45Z")
> [@marcel](#): > > Thats not one of my domains… Sorry but I don't know what you mean. ---
**Author:** ![marcel24](https://avatars.discourse-cdn.com/v4/letter/m/a88e4f/32.png) [@marcel24](https://community.letsencrypt.org/u/marcel24)\ **Post date:** [November 11, 2017, 7:44pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/6 "2017-11-11T19:44:12Z")
@marcel and @marcel24 are not the same person! Thanks, i will try adding the CAA record! ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [November 11, 2017, 7:48pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/7 "2017-11-11T19:48:36Z")
@marcel, sorry, I didn’t see that I wrote marcel instead of marcel24. @marcel24, thanks, your nick names are too close 😉 ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [December 11, 2017, 7:48pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-domain/46098/8 "2017-12-11T19:48:39Z")
Closed on December 11, 2017, 7:48pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.