# SERVFAIL looking up CAA for jbh1.i2rs.nl , even when done numerous times

**URL:** <https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984>\
**Category:** Help\
**Created:** [January 18, 2021, 8:51am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984 "2021-01-18T08:51:45Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 18, 2021, 8:51am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/1 "2021-01-18T08:51:45Z")

</div>

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: i2rs.nl

I ran this command: (even in a loop but to no avail) certbot certonly --nginx --dry-run -d "jbh1.i2rs.nl"

It produced this output:

; \<\<\>\> DiG 9.11.3-1ubuntu1.13-Ubuntu \<\<\>\> -t caa i2rs.nl  
;; global options: +cmd  
;; Got answer:  
;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 22159  
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:  
; EDNS: version: 0, flags:; udp: 65494  
;; QUESTION SECTION:  
;i2rs.nl. IN CAA

;; Query time: 0 msec  
;; SERVER: 127.0.0.53#53(127.0.0.53)  
;; WHEN: Sun Jan 17 11:20:36 CET 2021  
;; MSG SIZE rcvd: 36

root@h1-ub18-jbh:~# certbot certonly --nginx --dry-run -d 'jbh1.i2rs.nl'  
Saving debug log to /var/log/letsencrypt/letsencrypt.log  
Plugins selected: Authenticator nginx, Installer nginx  
Simulating a certificate request for jbh1.i2rs.nl  
Performing the following challenges:  
http-01 challenge for jbh1.i2rs.nl  
Waiting for verification...  
Challenge failed for domain jbh1.i2rs.nl  
http-01 challenge for jbh1.i2rs.nl  
Cleaning up challenges  
Some challenges have failed.

IMPORTANT NOTES:

- The following errors were reported by the server:

My web server is (include version): ningx 1.14.0

The operating system my web server runs on is (include version): ubuntu 18.04

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): snap certbot 1.11.0 889

IMPORTANT NOTES:

- The following errors were reported by the server:

Detail: DNS problem: SERVFAIL looking up CAA for jbh1.i2rs.nl - the

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 18, 2021, 10:21am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/2 "2021-01-18T10:21:32Z")

</div>

Hi @kwoot

> [@kwoot](#):
>
> Domain: jbh1.i2rs.nl  
> Type: dns  
> Detail: DNS problem: SERVFAIL looking up CAA for jbh1.i2rs.nl - the  
> domain's nameservers may be malfunctioning

looks like

- your dns configuration is buggy (and)
- my tool [https://check-your-website.server-daten.de/?q=jbh1.i2rs.nl](https://check-your-website.server-daten.de/?q=jbh1.i2rs.nl) has a small bug, so it's buggy too.

First, rechecked with Unboundtest (same as Letsencrypt uses) - same result: Servfail. [https://unboundtest.com/m/CAA/jbh1.i2rs.nl/ZXP2DL6F](https://unboundtest.com/m/CAA/jbh1.i2rs.nl/ZXP2DL6F)

> validate(nodata): sec\_status\_bogus

Same result with a local Unbound version:

> [1610963311] libunbound[22428:0] info: validate(nodata): sec\_status\_bogus  
> jbh1.i2rs.nl. has no CAA record (BOGUS (security failure))  
> validation failure \<jbh1.i2rs.nl. CAA IN\>: nodata proof failed from 2001:678:76c:167:53::10 and 178.251.195.254

But there - [https://check-your-website.server-daten.de/?q=jbh1.i2rs.nl](https://check-your-website.server-daten.de/?q=jbh1.i2rs.nl) - all is green.

But:

- You have a wildcard `*.i2rs.nl A 159.65.192.235`
- You have an explicit A: `jbh1.i2rs.nl A 148.251.150.51`

So the domain name `jbh1.i2rs.nl` exists in your zone.

But checking CAA there is a Not-Existing-proof:

> CAA-Query sends a valid NSEC3 RR as result with the hashed query name "dk9hekuqpi76428gr717cruqa3ahcjf6" between the hashed NSEC3-owner "cvdcv3m6sf75di9skda6nrh88kodshtr" and the hashed NextOwner "f00277a6phmt990ts4m9lv6a18970ni2". So the zone confirmes the not-existence of that CAA RR.

That NSEC3 is wrong. Same with the not existing AAAA.

Is your DNSSEC zone definition up to date? Recalculate your zone.

---

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 18, 2021, 10:44am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/3 "2021-01-18T10:44:02Z")

</div>

Thank you!  
I added a CAA record for jbh1.i2rs.nl and now a dry-run works!  
But I still not understand why I had to add a CAA record specific for this host when the certbot docs say it's not mandatory.  
Regards, Jeroen

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 18, 2021, 10:51am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/4 "2021-01-18T10:51:44Z")

</div>

> [@kwoot](#):
>
> But I still not understand why I had to add a CAA record specific for this host when the certbot docs say it's not mandatory.

That's expected.

- You use DNSSEC
- Your DNSSEC implementation is buggy
- The bug isn't visible if a CAA exists (then the CAA is sent back with a signing RRSIG)
- The bug is visible if you don't have a CAA, then a NoData/NotExisting-proof is required. You have an A-record -\> so it must be a NoData-proof -\> but you send a NotExisting-proof -\> that's your buggy system

Your system says:

`jbh1.i2rs.nl` exists and doesn't exist -\> bogus.

---

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 18, 2021, 11:13am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/5 "2021-01-18T11:13:23Z")

</div>

Hi,

I do not see any DNSKEY records, and my only way to manage my zone file is through a web interface.  
and dig DNSKEY i2rs.nl. +multiline is emtpy.  
So how do you see I use DNSSEC? That way I can contact my DNS providers support department.

Kind regards,  
Jeroen Baten

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 18, 2021, 11:28am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/6 "2021-01-18T11:28:47Z")

</div>

> [@kwoot](#):
>
> So how do you see I use DNSSEC?

Your parent zone has a DS -\> you use DNSSEC:

> dig DS i2rs.nl.

shows your DS, same with DNSKEY.

Or use online tools, then you see a lot of results.

---

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 19, 2021, 9:00am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/7 "2021-01-19T09:00:09Z")

</div>

Funny. When I do dig DS i2rs.nl I see nothing. It could be that the DNS provider had an error. Could you please recheck and confirm that I still have a DS?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 19, 2021, 9:22am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/8 "2021-01-19T09:22:30Z")

</div>

> [@kwoot](#):
>
> Could you please recheck and confirm that I still have a DS?

You have one and your configuration is buggy. Looks like you use a not working DNS.

Please use online tools.

> :~$ dig DS i2rs.nl.
> 
> ; \<\<\>\> DiG 9.11.3-1ubuntu1.11-Ubuntu \<\<\>\> DS i2rs.nl.  
> ;; global options: +cmd  
> ;; Got answer:  
> ;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 14255  
> ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
> 
> ;; OPT PSEUDOSECTION:  
> ; EDNS: version: 0, flags:; udp: 512  
> ;; QUESTION SECTION:  
> ;i2rs.nl. IN DS
> 
> ;; ANSWER SECTION:  
> i2rs.nl. 3600 IN DS 57517 8 2 9B99CAF6CD9D1A76295CEA22AE84A80C71F034B207808899FEE1D248 09457145
> 
> ;; Query time: 21 msec  
> ;; SERVER: 192.168.0.1#53(192.168.0.1)  
> ;; WHEN: Tue Jan 19 10:20:25 CET 2021  
> ;; MSG SIZE rcvd: 84

---

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 19, 2021, 10:01am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/9 "2021-01-19T10:01:49Z")

</div>

This is so weird!  
One query from my own Ubuntu 20.04 desktop system and one directed at the NS of my DNS provider:

Why do you see a DS and I don't?

$ dig DS i2rs.nl.

; \<\<\>\> DiG 9.16.1-Ubuntu \<\<\>\> DS i2rs.nl.  
;; global options: +cmd  
;; Got answer:  
;; -\>\>HEADER\<\<- opcode: QUERY, status: SERVFAIL, id: 57411  
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:  
; EDNS: version: 0, flags:; udp: 65494  
;; QUESTION SECTION:  
;i2rs.nl. IN DS

;; Query time: 0 msec  
;; SERVER: 127.0.0.53#53(127.0.0.53)  
;; WHEN: di jan 19 10:57:54 CET 2021  
;; MSG SIZE rcvd: 36

$ dig @ns.argewebhosting.nl -t DS i2rs.nl.

; \<\<\>\> DiG 9.16.1-Ubuntu \<\<\>\> @ns.argewebhosting.nl -t DS i2rs.nl.  
; (1 server found)  
;; global options: +cmd  
;; Got answer:  
;; -\>\>HEADER\<\<- opcode: QUERY, status: NOERROR, id: 40262  
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1  
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:  
; EDNS: version: 0, flags:; udp: 1232  
;; QUESTION SECTION:  
;i2rs.nl. IN DS

;; AUTHORITY SECTION:  
i2rs.nl. 3600 IN SOA ns1.argewebhosting.eu. hostmaster.argeweb.nl. 2021011800 10800 3600 604800 3600

;; Query time: 7 msec  
;; SERVER: 5.100.229.198#53(5.100.229.198)  
;; WHEN: di jan 19 10:58:24 CET 2021  
;; MSG SIZE rcvd: 112

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [January 19, 2021, 10:20am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/10 "2021-01-19T10:20:05Z")

</div>

Looks like you already worked this out?

Key tag 57517 is present in both the `nl` zone (your DS record) and in your actual zone (one of the DNSKEY records on e.g. `ns.argewebhosting.nl`).

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [January 19, 2021, 10:26am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/11 "2021-01-19T10:26:39Z")

</div>

> [@kwoot](#):
>
> Why do you see a DS and I don't?

Your local system is buggy or not completely recursive.

> dig @ns.argewebhosting.nl -t DS i2rs.nl.

may be the wrong server, you must ask the parent zone, not your zone.

---

<div class="post-metadata">

**Author:** ![kwoot](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/kwoot/32/35916_2.png) [@kwoot](https://community.letsencrypt.org/u/kwoot)\
**Post date:** [January 19, 2021, 1:15pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/12 "2021-01-19T13:15:30Z")

</div>

Sorry, I give up.  
Other work to do. Thanks everyone for your time and attention. I really appreciate it.

Regards,  
Jeroen

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [February 18, 2021, 1:15pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-for-jbh1-i2rs-nl-even-when-done-numerous-times/142984/13 "2021-02-18T13:15:43Z")

</div>

Closed on February 18, 2021, 1:15pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.