For the last week, we’ve been getting SERVFAIL looking up CAA in LE staging. I’ve read a half dozen other threads on this and have learned: LE has always inspected the DNS of domains during issuance process, but only recently started treating SERVFAIL as a failure in staging. The problem is almost…

You might suggest, “just skip staging and go to production since production doesnt have this checking.” I don’t believe that’s feasible. Production will have this SERVFAIL logic soon if it doesn’t already and we need to our code to be prepared. Furthermore, we absolutely depend on issuing against …

Hi @lancedolan , You might want to try https://unboundtest.com/ or the source code for that tool, linked from that page. This is a version of the same resolver that the Let’s Encrypt CA itself uses.

[image] schoen: . This is a version of the same resolver that the Let’s Encrypt CA itself uses. I found that tool in a separate thread actually, but it is a user interface and not a service API that I'm confident I can integrate into our production system. I could probably observe the request…

There’s a slight chance of divergences between the behavior of that source code and the behavior of the CA, but there aren’t intended to be any such divergences; if you find any, you can report them to @jsha , who would likely be able to get them straightened out by changing the behavior of one side …

[image] lancedolan: You might suggest, “just skip staging and go to production since production doesnt have this checking.” It sounds like you may have read some old threads and gotten an incorrect impression. Let's Encrypt now treats CAA SERVFAIL as preventing issuance on both production and…

[image] lancedolan: The reason this is crucial is that every attempt is a SAN containing 100 domains, so if one fails, they all fail. Why do you aggregate the domains at all? Are these subdomains of a given domain or distinct domains?

SERVFAIL looking up CAA: How to detect AHEAD of time?

Issuance Tech

bytecamp October 30, 2017, 12:14pm 7

Why do you aggregate the domains at all? Are these subdomains of a given domain or distinct domains?

Malformed request message, challenge is not pending?

Topic		Replies	Views
SERVFAIL only on staging environment Help	4	909	November 21, 2018
False CAA failure when issuing certs Issuance Tech	34	4318	July 10, 2018
SERVFAIL looking up CAA - prevent the case Help	2	668	February 3, 2021
Spurious CAA SERVFAIL responses during finalize Help	39	1929	December 5, 2023
Renewal problem: SERVFAIL looking up CAA Help	19	3753	April 18, 2017

SERVFAIL looking up CAA: How to detect AHEAD of time?

Related topics