SERVFAIL looking up CAA on subdomain

[igorosabel]

Hi!

I have a VPS server that hosts 4 domains and many subdomains (quite a lot for my experiments ) and I have set up Let’s Encrypt certificates for most of them.

But I have just created a new subdomain and when I try to put a certificate on it fails.

My domain is: http://apitpv.osumi.es

I’m using Plesk 17.8.11 to manage all my domains/subdomains and to create Let’s Encrypt certificates.

It produced this output:

Invalid response from https://acme-v01.api.letsencrypt.org/acme/authz/125cwEO1_-KKqGiO2BobQ2jqXdRKnR3zetMcfc5-FXc.
Details:
Type: urn:acme:error:dns
Status: 400
Detail: DNS problem: SERVFAIL looking up CAA for apitpv.osumi.es

My web server is (include version): 2.4.10-10+deb8u12 as shown by dpkg

The operating system my web server runs on is (include version): Debian 8

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk Onyx 17.8.11

I’ve tried doing dig and it shows NOERROR:

 dig @dns1.canaldominios.com apitpv.osumi.es CAA

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> @dns1.canaldominios.com apitpv.osumi.es CAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42413

Any help would be appreciated.

Thanks!!

iñigo

[mnordhoff]

For me (and DNSViz), the domain’s nameservers are returning SERVFAIL for a CAA query for that name. Among other issues which may or may not cause resolution to fail.

http://dnsviz.net/d/apitpv.osumi.es/WunMiA/dnssec/

$ dig +norecurse @dns1.canaldominios.com apitpv.osumi.es caa

; <<>> DiG 9.10.3-P4-Ubuntu <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37054
;; flags: qr aa ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es.               IN      CAA

;; ANSWER SECTION:
apitpv.osumi.es.        3600    IN      CNAME   osumi.es.

;; AUTHORITY SECTION:
osumi.es.               3600    IN      SOA     dns1.canaldominios.com. dns.canaldominios.com. 1 7200 1800 151200 3600

;; Query time: 109 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 14:37:38 UTC 2018
;; MSG SIZE  rcvd: 109

[igorosabel]

Thanks for the fast reply.

I’ve typed your same command and I get NOERROR, how can it be possible?

dig +norecurse @dns1.canaldominios.com apitpv.osumi.es caa

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28956
;; flags: qr aa ad; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es.               IN      A

;; ANSWER SECTION:
apitpv.osumi.es.        3600    IN      CNAME   osumi.es.
osumi.es.               3600    IN      A       37.59.239.108

;; AUTHORITY SECTION:
osumi.es.               3600    IN      NS      dns1.canaldominios.com.
osumi.es.               3600    IN      NS      dns2.canaldominios.com.
osumi.es.               3600    IN      NS      dns3.canaldominios.com.
osumi.es.               3600    IN      NS      dns4.canaldominios.com.

;; Query time: 28 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 16:53:59 CEST 2018
;; MSG SIZE  rcvd: 156

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 1775
;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;caa.                           IN      A

;; Query time: 27 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 16:54:00 CEST 2018
;; MSG SIZE  rcvd: 21

The most annoying thing is that I have already 20 or 30 domains with a Let’s Encrypt certificate in the same server and they didn’t fail. For example https://board.osumi.es/ or https://game.osumi.es/ (or even the main site https://osumi.es/ )

Thanks!

[mnordhoff]

You’re using an older version of dig that doesn’t know what CAA records are, so it did something different: It looked up the A record for apitpv.osumi.es. and then the A record for “caa.”.

Try:

dig +norecurse @dns1.canaldominios.com apitpv.osumi.es type257

(dig can send queries for types it doesn’t support. 257 is the code for CAA. If it gets a positive response, the records are displayed in an encoded, non-human-readable format, but you know they’re there.)

[igorosabel]

You’re right, now I see the SERVFAIL response:

dig +norecurse @dns1.canaldominios.com apitpv.osumi.es type257

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es type257
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16695
;; flags: qr aa ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es.               IN      TYPE257

;; ANSWER SECTION:
apitpv.osumi.es.        3600    IN      CNAME   osumi.es.

;; AUTHORITY SECTION:
osumi.es.               3600    IN      SOA     dns1.canaldominios.com. dns.canaldominios.com. 1 7200 1800 151200 3600

;; Query time: 24 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 17:21:58 CEST 2018
;; MSG SIZE  rcvd: 109

But if I try it with game.osumi.es it also fails with the same response, so, how can it be working?

Thanks!

[mnordhoff]

I’m not sure.

It may have worked a few hours ago. It may work in some locations.

With luck, if a resolver queries a type that works first, it will cache the CNAME response, and then only make a CAA query for osumi.es. itself, which doesn’t fail.

[sahsanu]

Hola @igorosabel,

You should open a support ticket to ACENS and explain them what is happening when trying to get a non existent CAA record for a subdomain that has already defined a CNAME record. Meanwhile… if you can add CAA records you could try to add a CAA record for your subdomain and try again (there is no need to remove the CNAME, just add the CAA record).

apitpv.osumi.es. CAA 0 issue "letsencrypt.org"

Buena suerte

Un saludo,
sahsanu