# SERVFAIL looking up CAA on subdomain

**URL:** <https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953>\
**Category:** Help\
**Created:** [May 2, 2018, 2:27pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953 "2018-05-02T14:27:41Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![igorosabel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/igorosabel/32/22896_2.png) [@igorosabel](https://community.letsencrypt.org/u/igorosabel)\
**Post date:** [May 2, 2018, 2:27pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/1 "2018-05-02T14:27:41Z")

</div>

Hi!

I have a VPS server that hosts 4 domains and many subdomains (quite a lot for my experiments 😛 ) and I have set up Let’s Encrypt certificates for most of them.

But I have just created a new subdomain and when I try to put a certificate on it fails.

My domain is: [http://apitpv.osumi.es](http://apitpv.osumi.es)

I’m using Plesk 17.8.11 to manage all my domains/subdomains and to create Let’s Encrypt certificates.

It produced this output:

```
Invalid response from https://acme-v01.api.letsencrypt.org/acme/authz/125cwEO1_-KKqGiO2BobQ2jqXdRKnR3zetMcfc5-FXc.
Details:
Type: urn:acme:error:dns
Status: 400
Detail: DNS problem: SERVFAIL looking up CAA for apitpv.osumi.es

```

My web server is (include version): 2.4.10-10+deb8u12 as shown by dpkg

The operating system my web server runs on is (include version): Debian 8

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Plesk Onyx 17.8.11

I’ve tried doing dig and it shows NOERROR:

```
 dig @dns1.canaldominios.com apitpv.osumi.es CAA

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> @dns1.canaldominios.com apitpv.osumi.es CAA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 42413

```

Any help would be appreciated.

Thanks!!

iñigo

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 2, 2018, 2:42pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/2 "2018-05-02T14:42:32Z")

</div>

For me (and DNSViz), the domain’s nameservers are returning `SERVFAIL` for a `CAA` query for that name. Among other issues which may or may not cause resolution to fail.

[http://dnsviz.net/d/apitpv.osumi.es/WunMiA/dnssec/](http://dnsviz.net/d/apitpv.osumi.es/WunMiA/dnssec/)

```
$ dig +norecurse @dns1.canaldominios.com apitpv.osumi.es caa

; <<>> DiG 9.10.3-P4-Ubuntu <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 37054
;; flags: qr aa ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es. IN CAA

;; ANSWER SECTION:
apitpv.osumi.es. 3600 IN CNAME osumi.es.

;; AUTHORITY SECTION:
osumi.es. 3600 IN SOA dns1.canaldominios.com. dns.canaldominios.com. 1 7200 1800 151200 3600

;; Query time: 109 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 14:37:38 UTC 2018
;; MSG SIZE rcvd: 109
```

---

<div class="post-metadata">

**Author:** ![igorosabel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/igorosabel/32/22896_2.png) [@igorosabel](https://community.letsencrypt.org/u/igorosabel)\
**Post date:** [May 2, 2018, 2:59pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/3 "2018-05-02T14:59:10Z")

</div>

Thanks for the fast reply.

I’ve typed your same command and I get NOERROR, how can it be possible?

```
dig +norecurse @dns1.canaldominios.com apitpv.osumi.es caa

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es caa
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 28956
;; flags: qr aa ad; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es. IN A

;; ANSWER SECTION:
apitpv.osumi.es. 3600 IN CNAME osumi.es.
osumi.es. 3600 IN A 37.59.239.108

;; AUTHORITY SECTION:
osumi.es. 3600 IN NS dns1.canaldominios.com.
osumi.es. 3600 IN NS dns2.canaldominios.com.
osumi.es. 3600 IN NS dns3.canaldominios.com.
osumi.es. 3600 IN NS dns4.canaldominios.com.

;; Query time: 28 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 16:53:59 CEST 2018
;; MSG SIZE rcvd: 156

;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 1775
;; flags: qr ad; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;caa. IN A

;; Query time: 27 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 16:54:00 CEST 2018
;; MSG SIZE rcvd: 21

```

The most annoying thing is that I have already 20 or 30 domains with a Let’s Encrypt certificate in the same server and they didn’t fail. For example [https://board.osumi.es/](https://board.osumi.es/) or [https://game.osumi.es/](https://game.osumi.es/) (or even the main site [https://osumi.es/](https://osumi.es/) )

Thanks!

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 2, 2018, 3:04pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/4 "2018-05-02T15:04:34Z")

</div>

You’re using an older version of `dig` that doesn’t know what `CAA` records are, so it did something different: It looked up the `A` record for `apitpv.osumi.es.` and then the `A` record for “`caa.`”.

Try:

```
dig +norecurse @dns1.canaldominios.com apitpv.osumi.es type257

```

(`dig` can send queries for types it doesn’t support. 257 is the code for `CAA`. If it gets a positive response, the records are displayed in an [encoded, non-human-readable format](https://tools.ietf.org/html/rfc3597), but you know they’re there.)

---

<div class="post-metadata">

**Author:** ![igorosabel](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/igorosabel/32/22896_2.png) [@igorosabel](https://community.letsencrypt.org/u/igorosabel)\
**Post date:** [May 2, 2018, 3:25pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/5 "2018-05-02T15:25:04Z")

</div>

You’re right, now I see the SERVFAIL response:

```
dig +norecurse @dns1.canaldominios.com apitpv.osumi.es type257

; <<>> DiG 9.9.5-9+deb8u6-Debian <<>> +norecurse @dns1.canaldominios.com apitpv.osumi.es type257
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 16695
;; flags: qr aa ad; QUERY: 1, ANSWER: 1, AUTHORITY: 1, ADDITIONAL: 0

;; QUESTION SECTION:
;apitpv.osumi.es. IN TYPE257

;; ANSWER SECTION:
apitpv.osumi.es. 3600 IN CNAME osumi.es.

;; AUTHORITY SECTION:
osumi.es. 3600 IN SOA dns1.canaldominios.com. dns.canaldominios.com. 1 7200 1800 151200 3600

;; Query time: 24 msec
;; SERVER: 82.194.64.50#53(82.194.64.50)
;; WHEN: Wed May 02 17:21:58 CEST 2018
;; MSG SIZE rcvd: 109

```

But if I try it with game.osumi.es it also fails with the same response, so, how can it be working?

Thanks!

---

<div class="post-metadata">

**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\
**Post date:** [May 2, 2018, 3:28pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/6 "2018-05-02T15:28:54Z")

</div>

I’m not sure.

It may have worked a few hours ago. It may work in some locations.

With luck, if a resolver queries a type that works first, it will cache the `CNAME` response, and then only make a `CAA` query for `osumi.es.` itself, which doesn’t fail.

---

<div class="post-metadata">

**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\
**Post date:** [May 2, 2018, 3:38pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/7 "2018-05-02T15:38:05Z")

</div>

Hola @igorosabel,

You should open a support ticket to ACENS and explain them what is happening when trying to get a non existent CAA record for a subdomain that has already defined a CNAME record. Meanwhile… if you can add CAA records you could try to add a CAA record for your subdomain and try again (there is no need to remove the CNAME, just add the CAA record).

`apitpv.osumi.es.	CAA	0 issue "letsencrypt.org"`

Buena suerte 😉

Un saludo,  
sahsanu

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [June 1, 2018, 3:50pm UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa-on-subdomain/60953/8 "2018-06-01T15:50:39Z")

</div>

Closed on June 1, 2018, 3:50pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.