# SERVFAIL Looking up CAA **URL:** \ **Category:** Help\ **Created:** [October 27, 2020, 7:20am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa/136911 "2020-10-27T07:20:31Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ursegor890](https://avatars.discourse-cdn.com/v4/letter/u/9fc348/32.png) [@ursegor890](https://community.letsencrypt.org/u/ursegor890)\ **Post date:** [October 27, 2020, 7:20am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa/136911/1 "2020-10-27T07:20:31Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help. My domain is: 1.thr.ir.hosthorizon.xyz I ran this command: sudo certbot certonly --standalone It produced this output: Obtaining a new certificate Performing the following challenges: http-01 challenge for 1.thr.ir.hosthorizon.xyz Waiting for verification... Challenge failed for domain 1.thr.ir.hosthorizon.xyz http-01 challenge for 1.thr.ir.hosthorizon.xyz Cleaning up challenges Some challenges have failed. IMPORTANT NOTES: - The following errors were reported by the server: I can login to a root shell on my machine (yes or no, or I don't know): Yes I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot): certbot 1.9.0 ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [October 27, 2020, 7:33am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa/136911/2 "2020-10-27T07:33:44Z")
Looks like it's a DNSSEC issue: - [https://letsdebug.net/1.thr.ir.hosthorizon.xyz/339357](https://letsdebug.net/1.thr.ir.hosthorizon.xyz/339357) - [https://unboundtest.com/m/CAA/1.thr.ir.hosthorizon.xyz/V6DDN6YK](https://unboundtest.com/m/CAA/1.thr.ir.hosthorizon.xyz/V6DDN6YK) You could try creating a CAA record in your DNS to avoid your nameservers sending the bogus response ... but I think it's probably best to ask Arvan about it, so that they can fix your zone for you. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [November 26, 2020, 7:33am UTC](https://community.letsencrypt.org/t/servfail-looking-up-caa/136911/3 "2020-11-26T07:33:46Z")
Closed on November 26, 2020, 7:33am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.