root@Ubuntu-iMac-R:~# certbot --apache -d rajivverma.tplinkdns.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Renewing an existing certificate for rajivverma.tplinkdns.com
Certbot failed to authenticate some domains (authenticator: apache). The Certificate Authority reported these problems:
Domain: rajivverma.tplinkdns.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for rajivverma.tplinkdns.com - check that a DNS record exists for this domain; DNS problem: SERVFAIL looking up AAAA for rajivverma.tplinkdns.com - the domain's nameservers may be malfunctioning
Hint: The Certificate Authority failed to verify the temporary Apache configuration changes made by Certbot. Ensure that the listed domains point to this Apache server and that it is accessible from the internet.
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
root@Ubuntu-iMac-R:~#
It produced this output: Above
My web server is (include version): Apache
root@Ubuntu-iMac-R:~# apachectl -v
Server version: Apache/2.4.66 (Ubuntu)
Server built: 2026-07-06T15:33:20
root@Ubuntu-iMac-R:~#
The operating system my web server runs on is (include version): Ubuntu
root@Ubuntu-iMac-R:~# lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 26.04.1 LTS
Release: 26.04
Codename: resolute
root@Ubuntu-iMac-R:~#
My hosting provider, if applicable, is:
I can login to a root shell on my machine (yes or no, or I don't know): yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
That domain name seems broken, with some of the nameservers that are configured as the authoritative ones for the domain not thinking that they're actually authoritative, and also have other errors in the replies. You need a working domain name before you can worry about getting certificates for it.
rajivverma.tplinkdns.com/A: The Authoritative Answer (AA) flag was not set in the response. See RFC 1035, Sec. 4.1.1. (44.206.50.56, UDP_-_EDNS0_4096_D)
tplinkdns.com zone: The server(s) did not respond authoritatively for the namespace. See RFC 1035, Sec. 4.1.1. (44.206.50.56)
rajivverma.tplinkdns.com/A: The server returned a no error (NOERROR) response when queried for rajivverma.tplinkdns.com having record data of type A, but returned a name error (NXDOMAIN) when queried for rajivverma.tplinkdns.com having record data of type AAAA. See RFC 1034, Sec. 4.3.2. (44.206.50.56, 52.204.177.89, 54.87.217.253, UDP_-_EDNS0_4096_D)
You need to have whomever runs the DNS server for that domain fix their broken setup.
This used to work fine until now. I’m using the TP-Link X20 in router mode and from my end, I have a very simple configuration as shown below. I haven’t made any changes to the configuration for a long time and the certificate has been renewing automatically without any issues until now.
It seems that other users have experienced a similar issue. I came across the discussion below, which was closed, but unfortunately, it doesn’t provide any details on what was done to resolve the issue.
I’ve reached out to TP-Link Support, and they’ve logged a case. Let’s see if they can come back with their analysis and provide a solution.
I don't know anything about TP-Link, and it may very well be that their systems used to work better, or that they work well enough some of the time. But from what I can tell, that domain name has a very broken setup, and getting a certificate for it would be the least of my concerns if I were using it.
You are using apt. That will most assuredly NOT be the latest. Version 4.0.0 is over a year out of date.
You can see supported installation methods that are kept up to date here: Certbot Instructions
If, like me, you don't relish the idea of installing snaps on your server, it's not too difficult to move to a pip version and keep it updated with cron.
Hopefully your TP-Link ticket leads to them fixing their nameservers.
