Two _acme-challenge dns records and letsencrypt failing with DNS problem: server failure at resolver looking up TXT for _acme-challenge

[cpu]

Hi @arek,

@arek

Are two (or more) _acme-challenge TXT records (where one is ok from letsencrypt point of view) for a domain considered invalid situation?

This is not considered an invalid situation.

@arek

Had few domains where letsencrypt failed with:

“DNS problem: server failure at resolver looking up TXT for _acme-challenge…”

exactly because there were multiple _acme-challenge TXT records

Hmm. This sounds like a problem with your authoritative DNS server. Can you share the domain name(s) that failed this way so I can check our logs? I suspect your server returned a SERVFAIL response instead of the TXT records.

@arek

IMO letsencrypt should check all _acme-challenge records and pass if one was valid.

This is the way Let's Encrypt validates DNS-01 challenges today. Boulder, the Let's Encrypt server side CA software, loops over each TXT record and considers the validation successful when one matches the expected value.

Hope this helps,