Was there some dns lookup failure in recent days?

[rg305]

@oseibert

Also I asked our NOC and they very much doubt that any of our DDoS rate limiting would kick in here.

@oseibert

Addendum: another try, and it mysteriously worked.

And... nobody changed nothing !
[yes, I'm a conspiracy theorist]
LOL

[oseibert]

From the next certificate which was attempted this weekend:

2022/12/17 04:11:05 [INFO] Skipping deactivating of valid auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/187639913467\n
2022/12/17 04:11:06 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/187639913477\n
2022/12/17 04:11:06 [INFO] Skipping deactivating of valid auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/187639913487\n
2022/12/17 04:11:06 [INFO] Skipping deactivating of valid auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/187639913497\n
2022/12/17 04:11:06 error: one or more domains had a problem:\n
[*.fes.sys11cloud.net] acme: error: 400 :: urn:ietf:params:acme:error:dns :: DNS problem: SERVFAIL looking up TXT for _acme-challenge.fes.sys11cloud.net - the domain's nameservers may be malfunctioning"

It needed 4 challenges. 3 of them succeeded, one failed (you can see that from the 4 auth links), blaming the name servers. However it is the same name servers in all cases. A few retries later, the 4th challenge succeeded too.

In other words: unless the error messages get made much clearer, proving exactly which name server is failing, I really don't see how the problem is on our side.

[bruncsak]

@oseibert

@bruncsak

The domain syseleven.net is part of the domain resolution chain of sys11cloud.net. Way to many name servers are involved in the name resolution, and that increases the chance of failure.

I think somebody is going to look at the dns configuration.

Sorry for insisting on that. Please fix the DNS first.