What DNS servers are used for the HTTP challenge

Help
1

Hi all,

I have seen a few useful topics here indicating that LetsEncrypt uses the authoritative DNS servers for the DNS challenge. Can anyone confirm if this is also the case for the HTTP challenge?
I've read the HTTP challenge is done from multiple network perspectives, but do are these locations using the authoritative DNS server for the initial lookup?

thanks!

2

Yes, all DNS requests, including for the http-01 challenge, are made recursively from the ACME validation server using the Unbound DNS resolver library.

I'm not a 100 % certain, but I believe so.

3 Likes
3

Yes. From multiple places, Let's Encrypt's validation systems look for your authoritative DNS servers (working up from the DNS root servers), ask them for your A & AAAA records, and then connect to the servers listed there via HTTP (trying the AAAA record first if it exists).

6 Likes
4

That's awesome. Thank you both for your replies!

3 Likes