Forcing certmagic to use system resolvers for propagation checks?

Help
11

@Hendrik_Visage
I think this is similar to a problem I experienced before. My default DNS resolver just wasn’t returning the TXT records in time and Caddy couldn’t verify the propagation (even though Let’s Encrypt would have been able to verify them). For me the solution was to use Cloudflare’s resolvers.

To check if this is the case with your resolver:

  1. Run Caddy so that it creates ACME DNS records.
  2. See if you can see these TXT records with your default DNS resolver in your restricted system:
    dig -t TXT _acme-challenge.sa.see.trosint.ovh.
  3. See if you can see TXT records using Cloudflare resolvers (outside your restricted system):
    dig -t TXT _acme-challenge.sa.see.trosint.ovh. @1.1.1.1

If you see the TXT records with Cloudflare but you can’t see the records with your default DNS, there’s your problem - Caddy can’t find the records because your DNS resolver can’t. If that’s the case, the only solution would be to disable propagation checks.

2 Likes