Repository navigation
Detect when ns1.example.com has the record but ns{2,3...}.example.com don't #27
Description
Activity
This sounds like a good idea, but I'm not sure how we could reliably check if the name servers are out of sync.
We could just directly query any name servers for the acme text records and check if they match, but this will be happening many minutes (and potential attempts) after someone has been having problems while issuing a certificate. My initial thought is this is most likely going to be outside any replication period, so I don't know if there is any reliable signal this info would provide (apart from if a nameserver is not replicating at all). I'll look at how reliable this could be and see if I can add something in the verbose information as an FYI in the next few days. Not sure if there is any way to neatly work Let's Debug into the issuance process where the dns records would be updated, so don't think it could be a real warning. Definitely welcome any thoughts/ideas you have though!
The only other way we could do this would be to perform some recursive lookups outside libunbound and check the serial number from the soa records to see if they match. Implementing our own recursive resolver external to unbound would be a big task though, so I don't think it's something we will look at. If someone else wants to take a crack at this though we would definitely welcome any pull requests. That said, would probably still need to be extra info in the verbose section because the text records could be matching, but another dns change has taken place that hasn't replicated so the serial doesn't match.
- added a commit that references this issue
on Dec 21, 2021 Few thoughts after looking into this,
- Not sure it's worth following CNAME entries to check those records, currently just shows info that this setup isn't supported for this checker.
- A notice (in the verbose info) is displayed if there is no TXT entries for _acme-challenge, but noting that this isn't an issue per se, because it's possible that an acme client cleans up after itself
- Should something be displayed if there is multiple TXT entries?
There's an uncommon but painful issue where nameserver replication hasn't completed yet, because maybe the nameservers mirror as a scheduled task and it hasn't run yet. We usually see that as something like
example.comhaving nameservers listed asns1andns2.example.com, and while the TXT record (or CNAME delegation) exists inns1, it hasn't appeared inns2yet. Since Unbound randomly chooses the nameserver, there's then a 50/50 chance of failure.It'd be great if letsdebug could query each nameserver and raise the issue of them being out-of-sync.