could not determine authoritative nameservers

[zuozhehao]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

certificate application

What did you see instead?

propagation: time limit exceeded: last error: [zone=bbb.com.] could not determine authoritative nameservers

How do you use lego?

Library

Reproduction steps

1、_acme-challenge.aaa.com CNAME aaa.com.bbb.com
2、Add aaa.com.bbb.com TXT record using API

Version of lego

v4.17.4

Logs

[2024/06/19T09:28:33.935] [application] [INFO] [logger.go:48,Printf] [INFO] [aaa.com] acme: Trying to solve DNS-01  
[2024/06/19T09:28:34.216] [application] [INFO] [logger.go:48,Printf] [INFO] Found CNAME entry for "_acme-challenge.aaa.com.": "aaa.com.bbb.com."  
[2024/06/19T09:28:34.719] [application] [INFO] [logger.go:48,Printf] [INFO] [aaa.com] acme: Checking DNS record propagation. [nameservers=google-public-dns-a.google.com:53,google-public-dns-b.google.com:53]  
[2024/06/19T09:28:39.722] [application] [INFO] [logger.go:48,Printf] [INFO] Wait for propagation [timeout: 10m0s, interval: 5s]  
[2024/06/19T09:28:40.114] [application] [INFO] [logger.go:48,Printf] [INFO] [aaa.com] acme: Waiting for DNS record propagation.  
[2024/06/19T09:38:44.914] [application] [INFO] [logger.go:48,Printf] [INFO] [*.aaa.com] acme: Cleaning DNS-01 challenge  
[2024/06/19T09:38:46.254] [application] [INFO] [logger.go:48,Printf] [INFO] [aaa.com] acme: Cleaning DNS-01 challenge 
[2024/06/19T09:39:19.818] [application] [INFO] [logger.go:48,Printf] [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/365785065087  
[2024/06/19T09:39:20.204] [application] [ERROR] [service.go:64,Boot] [aaa.com     ] sign error error: one or more domains had a problem:
[*.aaa.com] propagation: time limit exceeded: last error: [zone=bbb.com.] could not determine authoritative nameservers
[aaa.com] propagation: time limit exceeded: last error: [zone=bbb.com.] could not determine authoritative nameservers

Go environment (if applicable)

$ go version && go env
go version go1.22.3 windows/amd64

[ldez]

Hello,

it's because there are no NS records.

You can check that with dig or drill:

drill example.com NS

Check also your DNS resolvers.

[zuozhehao]

; <<>> DiG 9.16.23-RH <<>> NS mydomain.online
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12848
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;mydomain.online.			IN	NS

;; AUTHORITY SECTION:
mydomain.online.		16	IN	SOA	bennett.dnspod.net. freednsadmin.dnspod.com. 1718768337 3600 180 1209600 180

;; Query time: 23 msec
;; SERVER: 10.10.10.1#53(10.10.10.1)
;; WHEN: Wed Jun 19 11:49:24 CST 2024
;; MSG SIZE  rcvd: 119

[ldez]

ANSWER: 0

As I said you have 0 NS records.

Check your DNS resolver.

$ drill yingyongjia.com NS                 
;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 29931
;; flags: qr rd ra ; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 0 
;; QUESTION SECTION:
;; yingyongjia.com.     IN      NS

;; ANSWER SECTION:
yingyongjia.com.        86400   IN      NS      elizabeth.dnspod.net.
yingyongjia.com.        86400   IN      NS      marigold.dnspod.net.

;; AUTHORITY SECTION:

;; ADDITIONAL SECTION:

;; Query time: 354 msec
;; SERVER: 2a02:842b:5a8:b601:ce19:a8ff:fe05:c8ff
;; WHEN: Wed Jun 19 05:44:23 2024
;; MSG SIZE  rcvd: 90

[ldez]

It's not a problem with lego, but with your network.
So check your local DNS, your firewall, etc.

[zuozhehao]

[root@zxis ~]# dig NS mydomain.online @a.nic.online

; <<>> DiG 9.16.23-RH <<>> NS mydomain.online @a.nic.online
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 33418
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 2, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 7160492295ff2e3b48e4bf4966726643b3dfd32a576b0de4 (good)
;; QUESTION SECTION:
;mydomain.online.			IN	NS

;; AUTHORITY SECTION:
mydomain.online.		3600	IN	NS	bennett.dnspod.net.
mydomain.online.		3600	IN	NS	willow.dnspod.net.

;; Query time: 189 msec
;; SERVER: 194.169.218.54#53(194.169.218.54)
;; WHEN: Wed Jun 19 13:01:55 CST 2024
;; MSG SIZE  rcvd: 123

I specify that the NS server has records