DEV Community

Big Mazzy
Big Mazzy

Posted on

Fix Certbot DNS-01 Missing TXT Record on Ubuntu 24.04

#ubuntu #linux #devops #tutorial

TL;DR: Publish the TXT value Certbot gives you at the exact _acme-challenge name, confirm it on every authoritative server, then continue validation.

The problem

A DNS-01 challenge can fail even when Certbot displays a TXT value and waits for you to continue. The failure means the certificate authority could not find the required value in public DNS when it checked.

This Ubuntu 24.04 lab uses shop.example.com in a test zone. Replace the example domain and authoritative server with ones for a domain you own. The IP, PID, and session numbers in examples are placeholders where relevant.

Query the authoritative server directly:

dig +norecurse @ns1.example.com _acme-challenge.shop.example.com TXT
Enter fullscreen mode Exit fullscreen mode

The initial response has no answer records:

;; flags: qr aa; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
Enter fullscreen mode Exit fullscreen mode

Start a manual staging request:

sudo certbot certonly --manual --test-cert --preferred-challenges dns -d shop.example.com
Enter fullscreen mode Exit fullscreen mode

Complete any Certbot account prompts. When Certbot displays the challenge value, leave the request waiting. If you press Enter while the TXT record is absent, the staging validation fails.

Why it happens

Certbot’s manual DNS flow gives you a value to publish; it does not publish that value for you. The certificate authority looks up a TXT record at the challenge name, _acme-challenge.shop.example.com in this example. If the record is missing, has the wrong value, or has not reached public DNS yet, validation fails.

The record must match the current Certbot prompt exactly. An earlier challenge value, a typo, or a record entered at the wrong name will not satisfy the request. Some DNS providers append the zone name automatically, so check the final full name in the provider’s interface.

DNS-01 validation checks public DNS. It does not require an inbound web connection, so it can work behind NAT. The staging certificate used here is for testing.

Step-by-step fix

  1. Start the manual staging request and keep it waiting at the prompt: 
   sudo certbot certonly --manual --test-cert --preferred-challenges dns -d shop.example.com
Enter fullscreen mode Exit fullscreen mode
  1. In your DNS provider, create a TXT record using the exact name and the current value shown by Certbot. This illustrative test-zone entry shows the format; use the value from your live prompt: 
   Name: _acme-challenge.shop.example.com
   Type: TXT
   Value: vG7kQ2mR9xT4pN6sW1yH8cJ3dF5bL0uA_zEoIiKaBqM
Enter fullscreen mode Exit fullscreen mode

If your provider expects a relative name, enter the appropriate portion and confirm the provider has not duplicated the zone. The final full name must be _acme-challenge.shop.example.com.

  1. Check every authoritative server for the exact current value. The example query checks ns1.example.com; repeat the check through your DNS provider’s view of each authoritative server.

  2. Wait for cached negative answers to expire. Then check the authoritative server again:

   dig +norecurse @ns1.example.com _acme-challenge.shop.example.com TXT
Enter fullscreen mode Exit fullscreen mode

Continue only after the record is visible with the exact value on every authoritative server. Then return to the waiting Certbot prompt and press Enter.

How to verify

A successful authoritative query has one answer record and shows the expected TXT value:

;; flags: qr aa; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
_acme-challenge.shop.example.com. 300 IN TXT "vG7kQ2mR9xT4pN6sW1yH8cJ3dF5bL0uA_zEoIiKaBqM"
Enter fullscreen mode Exit fullscreen mode

After you continue, Certbot should complete staging validation:

Successfully received certificate.
Enter fullscreen mode Exit fullscreen mode

The answer record confirms that the authoritative server is serving the challenge value. Checking all authoritative servers matters because the certificate authority may query any of them.

Common mistakes

  • Pressing Enter before publishing the TXT record, or before it appears on all authoritative servers.
  • Reusing a value from an earlier Certbot request instead of copying the current prompt’s value.
  • Entering the record at the wrong challenge name, or letting the provider append the zone twice.
  • Assuming a successful provider save means public DNS is ready; cached negative answers can delay visibility.
  • Treating a staging certificate as suitable for production. Staging is for testing.

If you want a clean Ubuntu box to practice on, PowerVPS is a reasonable choice: https://powervps.net/?from=32

Watch more fixes on Server Lab: https://www.youtube.com/channel/UCov7rfWAnS4c2wF5E9V1Yag

Top comments (0)