Simply.com txt record is wrong

[hagsted]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

I expected to get the requested certificate.

What did you see instead?

level=error msg="Unable to obtain ACME certificate for domains \"example.com\": unable to generate a certificate for the domains [example.com]: error: one or more domains had a problem:\n[example.com] time limit exceeded: last error: NS ns1.simply.com. returned NXDOMAIN for _acme-challenge.example.com.\n" rule="Host(`example.com`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=lets-encrypt.acme routerName=api@docker

How do you use lego?

Through Traefik

Reproduction steps

Create a docker container with TLS exposed through traefik
use simply as DNS challenge provider
Wait for a certificate to be generated.
Traefik gives an error and the cert is Null

I can get the cert if I go to my simply.com management page and change the TXT record, by removing the example.com in the name so from: _acme-challenge.example.com to: _acme-challenge

Simply.com does automatically append the domain name (example.com) to all TXT and CNAME records. Hence the record seen from the world will be _acme-challenge.example.com.example.com.
For subdomains, it will be _acme-challenge.subdomain.example.com.example.com

Hence the parent domain must not be included in the TXT record.

Version of lego

traefik 2.6 (lego v4.6.0)

Logs

level=error msg="Unable to obtain ACME certificate for domains \"example.com\": unable to generate a certificate for the domains [example.com]: error: one or more domains had a problem:\n[example.com] time limit exceeded: last error: NS ns1.simply.com. returned NXDOMAIN for _acme-challenge.example.com.\n" rule="Host(`example.com`)" ACME CA="https://acme-v02.api.letsencrypt.org/directory" providerName=lets-encrypt.acme routerName=api@docker

Go environment (if applicable)

$ go version && go env
# paste output here

[ldez]

hello,

NXDOMAIN means Non eXistent DOMAIN, so your domain example.com is nonexistent, can you check your domain records (A record)?

[ldez]

FYI lego already creates a record based on the subdomain _acme-challenge, if lego creates an entry _acme-challenge.example.com. it means that the SOA call to detect the authoritative zone returns something unexpected.

This can be a sign of a network problem (local DNS, firewall, corporate DNS, ...).

[hagsted]

Hi ldez and thanks for the reply.

When I do a dig mydomain.tld soa I get the following answer, which for me seems correct:
mydomain.tld. 1781 IN SOA ns1.simply.com. hostmaster.simply.com. 2022020401 14400 3600 1209600 3600

If I do dig mydomain.tld a I get
mydomain.tld. 10927 IN A x.x.x.x

If I do dig sub.mydomain.tld a I get

sub.mydomain.tld.	43200	IN	CNAME	mydomain.tld.
mydomain.tld.		10927	IN	A	x.x.x.x

For me this all looks correct.

If I understand the error correctly from lego (I try with the binary for linux x64) which is:
NS ns1.simply.com. returned NXDOMAIN for _acme-challenge.mydomain.tld.
It cannot find the host _acme-challenge.mydomain.tld. in my DNS, this I fully understand as the value created by lego in my DNS is _acme-challenge.mydomain.tld.mydomain.tld, notice the extra mydomain.tld. To me it seems like lego instead of making the txt record with hostname _acme-challenge it makes one _acme-challenge.mydomain.tld, to which simply.com automatically appends mydomain.tld, hence the double domain name.

There might be some error with my DNS settings, but I cannot find them. If you need my real domain name for further helping me, I can send it.

Again thanks for you time,
best regards Kristian

[hagsted]

Hi again ldez

I am sorry to have used you time, I found the problem, and it seems that my dig's got the right return, but that lego somehow was disturbed by maybe systemd setting resolver to 127.0.0.53:53. As you per your answer, I tried to set the resolvers to simply.com server. This worked when only using 1 server in my traefik.toml, using two for some reason did not, but that is probably an err on my side.

Best regards Kristian