How To Troubleshoot AutoSSL SERVFAIL and Nameserver DNS Issues Make it Rain Paper

Pre-requirements

• Access to SSH or terminal for executing commands.
• Understanding of DNS records (NS, CAA, A) and server roles.

Overview of the Problem

When using the AutoSSL feature in cPanel to issue or renew SSL certificates, you may encounter DNS query errors in the AutoSSL log, such as:

WARN DNS query error (uptimestatus.page/CAA): SERVFAIL (2)

These errors typically indicate that AutoSSL cannot access the authoritative nameservers for your domain, preventing it from validating DNS CAA records required for SSL certificate issuance.

What Causes These DNS Query Errors?

• Nameservers are down or not responding.
• UDP port 53 is blocked or inaccessible.
• The server is behind NAT and misconfigured.
• A mismatch between registrar nameservers and NS records.
• Local DNS resolvers are unresponsive or misconfigured.

Step 1: Understanding Tools for DNS Troubleshooting

1. WHOIS

The whois command retrieves domain registration details, including the nameservers configured at the domain registrar.

whois example.com | grep Name

2. DIG

The dig command is a DNS lookup utility used to query nameservers for specific DNS records. It's useful for checking if DNS records are configured correctly.

dig example.com +short NS

3. NSLOOKUP

nslookup is another DNS lookup tool used to query DNS records from a specific nameserver.

nslookup example.com ns1.example.com

Step 2: Check Registered Nameservers

First, retrieve the registered nameservers using WHOIS:

whois uptimestatus.page | grep Name

This will return a list of nameservers:

Name Server: ns1.mydnsnode.com
Name Server: ns2.mydnsnode.com
Name Server: ns3.mydnsnode.com
Name Server: ns4.mydnsnode.com

Step 3: Verify NS Records

Now, use DIG to check if the nameservers match the registrar's information:

dig uptimestatus.page +short NS

If the output matches the WHOIS data, you can proceed to query the individual nameservers:

dig ns1.mydnsnode.com

This should return the IP address of the nameserver:

ns1.mydnsnode.com. IN A 34.102.101.169

Step 4: Query Nameservers Directly

To check if the nameserver responds correctly, query it directly:

dig uptimestatus.page @34.102.101.169

Ensure that you get a valid response for the A record:

uptimestatus.page. IN A 35.158.144.28

Step 5: Use +trace to Check DNS Propagation

If the above steps do not resolve the issue, use DIG with the +trace option to perform a recursive DNS lookup starting at the root nameservers:

dig +trace uptimestatus.page

This will show each step of the lookup, helping identify where the failure occurs.

Step 6: Use cPanel's Built-in DNS Debugging Tool

If you are on a cPanel server and have root access, use the following command to diagnose AutoSSL issues:

/scripts/cpdig uptimestatus.page A --verbose

This will provide detailed DNS lookup results and help identify misconfigurations.

To adjust the domain's DNS including the nameservers that delegate a DNS zone to use the specified authoritative name server, visit DNS Functions >> DNS Zone Manager.

Common Issues and Solutions

1. Nameserver Unresponsive

If querying the nameserver times out, the nameserver may be down or misconfigured. Ensure the server is running and that UDP port 53 is open for DNS traffic.

2. Mismatch Between Registrar and NS Records

If the nameservers listed at the registrar do not match the domain's actual NS records, update the NS records to match or update the registrar's nameserver settings.

3. DNS Propagation Issues

If you've recently made changes to DNS settings, wait for the TTL to expire and ensure the changes have propagated fully.

4. SSL Certificate Issues

If AutoSSL fails due to SSL issues, verify that your SSL certificate is valid, correctly chained, and not expired.

Gotchas to Avoid

• Ensure UDP port 53 is open and accessible.
• Avoid mismatches between the registrar's nameservers and the actual NS records.
• Make sure DNS propagation has been completed before troubleshooting DNS issues.
• Use a secure, recursive DNS server for AutoSSL validation.

By following these troubleshooting steps, you can resolve most DNS-related AutoSSL issues. Understanding how to use tools like WHOIS, DIG, and NSLOOKUP will help you quickly diagnose and fix issues with DNS queries and nameserver configurations. If you continue to run into the same issue, please contact our technical support team.