TXT Record Needs Modification

[Olliedawg]

I have a few domains registered with 123reg. I generate lets encrypt wildcard SSL certificates for these every 3 months using the win acme client, using the DNS-01 challenge which require the _acme.challenge txt record for verification.

 

I've done one of my domains, however for my last one (and the most important one), I cannot seem to get the txt record to propagate anywhere. I've waited over 24hrs & still nothing. The only TXT record I can see is the SPF one.

 

Been using these sites to check records : Dig web interface - online dns lookup tool and Check DNS results from Unbound (unboundtest.com)

 

I've contacted 123reg & they told me to delete the record & re-add it.. done that this morning at 10AM. Just checked now & still nothing, just the SPF!

 

Any ideas anyone before I call 123reg again

 

coincidently, our wildcard ssl certificate recently expired for this domain which was purchased through 123reg. I stopped the renewal as i'd rather save the £299 per year & generate my own. hmmmmmm.

Edited August 30, 2024 by 6Foot2

[dmj]

query the 123reg server directly using dig/nslookup. Is the TXT record there? If it exists and just isn't propagating then it's 123reg's issue.

 

It sounds like you are doing this manually? this needs to be automated.

[Olliedawg]

query the 123reg server directly using dig/nslookup. Is the TXT record there? If it exists and just isn't propagating then it's 123reg's issue.

 

It sounds like you are doing this manually? this needs to be automated.

 

my nameservers on 123reg are " ns05.domaincontrol.com & ns06.domaincontrol.com "

Just tried " nslookup -q=txt mydomain.org.uk ns05.domaincontrol.com "

 

Can't see the txt record! Only the SPF one again. I'll give them another ring tomorrow

 

Yes I have been doing it manually the past two renewals. I don't have many services utilizing the certificates (two internal webpages & exchange server) so it's not a massive job, but yes I do need to look at automating it. I was led to believe that you couldn't automate the wildcard certificates?

[dmj]

Sounds like the api or web interface you are using might be broken if it's not even adding the record to their own nameservers.

 

I was led to believe that you couldn't automate the wildcard certificates?

nah, we use an acme system to certify hundreds of wildcard certs every year. Besides, if you only have a few you could probably just add the SAN to them.

[ZeroHour]

To be honest I would look at migrating the DNS role to Cloudflare or another larger provider. You can keep the registration with 123-reg if you want (although CF is cheaper) but just move the dns role and records across as it will be much faster updating.

[dmj]

To be honest I would look at migrating the DNS role to Cloudflare or another larger provider. You can keep the registration with 123-reg if you want (although CF is cheaper) but just move the dns role and records across as it will be much faster updating.

 

They also have a decent api for automatically creating records, firewall rules etc so it's really simple to automate.

[Olliedawg]

Thanks both will look into