How to Complete a Let's Encrypt DNS Challenge

Q: ### Why does DNS challenge keep failing with NXDOMAIN?

The `_acme-challenge` subdomain must be delegated to the same nameservers as the parent domain. Check that the record is created at the correct zone level. Use `dig _acme-challenge.example.com TXT +short` to verify. ### How long does DNS propagation take for challenge records? Most DNS providers propagate changes within 60 seconds. However, TTL values on the zone can delay propagation. Set the challenge record TTL to 300 seconds (5 minutes) or lower for faster validation. ### Can I get a wildcard certificate with HTTP-01 challenge? No, wildcard certificates (`*.example.com`) can only be issued using DNS-01 challenges. HTTP-01 challenges cannot validate wildcard domains because there is no single server to serve the challenge file for all subdomains.

DodaTech Updated 2026-06-24 4 min read

In this tutorial, you'll learn about How to Complete a Let's Encrypt DNS Challenge. We cover key concepts, practical examples, and best practices.

The Problem

You need a Let's Encrypt wildcard certificate (*.example.com) or your HTTP-01 challenge keeps failing because port 80 is not accessible. The DNS-01 challenge requires creating a _acme-challenge TXT record, but the process fails with DNS problem: NXDOMAIN looking up TXT for _acme-challenge.example.com.

Quick Fix

Step 1: Run Certbot with DNS Challenge

certbot certonly --manual --preferred-challenges dns -d *.example.com -d example.com
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Please deploy a DNS TXT record under the name:
# _acme-challenge.example.com
# with the following value:
# abc123def456...xyz
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Press Enter to Continue

Step 2: Create the TXT Record (Manual)

WRONG — creating the record at the wrong name:

# dig TXT _acme-challenge.example.com +short
# (empty — record was created at acme-challenge.example.com without underscore)

RIGHT — create the TXT record with the exact name and value:

# In your DNS provider's control panel:
# Type: TXT
# Name: _acme-challenge
# Value: abc123def456...xyz
# TTL: 300

Step 3: Verify the DNS Record

dig TXT _acme-challenge.example.com +short
# "abc123def456...xyz"

If the record is not visible, wait for DNS propagation and check with multiple resolvers:

dig TXT _acme-challenge.example.com @8.8.8.8 +short
# "abc123def456...xyz"

Step 4: Press Enter to Complete

# Press Enter after verifying the record
# Successfully received certificate.
# Certificate is saved at:
#   /etc/letsencrypt/live/example.com/fullchain.pem
#   /etc/letsencrypt/live/example.com/privkey.pem

Step 5: Automate with DNS Plugins

WRONG — manual renewals every 90 days:

certbot renew
# No renewals were attempted.
# (manual mode cannot be renewed automatically)

RIGHT — use a DNS plugin for automated renewals:

sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials ~/.cloudflare/credentials.ini -d *.example.com -d example.com
# Saving debug log to /var/log/letsencrypt/letsencrypt.log
# Successfully received certificate.
certbot renew --dry-run
# Congratulations, all renewals succeeded. The following certs have been renewed:
#   /etc/letsencrypt/live/example.com/fullchain.pem

Supported providers: Cloudflare, Route53, Google Cloud DNS, DigitalOcean, and more via certbot plugins.

Step 6: Clean Up the TXT Record

WRONG — leaving old challenge records in DNS permanently:

# (unused TXT records clutter the zone and may cause confusion)

RIGHT — remove the TXT record after the certificate is issued:

# In your DNS provider's control panel:
# Delete the TXT record for _acme-challenge.example.com

DodaTech's SSL Bot monitors certificate expiry and automatically triggers DNS challenges 30 days before renewal, supporting all major DNS providers.

Prevention

Use DNS plugins for automated renewal of wildcard certificates.
Set TTL to 300 seconds for challenge records.
Verify DNS propagation before pressing Enter in manual mode.
Clean up challenge records after certificate issuance.
Test renewal with certbot renew --dry-run after setup.

Common Mistakes with dns challenge

Using head and tail instead of pattern matching, causing runtime errors on empty lists
Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
Using return to exit a function early instead of wrapping a pure value in the monad

These mistakes appear frequently in real-world LETSENCRYPT code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

### Why does DNS challenge keep failing with NXDOMAIN?

The _acme-challenge subdomain must be delegated to the same nameservers as the parent domain. Check that the record is created at the correct zone level. Use dig _acme-challenge.example.com TXT +short to verify.

How long does DNS propagation take for challenge records?

Most DNS providers propagate changes within 60 seconds. However, TTL values on the zone can delay propagation. Set the challenge record TTL to 300 seconds (5 minutes) or lower for faster validation.

Can I get a wildcard certificate with HTTP-01 challenge?

No, wildcard certificates (*.example.com) can only be issued using DNS-01 challenges. HTTP-01 challenges cannot validate wildcard domains because there is no single server to serve the challenge file for all subdomains.

← Previous How to Automate Let's Encrypt Certificate Renewal with Certbot Next → How to Get a Let's Encrypt Certificate with an ECDSA Key

Built by the developers of DodaTech

Doda Browser, DodaZIP & Durga Antivirus Pro

Home Browse Quick Fix