AutoSSL states domain is unmanaged, but DNS can be queried from the server.

Symptoms

When AutoSSL runs, it is unable to issue an SSL because of the following:

CONFIG_TEXT:  ERROR “example.com” is unmanaged. Verify this domain’s registration and authoritative nameserver configuration to correct this problem. 

However, you are able to perform a DNS lookup using tools like dig:

# dig example.com A +short
203.0.113.2 

Cause

AutoSSL requires an authoritative response from the root nameservers in order to issue an SSL certificate. If the server's network has any sort of DNS caching, dnsmasq, or other service that proxies DNS traffic, it could result in a non-authoritative response.

Resolution

You can verify if you are using most proxies by attempting the following:

#  dig @8.8.8.8 version.bind CHAOS TXT +short

If you have a proxy, cache, or any other network service filtering DNS traffic, the name or some indication of the service should be reported by the above command.