DNS Returned "SERVFAIL" and AutoSSL says domains not managed

Answered

Standifer Kilgore

• February 07, 2025 01:53
• Edited

So, I tried the "get_nameservers_for_domain("domain.com")" and received the message "DNS query failure code 2 "SERVFAIL" in response to NS records. I am new to DNS management and I feel like I'm a little over my head on this one. I have an account set up with a domain name and the web server is serving the page and is currently under self-signed SSL. I wanted to attach it to be taken care of by AutoSSL with Let's Encrypt, but when I try, I get a lot on the logs...

Log for the AutoSSL run for “oneclickpic”: Wednesday, February 5, 2025 5:36:26 PM GMT-0600 (Let’s Encrypt™)

5:36:26 PM AutoSSL’s configured provider is “Let’s Encrypt™”.

Analyzing “domain”’s domains …

5:36:26 PM Analyzing “domain.com” (website) …

5:36:26 PMERROR TLS Status: Defective

Certificate expiry: 2/5/26, 9:21 PM UTC (364.91 days from now)

ERROR Defect: OPENSSL_VERIFY: The certificate chain failed OpenSSL’s verification (0:18:DEPTH_ZERO_SELF_SIGNED_CERT).

5:36:26 PM Attempting to ensure the existence of necessary CAA records …

5:36:26 PM No CAA records were created.

5:36:26 PM Verifying 10 domains’ management status …

Verifying “Let’s Encrypt™”’s authorization on 10 domains via DNS CAA records …

5:36:50 PMWARN DNS query error (mail.domain.com/NS): SERVFAIL (2)

WARN DNS query error (cpanel.domain.com/NS): SERVFAIL (2)

WARN DNS query error (webdisk.domain.com/NS): SERVFAIL (2)

WARN DNS query error (webmail.domain.com/NS): SERVFAIL (2)

WARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “webdisk.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “cpanel.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “mail.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/NS): SERVFAIL (2)

WARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “domain.com” is unmanaged. Verify this domain’s registration and authoritative nameserver configuration to correct this problem.

5:36:50 PMWARN DNS query error (www.domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “www.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “webmail.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/NS): SERVFAIL (2)

WARN DNS query error (domain.com/NS): SERVFAIL (2)

WARN DNS query error (domain.com/NS): SERVFAIL (2)

WARN DNS query error (domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “*.domain.com” is unmanaged. Verify this domain’s registration and authoritative nameserver configuration to correct this problem.

5:36:50 PMWARN DNS query error (www.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (mail.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (webdisk.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (cpcalendars.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (webmail.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (cpcontacts.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (autodiscover.domain.com/CAA): SERVFAIL (2)

WARN DNS query error (cpcalendars.domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “cpcalendars.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (autodiscover.domain.com/NS): SERVFAIL (2)

5:36:50 PMERROR “autodiscover.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

5:36:50 PMWARN DNS query error (domain.com/CAA): SERVFAIL (2)

5:36:50 PM CA authorized: “domain.com”

CA authorized: “*.domain.com”

CA authorized: “www.domain.com”

CA authorized: “mail.domain.com”

CA authorized: “webdisk.domain.com”

CA authorized: “cpcalendars.domain.com”

CA authorized: “webmail.domain.com”

CA authorized: “cpcontacts.domain.com”

CA authorized: “autodiscover.domain.com”

5:36:50 PMWARN DNS query error (cpanel.domain.com/CAA): SERVFAIL (2)

5:36:50 PM CA authorized: “cpanel.domain.com”

“Let’s Encrypt™” is authorized to issue certificates for 10 of this user’s 10 domains.

5:37:02 PMWARN DNS query error (cpcontacts.domain.com/NS): SERVFAIL (2)

5:37:02 PMERROR “cpcontacts.domain.com” is unmanaged. Verify registration and authoritative nameserver configuration for this domain or “domain.com” to correct this problem.

AutoSSL cannot confirm management status for any of this user’s 10 domains. AutoSSL cannot secure any domain without confirming its management status.

5:37:02 PM AutoSSL cannot increase “domain”’s SSL coverage.

 

Like I said, a lot. Everything is "unmanaged". How do I go about setting up management in WHM to allow me to use AutoSSL?

 

 

• 

  cPRex Jurassic Moderator

  • February 06, 2025 18:34

  Hey there!  Can you try the command posted here to see if that shows any odd behavior with the DNS?  https://support.cpanel.net/hc/en-us/articles/6041680688279-AutoSSL-error-domain-tld-is-unmanaged-Verify-this-domain-s-registration-and-authoritative-nameserver-configuration-to-correct-this-problem

  0
• 

  Standifer Kilgore

  • February 06, 2025 22:33

  So, here's what I got:

  for i in {a..m}; do echo -n "$i.root-servers.net: "; dig -4 "$i".root-servers.net @"$i".root-servers.net +short;done

  a.root-servers.net: dig: couldn't get address for 'a.root-servers.net': failure
  b.root-servers.net: dig: couldn't get address for 'b.root-servers.net': failure
  c.root-servers.net: dig: couldn't get address for 'c.root-servers.net': failure
  d.root-servers.net: dig: couldn't get address for 'd.root-servers.net': failure
  e.root-servers.net: dig: couldn't get address for 'e.root-servers.net': failure
  f.root-servers.net: dig: couldn't get address for 'f.root-servers.net': failure
  g.root-servers.net: dig: couldn't get address for 'g.root-servers.net': failure
  h.root-servers.net: dig: couldn't get address for 'h.root-servers.net': failure
  i.root-servers.net: dig: couldn't get address for 'i.root-servers.net': failure
  j.root-servers.net: dig: couldn't get address for 'j.root-servers.net': failure
  k.root-servers.net: dig: couldn't get address for 'k.root-servers.net': failure
  l.root-servers.net: dig: couldn't get address for 'l.root-servers.net': failure
  m.root-servers.net: dig: couldn't get address for 'm.root-servers.net': failure

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 00:32

  That's going to be an issue for sure.  Can you run this command post the results?

  cat /etc/resolv.conf

  0
• 

  Standifer Kilgore

  • February 07, 2025 01:53
  • Edited

  This is what I have.

  nameserver 66.11.XXX.XXX
  nameserver 66.11.XXX.XXX

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 00:56

  Thanks for that information - you'll want to contact your host and let them know those resolvers aren't able to access the root-level nameservers listed above.  They will either be able to fix that for you, or provider you with a different set of resolvers you can place in that configuration file to fix the issue.

  0
• 

  Standifer Kilgore

  • February 07, 2025 01:01
  • Edited

  The only issue there is I am the host. I have the metal license and my machine is sitting next to me. The IP addresses shown is the IP address that is dedicated from my ISP. It's weird because the server pages are being served, the web site I added is working, it's domain name pulls up the online index.php page I created, but I have this issue.

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 01:17

  Ah, that won't work then :D

  You'll need to use the Google public resolvers.  Make that file look like this:

  nameserver 8.8.8.8
  nameserver 8.8.4.4

  and see if that changes the behavior of the root nameserver lookup.

  0
• 

  Standifer Kilgore

  • February 07, 2025 01:20

  "Make that file look like this:"

  Sorry to be dense, but which file are you referencing?
  

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 01:21

  Sorry if that wasn't clear - you'll need to edit the /etc/resolv.conf file and adjust it to use those public nameservers.  After that, I would expect the DNS resolution to work better.

  0
• 

  Standifer Kilgore

  • February 07, 2025 01:31

  All right, made the changes and restarted powerdns. I checked on intodns.com and got all good with the exception being the reverse MX A records, which states that there are no reverse DNS (PTR) entries. I tried to add that in to my system, but it doesn't seem to be working. I created a zone called  179.242.11.66.in-addr.arpa but and created the PTR record but it's not working. Almost there I think.

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 01:33

  You don't need to restart any services to make this change.  This also wouldn't change any of the settings on public DNS that intodns would be able to scan.

  You won't be able to create a reverse DNS record using a home network, as your ISP won't let you do that.

  0
• 

  Standifer Kilgore

  • February 07, 2025 01:57
  • Edited

  So the ISP will need to add the reverse DNS record (ptr) file to my IP address?  So they would just need the domain to point it to to add it on their end? Or do they need something else? (Sorry, being dense again, but I think it's the hostname they need. Could I get verification on that?)

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 02:45

  Yes, if they are willing to make that adjustment for you it would be the hostname that you'd want to use.

  0
• 

  Standifer Kilgore

  • February 07, 2025 02:50

  Thank you so much! You've been super great! I guess this one can be marked solved! :)

  0
• 

  cPRex Jurassic Moderator

  • February 07, 2025 02:53

  Thanks for the kind words - hopefully they are able to do that, but depending on your service plan they may not provide that rDNS service, but I do hope that works out as well!

  1

Please sign in to leave a comment.