Troubleshooting
dns_resolvers_disagree
Some resolvers see the new record and some don't yet. The change is still spreading.
Seen in pending_dnsUsually nothing to doAuto-recovers
What it means
Before we issue a certificate we ask three places for the record: 1.1.1.1, 8.8.8.8 and the zone's own nameservers. All three must agree. Here at least one of them already returns the right record and at least one does not. The domain stays in pending_dns and we keep checking every 15 seconds.
Why it happens
- The record was just added and has not reached every resolver yet. Public resolvers can hold the old answer for as long as its TTL.
- The zone moved to new nameservers recently and the old ones still answer for it.
- One of the zone's nameservers is out of sync with the others (a secondary that failed to transfer the zone).
What to do
- Usually nothing: it settles on its own, typically within minutes.
- If it lasts more than an hour, ask the customer to check the record at their DNS provider and lower the TTL if it is very long.
- If they recently changed nameservers, make sure the record exists at the new provider, not only the old one.
POST /v1/domains/{id}/verify checks again right away. One call per 15 seconds per domain.Was this helpful?
Edit this page