Certbot "DNS problem: NXDOMAIN looking up A" fix

DNS problem: NXDOMAIN means Let's Encrypt asked the public DNS for your domain and was told the name does not exist. The name is misspelled, has no record yet, is not delegated to the nameservers you are editing, or the whole domain is suspended.

Quick fix

The cause is a missing DNS record or a wrong delegation, and public resolvers show which.

Ask public resolvers and the authoritative servers directly, not your local DNS:

dig @1.1.1.1 +short A example.com
dig @8.8.8.8 +short A www.example.com
dig +short NS example.com
dig +trace example.com | tail -20

• If the trace ends with NXDOMAIN at your provider's nameservers, create the missing A/AAAA (or CNAME) record.
• If the NS records are not the servers where you edit the zone, fix the delegation at the registrar.
• Then retry with certbot certonly --dry-run -d example.com -d www.example.com.

Causes

1. Typo or missing record

The most common case is requesting www.example.com without having created a www record, or a typo in -d.

• Confirm: dig @1.1.1.1 www.example.com returns status: NXDOMAIN.
• Fix: add the record, or drop the name from the request.

2. Nameservers not delegated

You edit records at one provider while the registrar still points the domain at another provider's nameservers.

• Confirm: dig NS example.com (or whois example.com) lists nameservers different from the provider where you created the record.
• Fix: update the nameservers at the registrar, or create the record in the zone the domain is delegated to. Delegation changes can take up to the parent zone's TTL, often hours.

3. Domain expired, on hold or newly registered

Registries remove a domain from the DNS when it expires or is placed on clientHold / serverHold (for example after a failed registrant verification). A domain registered minutes ago may not be in the TLD zone yet.

• Confirm: whois example.com shows an expiry date in the past or a hold status.
• Fix: renew or complete the registrar's verification, then wait for the TLD to publish it again.

4. DNS-01: TXT record missing or in the wrong place

For DNS-01 the message reads NXDOMAIN looking up TXT for _acme-challenge.example.com.

• Confirm: dig +short TXT _acme-challenge.example.com @<authoritative server> returns nothing.
• Fix: create the TXT record in the delegated zone. If you use CNAME delegation (_acme-challenge CNAME to another zone), the TXT must exist at the CNAME target. Increase the client's propagation wait if your provider is slow.

5. Internal-only or split-horizon names

Names that exist only on an internal DNS server are invisible to the CA.

• Fix: publish the name (or at least the DNS-01 TXT record) in public DNS, or use a private CA for purely internal names.

Fixes by environment

For HTTP-01 the A or AAAA record must exist in public DNS; for DNS-01 the _acme-challenge TXT record must exist in the delegated zone.

Certbot DNS plugins: set a longer --dns-<provider>-propagation-seconds if the provider is slow to update all nameservers.

acme.sh: use --dnssleep 120 to wait longer before validation; see acme.sh verify error.

Cloud DNS consoles (Route 53, Cloudflare, Azure DNS): check that you edited the public hosted zone, not a private one with the same name.

Kubernetes (cert-manager): the DNS01 solver can use recursive nameservers that differ from the public ones; set --dns01-recursive-nameservers when split-horizon DNS hides the record from the controller.

Don't do this

• Edit /etc/hosts on the server. The CA never sees it.
• Retry immediately after creating a record that previously returned NXDOMAIN. Negative answers may be cached; wait, and use --dry-run while testing.
• Request every possible subdomain as a precaution. Each name must resolve; one missing record fails the whole order and counts as a failed authorization.