# Certbot "DNS problem: NXDOMAIN looking up A" fix

> Let's Encrypt's resolvers say the name does not exist. Check for typos, missing records, nameserver delegation, a suspended domain or a TXT in the wrong zone.

Source: https://ssl.sh/errors/certbot-dns-problem-nxdomain/
Last updated: 2026-11-10

**`DNS problem: NXDOMAIN` means Let's Encrypt asked the public DNS for your domain and was told the name does not exist.** The name is misspelled, has no record yet, is not delegated to the nameservers you are editing, or the whole domain is suspended.

## Quick fix

The cause is a missing DNS record or a wrong delegation, and public resolvers show which.

Ask public resolvers and the authoritative servers directly, not your local DNS:

```bash
dig @1.1.1.1 +short A example.com
dig @8.8.8.8 +short A www.example.com
dig +short NS example.com
dig +trace example.com | tail -20
```

- If the trace ends with NXDOMAIN at your provider's nameservers, create the missing A/AAAA (or CNAME) record.
- If the NS records are not the servers where you edit the zone, fix the delegation at the registrar.
- Then retry with `certbot certonly --dry-run -d example.com -d www.example.com`.

## Causes

### 1. Typo or missing record

The most common case is requesting `www.example.com` without having created a `www` record, or a typo in `-d`.

- **Confirm:** `dig @1.1.1.1 www.example.com` returns `status: NXDOMAIN`.
- **Fix:** add the record, or drop the name from the request.

### 2. Nameservers not delegated

You edit records at one provider while the registrar still points the domain at another provider's nameservers.

- **Confirm:** `dig NS example.com` (or `whois example.com`) lists nameservers different from the provider where you created the record.
- **Fix:** update the nameservers at the registrar, or create the record in the zone the domain is delegated to. Delegation changes can take up to the parent zone's TTL, often hours.

### 3. Domain expired, on hold or newly registered

Registries remove a domain from the DNS when it expires or is placed on `clientHold` / `serverHold` (for example after a failed registrant verification). A domain registered minutes ago may not be in the TLD zone yet.

- **Confirm:** `whois example.com` shows an expiry date in the past or a hold status.
- **Fix:** renew or complete the registrar's verification, then wait for the TLD to publish it again.

### 4. DNS-01: TXT record missing or in the wrong place

For DNS-01 the message reads `NXDOMAIN looking up TXT for _acme-challenge.example.com`.

- **Confirm:** `dig +short TXT _acme-challenge.example.com @<authoritative server>` returns nothing.
- **Fix:** create the TXT record in the delegated zone. If you use CNAME delegation (`_acme-challenge` CNAME to another zone), the TXT must exist at the CNAME target. Increase the client's propagation wait if your provider is slow.

### 5. Internal-only or split-horizon names

Names that exist only on an internal DNS server are invisible to the CA.

- **Fix:** publish the name (or at least the DNS-01 TXT record) in public DNS, or use a private CA for purely internal names.

## Fixes by environment

For [HTTP-01](https://ssl.sh/glossary/http-01/) the A or AAAA record must exist in public DNS; for [DNS-01](https://ssl.sh/glossary/dns-01/) the `_acme-challenge` TXT record must exist in the delegated zone.

**Certbot DNS plugins:** set a longer `--dns-<provider>-propagation-seconds` if the provider is slow to update all nameservers.

**acme.sh:** use `--dnssleep 120` to wait longer before validation; see [acme.sh verify error](https://ssl.sh/errors/acme-sh-verify-error/).

**Cloud DNS consoles (Route 53, Cloudflare, Azure DNS):** check that you edited the public hosted zone, not a private one with the same name.

**Kubernetes (cert-manager):** the DNS01 solver can use recursive nameservers that differ from the public ones; set `--dns01-recursive-nameservers` when split-horizon DNS hides the record from the controller.

## Don't do this

- **Edit `/etc/hosts` on the server.** The CA never sees it.
- **Retry immediately after creating a record that previously returned NXDOMAIN.** Negative answers may be cached; wait, and use `--dry-run` while testing.
- **Request every possible subdomain as a precaution.** Each name must resolve; one missing record fails the whole order and counts as a failed authorization.