0

I am trying to verify my domain ownership to Let's Encrypt by adding a TXT record to mydomain.zone located in /var/named. Let's Encrypt wants me to add it with a TTL of 1 second. However, I find no example on the web showing how a TTL can be added to this record. I simply use the following:

_acme-challenge.example.com IN TXT "sOmEWeiRedLoNgSTrInG"

Also in the beginning of the file inside the IN SOA ... definition I change the TTL from 3H to 1s but, still when I visit the Let's Encrypt specific URL to verify this challenge, I am shown "No TXT record found. Make sure to set your TTL to 1 second".

How can I add a TTL of 1 second to this TXT record?

  • 1
    TTL is set for the entire zone. You can't set a TTL just for one record. If you have just changed it from 3H to 1s for the zone, it could take up to three hours for others to see that change. – Doug Deden Feb 15 at 18:13
  • 1
    Use _acme-challenge.example.com 1 IN TXT "sOmEWeiRedLoNgSTrInG". That is, the TTL goes after the name. – garethTheRed Feb 16 at 20:43
  • 1
    @DougDeden "TTL is set for the entire zone. You can't set a TTL just for one record. " This is not true. The TTL is per record (to be precise: per recordset in fact). You can define a global one affecting the whole zone in your zonefile, but you can as well specify different TTLs per record. – Patrick Mevzek Feb 19 at 21:34
  • 1
    "Let's Encrypt wants me to add it with a TTL of 1 second." can you give a reference for that? Because in that specific case the TTL in fact does not matter: for verification purposes, the CA will query authoritative nameservers, not recursive ones, and hence the TTL has no influence whatsoever. Whatever your problem is (since you do not give details, noone can troubleshoot your DNS for you), it is clearly not related to the TTL of the record, but just the fact that for whatever reason the record is not published on your authoritative nameservers. – Patrick Mevzek Feb 19 at 21:36
  • @PatrickMevzek Thanks for the correction. I've never dealt with a separate TTL for an individual recordset, so I didn't realize that could be done. – Doug Deden Feb 19 at 22:32

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.