Host: Digital Ocean

OS: CentOS

I have an existing SSL certificate that covers my domain.

$ certbot certificates produces this output.

Found the following certs:
   Certificate Name: example.com
     Domains: example.com www.example.com
     Expiry Date: 2020-04-12 21:20:31+00:00 (VALID: 86 days)
     Certificate Path: /etc/letsencrypt/live/example.com/fullchain.pem
     Private Key Path: /etc/letsencrypt/live/example.com/privkey.pem

I installed postfix and I believe I need to add mail.example.com to my certificate.

I tried to add mail.example.com to my certificate using this command,

$ sudo certbot certonly --standalone -d mail.example.com

Unfortunately it threw this error,

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for mail.example.com
Waiting for verification…
Challenge failed for domain mail.example.com
http-01 challenge for mail.example.com
Cleaning up challenges
Some challenges have failed.


The following errors were reported by the server:

Domain: mail.example.com
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for mail.example.com

It appears that certbot is trying to install mail.example.com using an A record. On Digital Ocean in my Domain Records section mail.example.com was created as an MX record, not an A record.

  • i think nxdomain is telling you that the address couldn't be resolved
    – djdomi
    Commented Jan 17, 2020 at 20:07
  • Per RFC 2606 and RFC 6761 please use example.com or example.org when obfuscating your domain. (I'm assuming you don't actually own testsite.com .)
    – 84104
    Commented Jan 17, 2020 at 23:13

3 Answers 3


You are right, that for mail delivery you need an MX- entry. BUT: mail.testsite.com is a fully qualified hostname. And you need to tell everybody who wants to deliver mail to you what the ip address of this hostname is. So you need an A record as well, pointing to the server where you want to receive the mail.

Create the a record and point to your mail server and run certbot from that machine. Make sure, that a webserver is responding on port 80 for mail.testsite.com for the verification to be successfull. Then it will work.


Do it like this:

$ sudo certbot -d mail.example.com --manual --preferred-challenges dns certonly

A DNS TXT record will be printed (just don't click enter yet), publish it to your DNS and wait till you're sure that the TXT record can be read from outside of your DNS then click enter and it will be verified.

  • This was very helpful, thanks. Can that TXT record be removed afterwords or does it need to remain permanently? Commented Jul 9, 2020 at 4:33
  • 1
    @GreatBlakes YW..... Once the authorization status is valid then you can clear it, but better leave it for future queries. Commented Jul 9, 2020 at 15:56

If Ionos is your DNS provider and you follow the common convention of calling your mail server mail.example.com, it's not sufficient to create an A record "mail" and an MX record "mail". Your TXT record doesn't satisfy certbot.

You must create a subdomain called "mail" using the Ionos UI. Then you can navigate to that subdomain in the UI, create your TXT record and call it "_acme-challenge". That produces a working "_acme-challenge.mail.example.com" TXT record.

better leave it for future queries

It looks to me as if the value in the challenge changes each time you run certbot. So you can leave the TXT record in place but you will have to edit it each time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .