Txt records wildcards

Note that the address you are seeing, More information on Google Apps Help. Sign up to join this community. The best answers are voted up and rise to the top.

Stack Overflow for Teams — Collaborate and share knowledge with a private group. Create a free Team What is Teams? Learn more. Can SPF records contain domain name wildcards? Ask Question. Asked 10 years, 11 months ago. Active 5 years, 6 months ago. Viewed 22k times. Part of my SPF record contains: include:google.

Improve this question. Add a comment. I mean. Also requires 2 records, but dehydrated deploys and validates them one by one, be it v1 or v2. Also, why would you need 2 records at the same time for foo. It's most certainly just one record. This "multiple records at once" reasoning doesn't add up for me.

Let alone "aliases have nothing to do with it". Yes, they do. There's no multiple records, there's no wildcard, yet it still breaks. I remove the alias and it starts working. This issue is for validating a wildcard and non-wildcard domain at the same time.

One will validate the wildcard, and one will validate the non-wildcard. If you're validating foo. If you're having troubles with an alias, that's different again. It does not impact the validation records at all. So if you're experiencing an issue with an alias, it should be put in a separate issue, so it doesn't get lost in the discussion over validation records.

Yea, like txr13 said this is an issue with the dns hook script, for hook-chaining with certificates like example. Without chaining it would in theory work, but keep in mind that Let's Encrypt caches DNS entries for up to 5 minutes, so you may run into validation issues. After validating one of the two names it doesn't need to be validated again, so only the second one gets validated, and since now there is only one record it will obviously succeed. Unless I'm missing something here.

Will try to port certzure to azure-cli v2 coz I don't feel like messing around with Java too much. WIll make testing and debugging easier too.

Then I'll get back to this issue. In the meanwhile - what's "hook-chaining" and how do I use it? Google doesn't show up much It's especially useful for people with lots of domains, but it could also make logic for a hook a bit easier deploy everything, delete verything, instead of deploying and removing one by one.

Skip to content. Star 5. New issue. Jump to bottom. Copy link. Hi, thanks for the welcome. This has worked before, even with 0 delay. Beginning to suspect an issue with my provider's API. You might need to add both values in one modify-DNS-record call or the like, which can be tricky to integrate with certbot but I suspect is possible.

But yes, probably the first thing to do is to try to reach out to your DNS provider. Especially if the call to add a second value used to work and now doesn't, they might have broken something on their side.

Another option, if your DNS provider just doesn't work well for automation, is to use something like acme-dns where you delegate the acme challenge TXT record to a dedicated server that's purely designed for handling the ACME DNS challenges.

It's been a while, but last I used certbot for this stuff, they looped the challenges once - not with a separate setup, auth, cleanup phases. Years ago I used namecheap for some domains, and while they had one of the better APIs -- because you could delegate ONLY dns to an api token -- their DNS system appeared to use a read-through cache against the backing datastore , while their API and Admin Panel only affected the backing datastore it was not a write-through cache.

Every time you issued a DNS query, their systems would cache the data for 5 minutes. The way around it, until I switched to acme-dns, was to use a second delay. Insane, I know. Another option you can try is to obtain a first cert for example. If you do that within a short time period, I believe letsencrypt will re-use the successful validations and not issue a challenge. I could be wrong on this part, they might be consumed on a successful cert- but I think that strategy will work.

I haven't actually written any manual auth hooks for certbot, so I'll defer to your experience. It might not be the problem that I feared it was. I remember people having trouble here in the past with a DNS API only supporting one record at a time, but maybe it was a different client. But that was an issue with doing it all manually, but it sounded like authorizing through a script was supposed to handle things sequentially correctly.

So forget everything I said. Some clients will do all the setups first, and acme-dns accommodates for this design pattern by allowing two records per domain. I have no idea what certbot currently does, but the very old version I use for DNS auths does loop each challenge independently.

I am fairy certain that your understanding of the ACME protocol has increased significantly since that post, but on the off-chance it has not, the RFC essentially provides for this:.