2

My company renew our wildcard SSL certification today through DigiCert and I am trying to validate ownership of the domain through DNS. We manage our own DNS server using BIND. I have added the following line to our db.domain file, made sure to change the serial, and did rndc reload.

DOMAIN 60 IN TXT "TOKEN"

I did a dig on a different server, and didn't see the txt record, and Digicert isn't seeing it either. I did a chat with Digicert support and they said to wait a few hours. I have waited a few hours, and still not seeing it. I've never done a SSL cert before, and the engineer who did our SSL certs before is gone now. Am I missing something?

  • When you change content on the authoritative nameservers, there is nothing to wait for, the changes should be published (if no errors in update, serial change, reload of nameserver, etc.). You would get more relevant help if you gave the real name involved. Also make sure that DigiCert asks you to put the TXT record at apex (root of your domain), and not into some specific subdomain. – Patrick Mevzek Dec 4 '19 at 19:34
  • "I did a dig on a different server," you didn't show what you did exactly, nor the result, so it is very hard to help you properly. But this stands as the first rule of DNS troubleshooting: always check things first on authoritative nameserver and then only on recursive ones. Which means with dig, to always use the @ option to specify which nameserver you query exactly. – Patrick Mevzek Dec 4 '19 at 19:35
2

I found my mistake. Instead of putting in

DOMAIN 60 IN TXT "TOKEN"

I needed to put in

@ 60 IN TXT "TOKEN"
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.