ACME A record error

whiteflag

Hello,
since a few day I get the following error in ACME while it tries to check if a certificate renewal is required:

06.11.2021, 20:24:02 mail.xxx.tld - Use SKIP_LETS_ENCRYPT=y in mailcow.conf to skip it permanently.
06.11.2021, 20:24:02 mail.xxx.tld - Cannot validate any hostnames, skipping Let’s Encrypt for 1 hour.
06.11.2021, 20:24:02 mail.xxx.tld - No A or AAAA record found for hostname mail.xxx.tld
06.11.2021, 20:23:17 mail.xxx.tld - No A or AAAA record found for hostname autoconfig.xxx.tld
06.11.2021, 20:22:32 mail.xxx.tld - No A or AAAA record found for hostname autodiscover.xxx.tld
06.11.2021, 20:21:47 mail.xxx.tld - OK: xxx.xxx.x.xxx, 0000:0000:0000:0000:0000:0000:0000:0000
06.11.2021, 20:21:37 mail.xxx.tld - Detecting IP addresses…

I didn’t change anything on the server nor in my DNS configuration.
Records are set correctly and mailcow is accessible via hostname.

How to debug this problem?

maverick

Good luck. DNS problems with mailcow are recurrent and there is no support.

Because “They don’t do free consulting (to their own product) and time is rare” according to here

They don’t support the OS see here

Or for all regards any and all reasons so the issue is never with mailcow. the whole topic is more fun

After this I’ve had other issues also regarding DNS, like this one github.com - mailcow-dockerized - issue adding hostname to forwarding hosts

So don’t get too much worried for not getting a proper response. They don’t even put up to it because “time is rare” and this is a “you” problem. Be glad you haven’t been insulted yet. “sigh, you again” -> that’s from a product owner.

whiteflag

Thank you very much for this information.

I will try to find a better working solution then.
I think it’s very easy to find a solution that doesn’t screw itself up in less than a month. 😆

maverick

Yeah we also phased out this software, we still have one on for a non-profit. The last one standing.

Btw, about your issue and just to try to help and figure something out quickly, do you have any soft of firewall in front of the mailcow server? Using NAT or similar? You guys manage your DNS infrastructure?

whiteflag

No firewall running on the server (Ubuntu 20.04)
Just a firewall at the VPS hoster with all needed ports opened.
No NAT involved.
DNS is from an external provider but set up correctly and working for everything (except mailcow since a few weeks)

I cannot imagine how such things can happen.
I didn’t touch DNS, firewall or anything.
It just stopped working at a random point of time.

maverick

I was asking cause they have unbound resolver and unbound has some things to it, for example if you’re using a firewall and NAT requires some extra configs.
If you have an external DNS properly serving records and not even behind NAT its a simpler config IMO.

Have you tried to restart the unbound container and the acme-container afterward?

This command queries via acme-mailcow container the unbound resolver (172.22.1.254 is the docker gateway for the setup) what do you get from it? and if you replace 172.22.1.254 with for example 208.67.222.222? (OpenDNS)
Since you have no special DNS requirements, I believe there’s a way to override the DNS servers so you can have your mailcow querying OpenDNS for example. Or any other if you like to if I didn’t have my own DNS infrastructure I’d go for OpenDNS.

docker exec -it $(docker ps -qf name=acme-mailcow) dig +short stackoverflow.com @172.22.1.254

whiteflag

So it seems to have fixed itself…
Today the certificate renewal worked.

sebastian-fahrenkrog

Just in case anybody search for a solution. I was also having problems with letsencrypt. DNS resolving in the acme container was working fine (if done via docker exec or in the container bash enviroment BUT was NOT working fine when container was restarted)

For me this was solved by:

1) Adding DNS to docker /etc/docker/daemon.json

,“dns”:[“8.8.8.8”]

2) Skip http check in mailcow.conf

SKIP_HTTP_VERIFICATION=y

3) and restart the container

docker-compose restart acme-mailcow

Justman10000

@whiteflag

Is that cleared up here?

sebastian-fahrenkrog

Justman10000 I think so