LetsEncrypt refuses to issue the certificate because DNS resolution fails for A and AAAA resolution on the autoconfig.[domain4] and autodiscover.[domain4] subdomains.
I am presuming it is requesting bundled certificates, but in any case, ACME aborts because of this:
acme-mailcow-1 | raise ValueError("Challenge did not pass for {0}: {1}".for
mat(domain, authorization))
acme-mailcow-1 | ValueError: Challenge did not pass for autoconfig.vtelectronic s.net: {'identifier': {'type': 'dns', 'value': 'autoconfig.vtelectronics.net'}, 'status': 'invalid', 'expires': '2026-05-07T13:10:40Z', 'challenges': [{'type': 'http-01', 'url': 'https://acme-v02.api.letsencrypt.org/acme/chall/2748021221/69 6280730205/VV-Z1Q', 'status': 'invalid', 'validated': '2026-04-30T13:10:41Z', 'e rror': {'type': 'urn:ietf:params:acme:error:dns', 'detail': "During secondary va
lidation: DNS problem: SERVFAIL looking up A for autoconfig.vtelectronics.net - the domain's nameservers may be malfunctioning; DNS problem: query timed out loo
king up AAAA for autoconfig.vtelectronics.net", 'status': 400}, 'token': 'Vr6ExZ
8MsSdWTNGSSvTHt8uakjYhENosW5S2vdDEeKY', 'validationRecord': [{'url': 'http://aut
oconfig.vtelectronics.net/.well-known/acme-challenge/Vr6ExZ8MsSdWTNGSSvTHt8uakjY
hENosW5S2vdDEeKY', 'hostname': 'autoconfig.vtelectronics.net', 'port': '80', 'ad
dressesResolved': ['38.143.59.204'], 'addressUsed': '38.143.59.204'}]}]}
acme-mailcow-1 | Thu Apr 30 09:11:15 EDT 2026 - Failed to obtain certificate /v
ar/lib/acme/mail.highlandarrow.com/cert.pem for domains 'mail.highlandarrow.com
autoconfig.highlandarrow.com autoconfig.vtelectronics.net autodiscover.highlanda
rrow.com autodiscover.vtelectronics.net'
This is why bundling certificate CNs can be a bad idea, incidentally.
This failure state is kind of nasty; it means if ACME fails for a single domain on a mailcow install with many, the entire setup is hosed.
Secondary validation errors have been reported frequently to LetsEncrypt on their own forums since about mid December, they seem to completely shift the blame onto all the people having problems, rather than reconsidering their own setup. In my own case, the DNS service for all four domains (highlandarrow.com, housestuart.com, toud.pw, vtelectronics.net) are all provided by EasyDNS on their professional level. The other three domains seem fine. I had their support look at their records, and reset and republish the domain, but it seems fine, and resetting it did not accomplish the result.
What we did for now is force a redirect of AAAA queries to return A records, but that’s not how DNS is supposed to function, and it is not RFC compliant. It’s the workaround that worked though.
Going forward Mailcow should consider two things:
1] Allow alternative ACME providers such as Comodo or ZeroSSL through ACME,
and
2] Do not bundle the certificate common names in such way that failure of one domain’s resolution causes the entire service to become unstable,
or,
2b] Use selective fallbacks combinations to exclude the domains the secondary validation is failing for; autoconfiguration and autodiscovery are not vital functions which should result in a complete service failure if the certificate cannot be provisioned for them.
