Usecase : traefik with DNS challenge, a local ACME (step-ca), acme-dns, and a local DNS resolver.

Problem : traefik initially checks for DNS propagation querying the SOA and CNAME records for the challenge (not the TXT). As acme-dns returns NXDOMAIN, the nonexistence is cached by the local resolver with the default "minimum" value set in acme-dns zone (86400). Further queries for the same challenge, even with the correct type TXT fail because of this negative cache, preventing the ACME from issuing the certificate.

How to reproduce :

acme-dns config (DNS section) :

records = [
    "acme-dns.example.zone. A 10.0.0.1",
    "acme-dns.example.zone. NS acme-dns.example.zone.",
]

Configure traefik with an ACME certificate resolver, and a DNS challenge (ACME_DNS_API_BASE environment var to the acme-dns server)

Traefik will request a certificate for myapp.zone and *.myapp.zone, and register a subdomain via acme-dns API ; say d8659307-a365-4973-855e-13fb1508e4ab.

Manually create the CNAME with the registered subdomain as its rdata :

_acme-challenge.myapp.zone. CNAME d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone.

Restart traefik to tell the ACME to check the challenge.

Traefik will first check DNS propagation by following the CNAME and querying types SOA and CNAME :

DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=CNAME rcode=**NXDOMAIN**
DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=SOA rcode=**NXDOMAIN**
DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=TXT rcode=NOERROR

Because of the NXDOMAIN response code, the resolver will then cache the whole domain as nonexistent with a TTL value of 86400.

Any further request to the resolver, even type=TXT, will fail with the same NXDOMAIN.

Expected behaviour :

As per RFC 2308 section 5, these answers should be NODATA, that is NOERROR with an empty response (except for the existing TXT), as the name exists with another type. This would prevent a resolver from caching the domain as nonexistent :

DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=CNAME rcode=**NOERROR**
DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=SOA rcode=**NOERROR**
DEBU[0202] Answering question for domain                 domain=d8659307-a365-4973-855e-13fb1508e4ab.acme-dns.example.zone. qtype=TXT rcode=NOERROR

Should the query target a nonexisting domain, acme-dns would still return a NXDOMAIN :

DEBU[0202] Answering question for domain                 domain=nonexisting-label.acme-dns.example.zone. qtype=CNAME rcode=NXDOMAIN
DEBU[0202] Answering question for domain                 domain=nonexisting-label.acme-dns.example.zone. qtype=SOA rcode=NXDOMAIN
DEBU[0202] Answering question for domain                 domain=nonexisting-label.acme-dns.example.zone. qtype=TXT rcode=NXDOMAIN