Ensure Container is available at Domain Name before proceeding to Let's Encrypt Checks

[danieldent]

Ensure Container is available at Domain Name before proceeding to Let's Encrypt Checks

[claytondaley]

Come to think of it, even better if you could guard against the issue. Before starting the Let's Encrypt process:

1. Make sure the DNS name resolves to an A record
2. (configurable) Make a request against that domain to ensure it's reaching the right machine (the instance making the request). This would guard against old A records that are no longer valid.

The second check needs to be optional as it's theoretically possible that the container won't be able to initiate outbound connections.

[claytondaley]

• both checks need to be optional

If the server can't make an outbound connection, it might not be able to check a DNS name either. I think both of these are very rare -- I just try to anticipate the worst case.

[echohtp]

im having a similar issue! and hitting lets encrypt rate limits without wanting to

[claytondaley]

To further refine my suggestion, this thread says Lets Encrypt uses Google's DNS servers and this thread says they don't cache the requests.

• If possible you should run your DNS checks against the Google DNS (i.e. 8.8.8.8 or 2001:4860:4860::8888).
• You can Flush the Google DNS cache by completing the form here. Your debug/helper text for the DNS check phase could point users to this form to accelerate the change on Google's DNS.