Propagation time limit exceeded (Duck dns) tried many settings still fails

[languagemaniac]

Hi, I ran this command:

sudo docker run --rm \
-e DUCKDNS_TOKEN=mytoken \
-e DUCKDNS_PROPAGATION_TIMEOUT=100 \
-e DUCKDNS_POLLING_INTERVAL=10 \
goacme/lego \
--email [email protected] \
--dns duckdns \
--domains mydomain.duckdns.org \
--accept-tos \
--dns-timeout 60 \
--dns.resolvers 8.8.8.8 \
run

and variations of it, more dns timeout, more propagation timeout (tried up to 340), still fails. This is the full log

2024/08/20 07:50:55 No key found for account [email protected]. Generating a P256 key.
2024/08/20 07:50:55 Saved key to /.lego/accounts/acme-v02.api.letsencrypt.org/[email protected]/keys/[email protected]
2024/08/20 07:50:55 [INFO] acme: Registering account for [email protected]
2024/08/20 07:50:56 [INFO] [example.duckdns.org] acme: Obtaining bundled SAN certificate
!!!! HEADS UP !!!!

Your account credentials have been saved in your Let's Encrypt
configuration directory at "/.lego/accounts".

You should make a secure backup of this folder now. This
configuration directory will also contain certificates and
private keys obtained from Let's Encrypt so making regular
backups of this folder is ideal.
2024/08/20 07:50:56 [INFO] [example.duckdns.org] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/392632525176
2024/08/20 07:50:56 [INFO] [example.duckdns.org] acme: Could not find solver for: tls-alpn-01
2024/08/20 07:50:56 [INFO] [example.duckdns.org] acme: Could not find solver for: http-01
2024/08/20 07:50:56 [INFO] [example.duckdns.org] acme: use dns-01 solver
2024/08/20 07:50:56 [INFO] [example.duckdns.org] acme: Preparing to solve DNS-01
2024/08/20 07:51:02 [INFO] [example.duckdns.org] acme: Trying to solve DNS-01
2024/08/20 07:51:07 [INFO] [example.duckdns.org] acme: Checking DNS record propagation. [nameservers=8.8.8.8:53]
2024/08/20 07:51:17 [INFO] Wait for propagation [timeout: 1m40s, interval: 10s]
2024/08/20 07:51:24 [INFO] [example.duckdns.org] acme: Waiting for DNS record propagation.
2024/08/20 07:51:42 [INFO] [example.duckdns.org] acme: Waiting for DNS record propagation.
2024/08/20 07:52:02 [INFO] [example.duckdns.org] acme: Waiting for DNS record propagation.
2024/08/20 07:52:17 [INFO] [example.duckdns.org] acme: Waiting for DNS record propagation.
2024/08/20 07:53:34 [INFO] [example.duckdns.org] acme: Waiting for DNS record propagation.
2024/08/20 07:53:44 [INFO] [example.duckdns.org] acme: Cleaning DNS-01 challenge
2024/08/20 07:53:49 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/392632525176
2024/08/20 07:53:50 Could not obtain certificates:
        error: one or more domains had a problem:
[example.duckdns.org] propagation: time limit exceeded: last error: DNS call error: read udp 172.17.0.3:52444->99.79.143.35:53: i/o timeout [ns=ns1.duckdns.org.:53, question='_acme-challenge.example.duckdns.org. IN  TXT']

I don't know what I'm doing wrong tbh I spent quite some time trying, but no luck. I'd appreciate any help. I searched for similar discussions and tried what solved the issue for some other people, like adding the dns-timeout setting and modifying the propagation limit, trying with different dns, like quad9, cloudflare etc. Doesn't make a difference unfortunately.

Do I have to forward any port in my router maybe?

[ldez]

DNS call error: read udp 172.17.0.3:52444->99.79.143.35:53: i/o timeout

Your problem is not related to a propagation timeout but to a DNS call timeout.

Your problem relates to your local network (firewall, local DNS, etc.).
There is something inside your network that "blocks" the DNS calls.

[languagemaniac]

other than adguard, I am not aware of anything else affecting my dns. In my router I have a vary basic setting of firewall, which I have set to "low" and then I have a "Anti-PortScan" setting which says " “Threshold” means the maximum number of TCP or UDP connections from a host on the WAN side to the CPE itself every 3 seconds." and is set to 100. which I haven't touched because I don't really know what it does.

On the router, I have cloud9 set as a dns, and cloudflare as a secondary dns.

If I execute the command "dig @ns1.duckdns.org TXT _acme-challenge.example.duckdns.org" I do get a couple of "timed out" results, but then I get the answer.

Adguard doesn't seem to be blocking anything related to this. Don't know what else to look for.

[staticdev]

@ldez exact same issue here with duckdns.. sometimes it times out on dig sometimes it doesn't. but lego is failing.
I tested also some different timeout configurations such as:

DUCKDNS_PROPAGATION_TIMEOUT=100
DUCKDNS_HTTP_TIMOUT=10
DUCKDNS_POLLING_INTERVAL=10

@languagemaniac did you find any solution?

[languagemaniac]

I just used certbot standalone. I tried using that before but was having issues, but eventually worked

[ldez]

@staticdev the problem seems related to propagation to all the authoritative nameservers of the DNS provider.

Since v4.19, there is an option (--dns.propagation-disable-ans) to skip this check.

lego --email xxx --dns xxx --domains xxx --dns.propagation-disable-ans --dns.resolvers 1.1.1.1 run 

I recommend using several --dns.resolvers in addition to the option and add --dns.propagation-rns.

https://go-acme.github.io/lego/usage/cli/options/index.html

Also i/o timeout is a generic error, so if you still have the problem, I recommend creating another discussion.

[staticdev]

Thanks @ldez, meanwhile I found a configuration that looked stable for me:

DUCKDNS_PROPAGATION_TIMEOUT=120
DUCKDNS_POLLING_INTERVAL=30
DUCKDNS_TTL=200