VirtualMin: Failed DNS Validation when request CERT attempted from Let's Encrypt Servers

I still don’t follow.

MX asks:
input mail domain,
input mail exchanger

CNAME asks:
input domain name,
input canonical name(destination)

Did you read the following link - https://www.papaki.com/support/kb/article/Τι-είναι-το-dns-και-τα-a-cname-mx-records-%3B-2125.html

that I posted earlier? It explains A, CNAME & MX records and refers to their system.

EDIT: if nothing else, log a support ticket with papaki and ask them about DNS records or an online chat if they have one. As them what needs to input on the screen if you want to add a CNAME for www pointing to superhost.gr - I recently came across a domain registrar which I hadn’t used and their system wasn’t intuitive - so I asked their support who explained in a few mins.

i managed to put those entries.
Before you said somethign that if i was to leave BIND active for my other websites i have to:

can you explain it please?

You would need BIND to not resolve for superhost.gr - how you would do that, I don’t know, as I don’t run BIND. You might not be able to do that as domain is running the name servers.

To stop things breaking further - you should add 2 more A records or CNAME’s for ns1.superhost.gr & ns2.superhost.gr - I’d go with A records for the moment - just in case CNAME’s are not the preferred way for nameservers.

Do you have access to the DNS control panels for the other domains?

If i disable BIND then i will have to enter records A, CNAME, MX for each domain right? That would bring down the sites and i dont want that because i will here complains.

If you add in all the relevant A, CNAME, TXT (spf) & MX records for the other domains correctly - nothing would come down. 1 minute they would be resolving using the name servers and the next minute via the registrars DNS servers once propagation hits the DNS that they are using.

Try it on one of the domains (other than superhost.gr) and see how it goes.

Call me an idiot but i fear iam gonna break things.

Unless you accept me giving you access to papaki.gr to make the alternations yourself correctly as it should, i’am switching back to BIND.

ALL 4 domains are in the same DNS control panel because i host all of them to papaki.gr

Shall i give you access to make the changes to all 4 domains so i can finally disable BIND?

Nikos - I’m personally not sure what you are afraid of. Pick one of the domains - one that is least important and change it over from the nameservers to use A, CNAME, TXT, MX records and see how you get on.

Worst case scenario is you can go back to the nameserver entries.

Why shit yourself over doing something that can be reversed?

Don’t take this personally - if you can’t do sysadmin stuff or learn to do it, you either need to move to a managed service somewhere or stop doing it.

Could you fix it for me please? i would not know what A is required or CNAME instead.
Shall i give you access to make the needed changes?

Nikos - not really related to your issue but I used to be on shared hosting up until middle of 2016. It allowed me to host my domain\mail. The provider was getting out of the business of shared hosting. So I googled and having a few bad experiences prior to that with shared hosting - I didn’t want to go back to it. So goggled and found out about VPS’s.

Then read up and found Virtualmin - read up on the docs and searched the forums. I settled on Linode and read their docs on setting up a LAMP stack etc. And securing the VPS. I followed the docs I had found and installed Virtualmin and put 2 domains on it.

Didn’t really do much over the next 3 years. Then this year I was told one of the domains wasn’t able to send emails to hotmail. That made me check if the server IP was on any blacklists. It was on backscaterrer. In the space of a few weeks, I learnt about Apache (to a greater depth), upgraded to the latest version of PHP, created additional jails for Fail2Ban (from the CLI) and locked Postfix down (again from the CLI) to a far greater degree. I did also look in Virtualmin to see where thos additional config changes I had made via CLI were turning up. I found them. All this via CLI - i prefer it that way.

My point in saying this - I’m not an experienced SysAdmin, but I come from a very tech heavy background (Cisco, Windows, MS Exchange etc) so perhaps for me picking up things is easier - but there’s no substitute for putting the hours in. Learning, putting a plan together (with some idea of how to reverse what I have done), testing and then doing it for real.

I’ve learnt from some wonderful people (IRL & the internet) but the ethos is on helping people to help themselves. DNS entries are very straight-forward (99% of the time) and you should read up the docs on papaki’s website\support section. Do an online chat with them or log a support ticket if you don’t fully understand how to do an A record or other records.

They’ll explain it to you and assuming you’ve engaged - you’ll understand.

I will follow your advice Dibs, i already opened a ticket in papaki.gr asked them to move me from server’s BIND DNS System to papaki DNS serrvice.

After i do that and retry requesting a LE Cert, do you think it will work this time without that DNS error?!

Basically you need them to walk you thru how to add A, CNAME, TXT (spf) and MX records to all point to 1 IP (in your case) in their DNS control panel.

Once you understand how to do that for 1 domain - it’s simply repeat for the others.

Then you can turn BIND off. That’s the process for moving from BIND to them. Papaki won’t move you from BIND to them any other way. If that makes sense?

LE Cert - I don’t use BIND and host the DNS all externally and have zero issues requesting certs for any of the domains.

Having said that - you have already requested too many in the last 7 days, so might need to wait a few days before requesting more. Also with the V2 thing and V1 and Nov 2019 might mean something - I’m not sure exactly. You may need to check the other threads - it could mean you might not be able to request brand new certs using Virtualmin and can only do renewals - or the Nov 2019 reference may have been to LE’s staging environment and there is no issue with requesting live certs.

You’ll need to check this yourself.

Yes it does. And if i move to papaki dns but also leave BIND active then from which DNS service domain requests would be resolved from?

Resolution will be by\from whatever papaki’s DNS says - which will be giving the resolution as opposed to your local BIND. Your BIND DNS will become redundant.

It’s an over simplification as papaki’s DNS servers will replicate\propagate their info globally round the world to other DNS servers.

YUP.
Sofar i did write on the forum some about wen using DKIM and mail on the virtualmin Box in GUI DKIM you have to use sofar i know for main mailserver/host/domain the dns bind part.

Am i Wrong here DIBS?

if not you can use dns/bind even if duplicate / redundant for DKIM part dkim keys sending with mail.

That DKIM generated you have to copy to DNS services of your hoster.

Don’t do that for now NIKOS, only after you have read enough about that , understanding such , and all other things are OK , otherwise you make things more complicated.
So it is ok to forget about DKIM , and DMARC for the start , SPF you should take care in the dns services i supose.

For the moment as i see this , is more a tryout learning fase, that is ok, if production then hmm it is somewhat hard and bumpy, but goodluck with all.

( i guess generating DKIM with some online services and paste that one in configs and dns should do to) i’m to lazy for that , using the one dns for mailserver part only with virtualmin for having dkim right myself , bind don’t use much memory/cpu so redundant…)

OYEA some advice DIBS give you please read papaki’s , try to understand and take some time and cup of coffe / tee , don’t bother them tomuch to early if you didn’t spend enough time yourself to understand stuff with their helppages. ( if the info is on thier help pages they could be get nerved if you asking same stuff they have already writen out there…) :wink:

@Jfor

On the key part - you are not wrong.

I think the (Public) key in the GUI would be redundant. I haven’t implemented DKIM - so I am assuming the GUI holds (at least) the Public Key. You would need to add it on the DNS at the registrar. But that’s the public key. The server (VPS) would still need to hold the private key. If the GUI holds the private key too - then that might still work.

It might be the case that the GUI doesn’t like to hold just the Private Key and wants the Public Key too - in which case having it there and the registrar - shouldn’t hurt to my mind. The local Public is redundant and has only been entered to keep Virtualmin happy as the developers may not have envisaged using DKIM with an external DNS. But that’s a maybe. :wink:

If anyone specifically requires DKIM then (not using it personally) then that’s the time to look at the few ways that might exist for your distro and read up. My thought is that DKIM isn’t for newbies - so reading is going to be required. As with all things - DKIM and other things - if you aren’t being told you actually need it and if asked why you need it, you have no answer (and no one else speaks up) - I’d say there is a good chance you don’t actually need it. :wink:

Hello, so you are saying that its better for me to have things as it is now, using BIND.
ok i’ll stick to BIND.

i notices that http://mail.superhost.gr and http://176.223.129.220/ both point to http://superhost.gr and that is wrong.
How am i supposed to fix this?