“SERVFAIL looking up CAA” / “DNSSEC: DNSKEY Missing”: certificate renewal blocked by broken DNSSEC

Short answer: Your certificate authority could not read your domain's DNS because DNSSEC validation failed, or because your DNS host returns an error for CAA queries. Since 15 March 2026 every public CA must treat that as a refusal, so renewal fails at Let's Encrypt, DigiCert and every other CA alike. Fix the DS record at your registrar (or the CAA answer), then retry.

Coming: CAs Must Validate DNSSEC (Since 15 Mar 2026): Broken DNSSEC Now Blocks Certificate Renewal

The renewal error looks like this
DNS problem: SERVFAIL looking up CAA for example.com - the domain's nameservers may be malfunctioning
DNS problem: looking up A for www.example.com: DNSSEC: DNSKEY Missing
DNS problem: looking up TXT for _acme-challenge.example.com: DNSSEC: Signature Expired
CAA record for example.com prevents issuance
We detected a DNSSEC validation issue on your domain. Please contact your DNS provider to review the configuration.

What it means

CA/Browser Forum ballot SC-085 makes every public CA validate DNSSEC back to the IANA root on all CAA and domain-validation lookups from 15 March 2026, and the Baseline Requirements (section 4.2.2.2.5) say a validation error such as SERVFAIL "MUST NOT be treated as permission to issue". Let's Encrypt has validated DNSSEC for years; DigiCert started on 3 March 2026. Domains without DNSSEC (no DS record at the registrar) are not affected. The usual cause is a DS record left at the registrar after moving to a new DNS host, which Cloudflare and Google both name; others are signatures that stopped being refreshed, a key rollover gone wrong, or a DNS host that errors on the CAA record type. Let's Encrypt shows the Extended DNS Error ("DNSSEC: DNSKEY Missing", "Signature Expired"…) when the resolver gives one, and the generic "SERVFAIL … nameservers may be malfunctioning" when it doesn't. Switching CA won't help, and validating resolvers also refuse your records, so mail to the domain is deferred too.

How to fix it

  1. Run our checker on the domain: the DNSSEC and CAA rows show whether the chain is broken and why, and when the DS doesn't match the key your DNS host signs with, the fix shows the exact DS record to publish instead. By hand: dig CAA example.com @1.1.1.1 returns SERVFAIL and dig +cd CAA example.com @1.1.1.1 answers? Then DNSSEC is the cause (Cloudflare's test).
  2. Moved DNS hosts? At the registrar, delete the old DS record or replace it with your new host's DS. Cloudflare's safe order for a move: remove the DS, wait for its TTL to expire (often 24–48 hours), change the nameservers, then turn DNSSEC back on and add the new DS.
  3. "Signature Expired" or "RRSIGs Missing": your DNS host stopped signing. Ask them to re-sign the zone, or delete the DS to go unsigned until they do. An unsigned domain can get certificates again right away.
  4. Zone signed with algorithm 5 or 7 (RSASHA1)? RFC 9905 (November 2025) says not to sign with SHA-1 any more, and resolvers that follow it treat such zones as unsigned. Roll to algorithm 13 (ECDSAP256SHA256) or 8.
  5. DNSSEC fine but CAA still fails: your DNS host returns an error for CAA queries. Ask them to answer (an empty answer is fine) or move DNS. "CAA record … prevents issuance" means your CAA records don't list this CA: add the identifier your CA documents (for Let's Encrypt, letsencrypt.org).
  6. Retry the renewal, then reload the services that use the certificate (web server, Postfix, Dovecot): see shorter certificate lifetimes. Timeline and sources: CAs validate DNSSEC.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Did this fix it?

What's still not working?

Paste the bounce message or describe what happens. We read every report and add fixes for new errors.

Other bounce errors