Subject: [Acme] DNS based validation and cache issue

From: Romain Fliedel <[email-masked]>
Date: Thu, 24 Sep 2015 09:51:50 +0200

Hi,

When using DNS validation, there might be some cache issues when trying to
validate that already had a _acme-challenge. TXT entry (from a previous
validation attempt).
I thing the spec should recommend the use of short TTL value for those
records (but this might not always be possible when using hosting
providers).
Also, when validating the TXT record entry, the acme server should be
required to get an authoritative answer from the domains NS directly.
Those two changes would mostly solve the problem, but it might not be
sufficient. For instance if a end user provisions a TXT record using its
hosting provider api, he might not be able to know when its change will be
effective on the DNS server.
The current boulder implementation only tries to validate the DNS entry
once, and mark the challenge as failed on a TXT missmatch, maybe it should
try several times with some delay (record TTL ?) between requests before
marking the challenge as failed.

Another approach would be use _acme-$RAND. TXT prefix, with $RAND a short
random string that would be part of the dns challenge. This would solve the
cache issue without any major changes. (Note that the acme server should
still perform several attempts to get the TXT record when getting
a NXDOMAIN reply).

What do you think ?