New dedyn.io domain returns SERVFAIL — DS not published in parent zone

dynDNS at dedyn.io
1

Hi,

I registered opendesktest.dedyn.io today (2026-09-17) and added two A records:

  • subname "" → 172.30.4.187
  • subname * → 172.30.4.187

Both RRsets are visible via the API and resolve correctly when querying the authoritative servers directly:

dig +short A opendesktest.dedyn.io @ns1.desec.io
→ 172.30.4.187

However, every validating resolver returns SERVFAIL:

dig +short A opendesktest.dedyn.io @1.1.1.1
→ SERVFAIL
dig +cd +short A opendesktest.dedyn.io @1.1.1.1
→ 172.30.4.187

The +cd result suggests a DNSSEC validation failure. DNSViz shows a broken chain of trust between dedyn.io and my zone, with warnings on the CDS and CDNSKEY records — it looks like the DS record was never published in the parent zone.

dig +short DS opendesktest.dedyn.io @1.1.1.1 returns nothing.

Is this expected to resolve on its own, or did the automatic DS publication fail? I need working resolution to issue a Let’s Encrypt certificate via DNS-01.

Thanks!

2

Hi,

adding some info, in my experience DNS-01 challenge used to work, last week. Having a similar error only very recently. (i have a thread with the full LE error). nothing else to add, cant solve your issue, i am no dns expert. Hope it will work.

3

Hi tikD,

Thanks for your message, and welcome to deSEC! :slight_smile:

Just give it some more time: new domains may take a bit to become fully operational.

@osef has a different issue, see DNSSEC: Bogus: validation failure <crytalk.dedyn.io. A IN> - #2 by peter.

Stay secure,
Peter