That does not seem to be a propagation issue in your case.
From what I understand, Lego roughly does the following steps:
- Request a challenge from the CA
- Set up the response DNS record
- Poll the authoritative DNS server(s) until they serve the response
- Tell the CA to verify the response
My (and Freundschaft’s, I suppose) issue, was that step 3 completed too soon (see other thread for the error message).
You error message (time limit exceeded: last error: NS ns1.desec.io. did not return the expected TXT record) suggest that step 3 does not complete at all (before the timeout).
I can think of two possible causes:
- Step 2 failed (but Lego didn’t notice). You should try querying the API and the deSEC name servers while Lego is running to see if the response is correctly set up and served.
- Step 2 succeeded, but Lego can not reach the deSEC name servers and therefore fails in step 3. If your firewall blocks DNS traffic that does not go to your preferred (stub) resolver, this may be your issue.