Lego, ACME DNS-01, and negatively-cached surprises

· Chameth · Sept. 9, 2026, 1:43 p.m.
Summary
The blog post discusses a DNS propagation issue encountered while deploying a reverse proxy service called Centauri, specifically focusing on the behavior of different DNS resolvers and how caching impacts the ACME DNS-01 challenge. It highlights a problem with the Lego library, which checks for CNAMEs and TXT records in a way that led to inconsistencies due to negative caching. The author explores how changes in recent versions of Lego altered the default behavior, potentially complicating deployments for developers. Personal insights and debugging experiences provide a deeper understanding of DNS challenges.
AUTHOR