Renewal DNS Health & DNS-01 Preflight

Modern certificates auto-renew, but that automation quietly depends on DNS that
has to be correct at setup and stay correct forever after. The most common
outage isn't an expired cert you forgot — it's a renewal that failed silently
months after someone made an unrelated DNS change. CertTracker's Renewal DNS
Health watches exactly those records, and the DNS-01 Preflight lets you
prove a renewal will work before it runs.

You'll find both on a domain's detail panel in the Domain Tracker.

What Renewal DNS Health checks

When you enable it on a domain, CertTracker verifies the DNS a CA relies on to
issue and renew the certificate, and alerts you if any of it drifts:

• CAA vs. the issuing CA. If your domain publishes a CAA record, it must
  permit the CA that issued your current certificate. A CAA that excludes your
  issuer means the next renewal will be refused — the highest-value check,
  because CertTracker already knows both your issuer (from monitoring the cert)
  and your CAA record.
• A / AAAA presence. The address records an HTTP-01 renewal needs.
• _acme-challenge delegation. For delegated DNS-01, the persistent CNAME
  that points validation at your provider. (Note: a plain _acme-challenge TXT
  is not expected at rest — with direct DNS-01 the record exists only during
  issuance, so its absence is normal and never alarmed.)

Each domain rolls up to OK, Warning, or Renewal at risk, and a
change to any of these fires through the same alerting pipeline as your other
domain alerts.

Turning it on

Open a domain and tick "Check this domain's renewal DNS health." The daily
poller then checks only the domains you've enabled — you choose which ones
matter. Turning it off clears the stored result.

DNS-health-only entries (no license)

Sometimes you want to watch the renewal DNS for a name you don't fully
track — a subdomain you auto-enroll but don't own the registration for, or one
you don't want to spend a domain license on. Add it as a DNS-health-only
entry (the "Type" dropdown when adding a domain, or one-click Track from
"Suggested from your monitors"). These run the renewal checks only — no
registrar/expiry tracking — and don't count against your plan's domain
limit.

DNS-01 Preflight: prove a renewal will work

Under Test DNS-01 Renewal Setup you have two tools.

Check propagation (no Let's Encrypt)

Simulates what a CA does during a DNS-01 lookup, from the public internet's
point of view: it follows any _acme-challenge CNAME delegation, finds your
domain's authoritative nameservers, and queries each one directly for the
record. Querying every authoritative server (not a caching resolver) is what
catches partial propagation — one nameserver updated, another still stale. It
also reports the CAA verdict. Safe to run anytime; it never contacts a CA.

Start Let's Encrypt staging test → Verify

A real end-to-end test against Let's Encrypt's staging environment (so it
never touches your real certificate or rate limits):

1. Click Start Let's Encrypt staging test. CertTracker opens a staging
   order and shows you the exact TXT record to publish.
2. Add that TXT record at your DNS provider.
3. Click Verify. CertTracker runs the propagation check against that exact
   value, then asks Let's Encrypt staging to validate it, and reports the
   result.

A VALID result means your DNS-01 renewal path genuinely works. This is the
authoritative check; the propagation simulator is the quick convenience
pre-check.

Interpreting results & troubleshooting

• Staging says VALID but the simulation shows "missing": almost always a
  split-horizon DNS situation — the host running CertTracker resolves your
  domain to internal nameservers, while the CA (and the simulator's public
  view) sees your public ones. The simulation queries public resolvers to
  match the CA; if your environment restricts outbound DNS, an administrator can
  set the resolvers it uses in settings (module='dns01',
  variable_name='public_resolvers').
• "No route to host" for a nameserver: that authoritative server isn't
  reachable from CertTracker's vantage point — on production it usually should
  be; worth investigating if it persists.
• CAA blocks the issuer: add an issue/issuewild entry for your CA, or
  remove the offending CAA record, before the next renewal.
• Nameservers disagree: propagation is still in flight — wait and re-check.

Coming next

A future enhancement, DNS-01 TXT Automation, will let CertTracker create and
remove the _acme-challenge record for you via your existing DNS provider's API
(the way certbot's DNS plugins work), so the staging test — and eventually
renewals themselves — need no manual DNS edits. Manual entry will remain
available. CertTracker never hosts your DNS; the records always live in your own
zone. Vote for it on the roadmap.