"xyz is not a valid domain. Expected at least 1 TLD and 1 SLD" over and over in my caddy logs

[rubydotexe]

1. The problem I'm having:

Hello everyone. :) I am trying to use Namecheap as my DNS Provider and have Caddy lease and renew certificates for my wildcard url. I get an error saying xyz is not a valid domain. francislavoie says its a bug with the namecheap libdns. Please see this discussion post for further details as to why.

Here my logs from Caddy. The error seems to be coming from this line of code, ""domain: %s is not a valid domain. Expected at least 1 TLD and 1 SLD", domain"

2. Error messages and/or full log output:

caddy  | {"level":"error","ts":1701060103.9745886,"logger":"tls.issuance.zerossl.acme_client","msg":"cleaning up solver","identifier":"*.example.com","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.example.com\" (usually OK if presenting also failed)"}
caddy  | {"level":"error","ts":1701060104.0441127,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"*.example.com","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[*.example.com] solving challenges: presenting for challenge: adding temporary record for zone \"xyz.\": domain: xyz is not a valid domain. Expected at least 1 TLD and 1 SLD (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/126400904/12565262814) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
caddy  | {"level":"error","ts":1701060104.0441592,"logger":"tls.obtain","msg":"will retry","error":"[*.example.com] Obtain: [*.example.com] solving challenges: presenting for challenge: adding temporary record for zone \"xyz.\": domain: xyz is not a valid domain. Expected at least 1 TLD and 1 SLD (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/126400904/12565262814) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":3,"retrying_in":120,"elapsed":182.406113883,"max_duration":2592000}
caddy  | {"level":"info","ts":1701060224.0448413,"logger":"tls.obtain","msg":"obtaining certificate","identifier":"*.example.com"}
caddy  | {"level":"info","ts":1701060224.25706,"logger":"tls.issuance.acme.acme_client","msg":"trying to solve challenge","identifier":"*.example.com","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
caddy  | {"level":"error","ts":1701060224.3363547,"logger":"tls.issuance.acme.acme_client","msg":"cleaning up solver","identifier":"*.example.com","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.example.com\" (usually OK if presenting also failed)"}
caddy  | {"level":"error","ts":1701060224.405523,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"*.example.com","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[*.example.com] solving challenges: presenting for challenge: adding temporary record for zone \"xyz.\": domain: xyz is not a valid domain. Expected at least 1 TLD and 1 SLD (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/126400904/12565306424) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
caddy  | {"level":"info","ts":1701060224.61004,"logger":"tls.issuance.zerossl.acme_client","msg":"trying to solve challenge","identifier":"*.example.com","challenge_type":"dns-01","ca":"https://acme-staging-v02.api.letsencrypt.org/directory"}
caddy  | {"level":"error","ts":1701060224.639476,"logger":"tls.issuance.zerossl.acme_client","msg":"cleaning up solver","identifier":"*.example.com","challenge_type":"dns-01","error":"no memory of presenting a DNS record for \"_acme-challenge.example.com\" (usually OK if presenting also failed)"}
caddy  | {"level":"error","ts":1701060224.7054188,"logger":"tls.obtain","msg":"could not get certificate from issuer","identifier":"*.example.com","issuer":"acme-staging-v02.api.letsencrypt.org-directory","error":"[*.example.com] solving challenges: presenting for challenge: adding temporary record for zone \"xyz.\": domain: xyz is not a valid domain. Expected at least 1 TLD and 1 SLD (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/126400904/12565306614) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}
caddy  | {"level":"error","ts":1701060224.7054589,"logger":"tls.obtain","msg":"will retry","error":"[*.example.com] Obtain: [*.example.com] solving challenges: presenting for challenge: adding temporary record for zone \"xyz.\": domain: xyz is not a valid domain. Expected at least 1 TLD and 1 SLD (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/126400904/12565306614) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)","attempt":4,"retrying_in":300,"elapsed":303.067413508,"max_duration":2592000}
^CGracefully stopping... (press Ctrl+C again to force)

Any assistance would be deeply appreciated, thank you.

[volfco]

@rubydotexe

'xyz is not a valid domain. Expected at least 1 TLD and 1 SLD' Means that the SOA record for your domain, i.e. foo.xyz, is incorrect. I experienced this because I had a CNAME for the root record, which was causing Namecheap to not return a SOA.

Caddy will keep trying to find the root zone of the given hostname, and the above error is because the only valid SOA response is from the tld zone. (This behavior is from https://github.com/caddyserver/certmagic/blob/master/dnsutil.go#L23)

I also encountered: namecheap api returned error in response. Err: Error0: Invalid request IP:

This means that the IP the API request is coming from is not whitelisted. Namecheap requires you to whitelist the IP you want to call their API from.