P
P
p2n2017-07-19 11:03:39
Yandex
p2n, 2017-07-19 11:03:39

How to delegate a subdomain from Yandex.Connect to Yandex.Mail for Domain?

Good day to all!
There is a $mydomain domain in Yandex.Connect, for which there is currently no public API. There is also a desire to use the Let's Encrypt service and run a DNS-01 challenge to verify ownership of the domain.
There was an idea to select the acme.$mydomain subdomain and delegate it to Yandex.Mail for the domain (the subdomain is connected to another Yandex account, of course). With a successful outcome, this could give:
1) the ability to use the Yandex.PDA public API to complete the DNS-01 challenge;
2) greater security, since the ACME client will use the PDDToken of the subdomain, and not the main domain.
The problem is that the subdomain cannot be verified - as soon as I press the "Check Domain Ownership" button, the Yandex DNS servers immediately intercept the SOA of the subdomain, which leads to a deadlock - the DNS records of the main domain are no longer available, and new ones cannot be created yet.

This is before attempting to pass subdomain verification
C:\> nslookup -type=soa acme.$mydomain. dns1.yandex.net.
Name:     UnKnown
Address:  213.180.204.213

$mydomain
        primary name server = dns1.yandex.ru
        responsible mail addr = $myyandexaccount1.yandex.ru
        serial  = 2011102501
        refresh = 14400 (4 hours)
        retry   = 900 (15 mins)
        expire  = 1209600 (14 days)
        default TTL = 14400 (4 hours)

And this is right after trying to execute it (i.e. pressing the 'Check Domain Ownership' button
C:\> nslookup -type=soa acme.$mydomain. dns1.yandex.net.
Name:     UnKnown
Address:  213.180.204.213

acme.$mydomain
        primary name server = dns1.yandex.net
        responsible mail addr = $myyandexaccount2.yandex.ru
        serial  = 2017071901
        refresh = 14400 (4 hours)
        retry   = 900 (15 mins)
        expire  = 1209600 (14 days)
        default TTL = 14400 (4 hours)

Answer the question

In order to leave comments, you need to log in

1 answer(s)
P
p2n, 2017-07-20
@p2n

I delegated the acme.$mydomain subdomain to a third-party free DNS hosting (netbreeze.net, aka dns-hosting.ru), created the CNAME record required by Yandex, and a day later discovered that the subdomain had successfully passed the validation. After that, I delegated the subdomain to Yandex.PDA and got what I wanted.
The question can be considered closed.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question