Answer the question
In order to leave comments, you need to log in
How to delegate a subdomain from Yandex.Connect to Yandex.Mail for Domain?
Good day to all!
There is a $mydomain domain in Yandex.Connect, for which there is currently no public API. There is also a desire to use the Let's Encrypt service and run a DNS-01 challenge to verify ownership of the domain.
There was an idea to select the acme.$mydomain subdomain and delegate it to Yandex.Mail for the domain (the subdomain is connected to another Yandex account, of course). With a successful outcome, this could give:
1) the ability to use the Yandex.PDA public API to complete the DNS-01 challenge;
2) greater security, since the ACME client will use the PDDToken of the subdomain, and not the main domain.
The problem is that the subdomain cannot be verified - as soon as I press the "Check Domain Ownership" button, the Yandex DNS servers immediately intercept the SOA of the subdomain, which leads to a deadlock - the DNS records of the main domain are no longer available, and new ones cannot be created yet.
C:\> nslookup -type=soa acme.$mydomain. dns1.yandex.net.
Name: UnKnown
Address: 213.180.204.213
$mydomain
primary name server = dns1.yandex.ru
responsible mail addr = $myyandexaccount1.yandex.ru
serial = 2011102501
refresh = 14400 (4 hours)
retry = 900 (15 mins)
expire = 1209600 (14 days)
default TTL = 14400 (4 hours)
C:\> nslookup -type=soa acme.$mydomain. dns1.yandex.net.
Name: UnKnown
Address: 213.180.204.213
acme.$mydomain
primary name server = dns1.yandex.net
responsible mail addr = $myyandexaccount2.yandex.ru
serial = 2017071901
refresh = 14400 (4 hours)
retry = 900 (15 mins)
expire = 1209600 (14 days)
default TTL = 14400 (4 hours)
Answer the question
In order to leave comments, you need to log in
I delegated the acme.$mydomain subdomain to a third-party free DNS hosting (netbreeze.net, aka dns-hosting.ru), created the CNAME record required by Yandex, and a day later discovered that the subdomain had successfully passed the validation. After that, I delegated the subdomain to Yandex.PDA and got what I wanted.
The question can be considered closed.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question