While trying Let's Encrypt closed beta, I found that my email addresses (I host) are not accepted.

I modified the client and got following Python exception information while registering an account (mail address in this example is not real though).

Error(typ=u'malformed', detail=u'Error creating new registration :: Validation of contact mailto:dummy@dummy.a4lg.com failed: Server failure at resolver', title=None)

After a few hours of investigation, I found that the current version of boulder needs an A record (not MX records) for domain part of the email address while registration (dummy.a4lg.com in this case). After adding dummy A record, the account registration has succeeded.

Workaround

Try adding dummy A record (it worked for me). Dummy AAAA record doesn't work. If this is not working, something might be wrong...

; Example for dummy@dummy.a4lg.com (BIND format)
;
; Existing configuration
dummy.a4lg.com. 600 IN MX 10 mx1.example.com.
dummy.a4lg.com. 600 IN MX 10 mx2.example.com.
; New configuration you need
; (IP address does not matter but you might need to avoid private IP address range)
dummy.a4lg.com. 600 IN A 1.2.3.4

Maybe we should consider notifying users for this workaround because this is not easy to spot.

Cause

This is caused by validateEmail function in ra/registration-authority.go.

This function originally checked only MX records (using LookupMX) but changed since commit 3ccc79e. Now boulder only checks A records (not MX records and AAAA records either!) which causes several mail address verification failure.

Fix

According to RFC 5321, both MX (mail exchanger) and A/AAAA (address) records must be checked. I proposed replacing LookupHost to just LookupMX first but this is not enough.

Another Bug?

If just DNS response for A record is empty, Python exception should look like this:

Error(typ=u'malformed', detail=u'Error creating new registration :: Validation of contact mailto:dummy@dummy.a4lg.com failed: empty DNS response', title=None)

But I got Server failure at resolver which implies DNS server failure (and an underlying Golang error). I checked the authoritive DNS server (I use) but nothing was wrong (returns NOERROR and no answers).

I think this is related to:

• Either (possibly both but seems unlikely):
  • Unhandled error raised by underlying DNS library
  • Misconfiguration of underlying DNS resolver servers
• ProblemDetailsFromDNSError function in dns/problem.go