Certbot DNS SERVFAIL: inspect domain and CNAME resolution
Trace A, AAAA and CNAME answers to the authoritative servers when Certbot fails with DNS SERVFAIL.
KAN KAI WORKS · Help
Help for n8n, Make, Nextcloud, tunnels and certificates
Automation and access can fail at several handoffs: the trigger, a queue, a permission check, the connection or the destination system. Select a guide using the product and exact message. A manual test and a real production run may follow different paths.
Which handoff is missing evidence?
- No start or missing message: Check the trigger and environment that were actually addressed.
- Failure after a retry: Inspect the destination state before starting another execution.
- Tunnels, DNS or TLS: Separate name resolution, connection establishment and the availability of the underlying service.
- Nextcloud or ERP: Record the version, affected data and last change before repeating an update or recovery.
These guides cover different systems and causes. Match the product, operating mode and version to the individual case, then verify the result at the actual destination.
Certbot
Certbot renewal fails: check manual auth hooks and timers
Check the actual Certbot executable, authentication method and scheduler separately before a certificate expires unnoticed.
Certbot wildcard with --standalone: DNS-01 is required
Identify the unsupported authenticator combination and plan a renewable DNS challenge for your wildcard certificate.
Cloudflare Tunnel
Cloudflare Tunnel Healthy but the application is unreachable
Compare the public response, connector and origin separately.
Cloudflare WARP private DNS: diagnose missing replies
Separate resolver reachability, DNS policy and UDP/TCP behaviour when WARP can no longer resolve internal names.
cloudflared QUIC CRYPTO_ERROR 0x178: check the handshake
Distinguish UDP reachability from a successful QUIC handshake and run a limited HTTP/2 comparison where appropriate.
cloudflared on Linux: .local origin returns no such host
Check name resolution inside the connector environment when a .local service works on other devices.
Cloudflare Tunnel ERR_TOO_MANY_REDIRECTS: trace the loop
Trace Location headers and the origin scheme when an application enters a redirect loop through the tunnel.
cloudflared connectTimeout: immediate origin i/o timeout
Compare saved remote configuration, expected units and elapsed time when an origin request times out immediately.
Cloudflare Tunnel WebSocket 1006: inspect the handshake
Trace the WebSocket handshake to the origin when live updates fail but ordinary HTTP requests still work.
Frappe / ERPNext
ERPNext blocks backdated batch entries after reconciliation
A later Stock Reconciliation blocks an earlier batch entry? Inspect document chronology, affected batch and version before changing records.
Frappe / ERPNext Germany: conflicting Tenacity dependencies
Installation requires incompatible Tenacity 8.2 and 9.1 ranges? Compare exact app revisions and dependencies instead of forcing alternating versions.
Frappe CRM asset build: DataImport MISSING_EXPORT
CRM assets fail with MISSING_EXPORT after a Frappe update? Compare the component interface and matching CRM version before applying local patches.
Let’s Encrypt
Let's Encrypt AAAA error: check the IPv6 validation path
Compare IPv4 and IPv6 on the same challenge path when the website works but certificate renewal fails.
Let's Encrypt HTTP-01: timeouts from some validation paths
Compare the same challenge path from independent networks and match both successful and missing requests to your logs.
Make
Make Custom Webhook: check Unauthorized and API-key access
Opening a webhook URL returns Unauthorized? Check its API-key header, IP rules and actual hook identity without removing protection.
Make Google Sheets / Drive: No access token specified
A Google connection exists but Sheets or Drive return 403? Separate OAuth completion, connection identity and access to the actual file.
Make: linked feeder was not found when resuming a run
An incomplete Make execution fails at an aggregator? Inspect saved run state, Source Module and data completeness before restarting.
Make Google Sheets Search Rows returns just one bundle
Several spreadsheet rows but one result? Compare spreadsheet ID, sheet, range and the actual module output before downstream filters.
Make HTTP: Airtable webhook returns 422 but curl works
curl works but Make returns a parameter-validation error? Compare the transmitted JSON body, headers and resolved values.
Make Iterator: Array empty despite existing source data
The source contains several items but Iterator receives nothing? Check the field path, array type and module reference in the same execution.
n8n
n8n production webhook: HTTP 500 with no visible execution
Separate request arrival, execution storage and the target system.
n8n retry: investigate duplicate records and actions
An n8n run failed after the target already processed its request? Reconcile business references and retry behaviour before repeating the action.
n8n HTTP Request: diagnose connect ETIMEDOUT errors
n8n cannot reach an HTTPS API that opens in your browser? Separate connection establishment, source network and HTTP response.
n8n and Supabase: investigate a self-signed certificate
Postgres connection fails with a certificate-chain error? Check the endpoint, trust chain and the differences between Cloud and self-hosting.
n8n Data Table: investigate .item errors after a lookup
Item links fail after Get row(s)? Check match counts, empty results and business IDs before data is assigned to the wrong record.
n8n: excessive API calls and 429 after multiple branches
429 or concurrency errors after n8n branches converge? Inspect node invocations, item counts and the intended aggregation separately.
n8n cannot publish: entry with this name already exists
Publication reports an existing name after deployment? Compare the running n8n version with database migration history before duplicating workflows.
n8n Schedule Trigger not firing: investigate silent gaps
Scheduled processing goes quiet? Check publication, timezone and expected business output, then monitor missed successful runs.
n8n Connection lost: check the editor and running workflows
Blank n8n editor or repeated disconnects? Separate browser, connection and backend health without replaying active operations.
Instagram DMs missing in n8n despite working webhook tests
Instagram test events work but real messages are missing? Trace event delivery, the public route and the n8n production endpoint.
n8n Cloud executions stuck on Queued or Starting soon
Executions remain queued or the instance restarts? Inspect backlog, active runs and workload before replaying incoming events.
n8n SQLITE_CORRUPT: preserve the database before recovery
A corrupt SQLite database stops n8n? Preserve the original, companion files and key, then assess recovery on an isolated copy.
n8n Docker: diagnose getaddrinfo EAI_AGAIN and DNS
A hostname fails to resolve from n8n? Inspect container DNS, service names and destination ports in the relevant network.
Nextcloud
Nextcloud upgrade stuck: needsDbUpgrade and table errors
Assess needsDbUpgrade and an already existing table safely.
Nextcloud file locked: check DAV locks and write access
Saving fails with Sabre DAV Locked? Identify the lock mechanism and distinguish it from filesystem permissions before removing anything.
Nextcloud updater: Write permissions check still fails
An update stops at its write-permission check? Identify the exact path, effective PHP user and mount permissions before changing ownership.
Nextcloud ignores php.ini: check effective PHP settings
Upload limits or PHP values remain unchanged? Compare web SAPI, CLI and the configuration actually loaded before reinstalling PHP.
Nextcloud Collabora: diagnose Document loading failed
Office connection appears healthy but documents will not load? Check browser access and both server-to-server connection directions.
Nextcloud group folders missing after update: check IDs
Team files remain on storage but folders disappear from Nextcloud? Check app state, folder configuration and group access before recreating them.
Nextcloud update: investigate unknown files detected
Unknown files detected within the installation folder? Identify the reported files and preserve evidence before cleaning the installation.
Nextcloud deletes client files after a storage change
Files disappear after a mount or sharing change? Pause synchronisation, preserve local copies and establish server and storage state.
Nextcloud reads Samba files but cannot save changes
Reading works but saving returns Permission denied? Distinguish a local bind mount from SMB access and identify the effective writing identity.
Nextcloud AIO domain validation fails behind a reverse proxy
AIO reports a domain or reverse-proxy problem? Check DNS, APACHE_PORT and the upstream actually reachable from the proxy.
nginx
nginx on Windows: diagnose cannot load certificate errors
Compare nginx’s certificate path with the actual file, startup directory and permissions before issuing replacement certificates.
SWAG
SWAG DuckDNS KO: diagnose wildcard certificate renewal
Check the DuckDNS response, domain ownership and published TXT record when SWAG cannot renew its wildcard certificate.
Synology DSM
Synology DSM: maximum certificate requests reached
Separate the DSM message from a confirmed ACME rate limit and check domain validation and certificate assignment.
UpdraftPlus
UpdraftPlus Google Drive: error 401 deleted_client
Identify the OAuth client and preserve existing backups before authorising the Drive connection again.
Wordfence
Wordfence: wordfence-waf.php missing in extended protection
Check the bootstrap file, actual website path and PHP configuration in the correct order.
Wordfence: lost authenticator and recovery codes
Choose an authorised owner-recovery route and fully re-establish two-factor protection afterward.
Explore all 100 troubleshooting guides →
Your issue is not listed?
Describe the affected system, the visible problem and when it started. That gives us a starting point for the next check.
Describe a different issue →