Error unquoting TXT/SPF record: invalid syntax

[jjanyan]

This week I updated my caddy server build and plugins, which includes caddy-dns/route53 which in turn uses this library.

For certain domains (and subdomains) that I'm generated certs for, I'm receiving this error:

2022/10/27 21:05:28.225 ERROR tls.obtain could not get certificate from issuer {"identifier": "crossbar.org", "issuer": "acme-v02.api.letsencrypt.org-directory", "error": "[crossbar.org] solving challenges: presenting for challenge: adding temporary record for zone "crossbar.org.": Error unquoting TXT/SPF record: invalid syntax (order=https://acme-staging-v02.api.letsencrypt.org/acme/order/73962564/4806343264) (ca=https://acme-staging-v02.api.letsencrypt.org/directory)"}

I receive a similar error for crossbar.org and any subdomain on it. I've tried a dozen other domains that we manage and none have had an issue.

I'm currently using

dep	github.com/libdns/route53	v1.3.0	h1:f41D9uUK7Gib8Zbg3LtAXfxGRFlqfR4gep+FsthDFg0=
dep	github.com/caddy-dns/route53	v1.3.0	h1:g/VIZKbaKEog3DCTankthLJBQYbZgQ+1pIOCyxrZntQ= # not sure if this is useful

Any ideas on what could be the issue here? Thanks!

[jjanyan]

Digging in a bit more, I think the issue is related to having a TXT record greater than 255 characters.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#TXTformat-limits

If you need to enter a value longer than 255 characters, break the value into strings of 255 characters or fewer, and enclose each string in double quotation marks ("). In the console, list all the strings on the same line:

"String 1" "String 2" "String 3"

The maximum length of a value in a TXT record is 4,000 characters.

[jjanyan]

I added a PR for this #21

[jonbuda]

we're also seeing this now, but for only one of our wildcard domains. not sure why it's happening now, but is there going to be a permanent fix for this? we're also on Caddy 2.6.2 and route53 1.3.0

[jjanyan]

@jonbuda if you're time sensitive, i'd suggest cloning my repo that includes a fix. you can get to it via the PR mentioned above. then using your clone to make a custom build of caddy.
here's my custom build for reference

GOOS=linux GOARCH=amd64 xcaddy build --with github.com/caddy-dns/route53@v1.3.0 --with github.com/techknowlogick/certmagic-s3@v1.2.3 --with github.com/lib
    dns/route53@v1.3.0=github.com/jjanyan/route53@master

[jonbuda]

@jonbuda if you're time sensitive, i'd suggest cloning my repo that includes a fix. you can get to it via the PR mentioned above. then using your clone to make a custom build of caddy. here's my custom build for reference

GOOS=linux GOARCH=amd64 xcaddy build --with github.com/caddy-dns/route53@v1.3.0 --with github.com/techknowlogick/certmagic-s3@v1.2.3 --with github.com/lib
    dns/route53@v1.3.0=github.com/jjanyan/route53@master

Thanks @jjanyan - we finally got it working but not 100% sure it was from your fix, which we did try out. I think it was due to a malformed TXT record in our Route53 zone that this plugin couldn't parse. I'm going to try to replicate it in another zone.

[BirkhoffLee]

@jonbuda if you're time sensitive, i'd suggest cloning my repo that includes a fix. you can get to it via the PR mentioned above. then using your clone to make a custom build of caddy. here's my custom build for reference

GOOS=linux GOARCH=amd64 xcaddy build --with github.com/caddy-dns/route53@v1.3.0 --with github.com/techknowlogick/certmagic-s3@v1.2.3 --with github.com/lib
    dns/route53@v1.3.0=github.com/jjanyan/route53@master

Thanks @jjanyan - we finally got it working but not 100% sure it was from your fix, which we did try out. I think it was due to a malformed TXT record in our Route53 zone that this plugin couldn't parse. I'm going to try to replicate it in another zone.

Indeed! That was the culprit of my case -- there was a malformed TXT record in my zone that looks like

"blahblahverylongstring""anotherlongstring""yetanother"

I went to the console and followed their instructions to split them into different lines and it worked!

[aymanbagabas]

Could anyone confirm that #45 is working properly?