{"record":{"id":"a568106497039137","repo":"caddyserver/caddy","slug":"unable-to-publish-ech-data-to-https-dns-record-w","errorCode":null,"errorMessage":"unable to publish ECH data to HTTPS DNS record: %w (zone=%s dns_record_name=%s)","messagePattern":"unable to publish ECH data to HTTPS DNS record: %w \\(zone=(.+?) dns_record_name=(.+?)\\)","errorType":"exception","errorClass":"PublishECHConfigListErrors","httpStatus":null,"severity":"warning","filePath":"modules/caddytls/ech.go","lineNumber":895,"sourceCode":"\t\t\tcontinue\n\t\t}\n\t\tparams := httpsRec.Params\n\t\tparams = dnsPub.publishedSvcParams(domain, params, configListBin)\n\n\t\t// publish record\n\t\t_, err = dnsPub.provider.SetRecords(ctx, zone, []libdns.Record{\n\t\t\tlibdns.ServiceBinding{\n\t\t\t\t// HTTPS and SVCB RRs: RFC 9460 (https://www.rfc-editor.org/rfc/rfc9460)\n\t\t\t\tScheme:   \"https\",\n\t\t\t\tName:     relName,\n\t\t\t\tTTL:      5 * time.Minute, // TODO: low hard-coded value only temporary; change to a higher value once more field-tested and key rotation is implemented\n\t\t\t\tPriority: 2,               // allows a manual override with priority 1\n\t\t\t\tTarget:   \".\",\n\t\t\t\tParams:   params,\n\t\t\t},\n\t\t})\n\t\tif err != nil {\n\t\t\terrs[domain] = fmt.Errorf(\"unable to publish ECH data to HTTPS DNS record: %w (zone=%s dns_record_name=%s)\", err, zone, relName)\n\t\t\tcontinue\n\t\t}\n\t}\n\n\tif len(errs) > 0 {\n\t\treturn errs\n\t}\n\treturn nil\n}\n\nfunc (dnsPub *ECHDNSPublisher) publishedSvcParams(domain string, existing libdns.SvcParams, configListBin []byte) libdns.SvcParams {\n\tparams := make(libdns.SvcParams, len(existing)+2)\n\tfor key, values := range existing {\n\t\tparams[key] = append([]string(nil), values...)\n\t}\n\n\tparams[\"ech\"] = []string{base64.StdEncoding.EncodeToString(configListBin)}\n","sourceCodeStart":877,"sourceCodeEnd":913,"githubUrl":"https://github.com/caddyserver/caddy/blob/50e54ee279aa1e504fe218ca49ab6ae16c100410/modules/caddytls/ech.go#L877-L913","documentation":"The final write of ECH DNS publishing: dnsPub.provider.SetRecords sets the HTTPS ServiceBinding record (priority 2, target '.', TTL 5m, ech SvcParam merged with existing params). Failure is wrapped with zone and record name context and collected into PublishECHConfigListErrors for that domain. Causes are provider-side: auth, permissions, zone mismatch, rate limits, or API errors.","triggerScenarios":"SetRecords for <relName> HTTPS RR in <zone> rejected: token lacks write scope, zone not managed by that provider account, provider API 4xx/5xx, concurrent modification conflict.","commonSituations":"Read-only DNS token; domain's DNS hosted at a different provider than configured; publishing during a provider outage; very long record sets exceeding provider limits.","solutions":["Use the zone= and dns_record_name= in the message plus the wrapped error to pinpoint the rejected write.","Grant the token write access for that zone (or move DNS hosting to the configured provider).","Retry after rate-limit windows; spread publications if many domains.","Verify manually that the API token can create HTTPS/SVCB records via the provider's console."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"var perrs caddytls.PublishECHConfigListErrors\nif errors.As(err, &perrs) {\n    for d, e := range perrs {\n        if strings.Contains(e.Error(), \"unable to publish ECH data\") {\n            // zone/record named in message; fix token write scope or zone hosting, then reload\n        }\n    }\n}","preventionTips":["Verify the account/token actually manages the DNS zone of each ECH name.","Test one HTTPS record write via the provider API before wide rollout.","Expect retries: ECH republish happens on maintenance intervals, so transient API errors self-heal."],"tags":["tls","ech","dns","api","https-record"],"backgroundTag":null,"analyzedSha":"50e54ee279aa1e504fe218ca49ab6ae16c100410","analyzedAt":"2026-08-15T09:20:21.641Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}