onetimesecret/onetimesecret · error · Onetime::LimitExceeded

DNS verification rate limit exceeded. Please wait before try

Error message

DNS verification rate limit exceeded. Please wait before trying again.

What it means

Error "DNS verification rate limit exceeded. Please wait before trying again." thrown in onetimesecret/onetimesecret.

Source

Thrown at lib/onetime/security/dns_rate_limiter.rb:100

      #
      # @param domain_id [String] The domain's unique identifier
      # @raise [Onetime::LimitExceeded] If rate limit is exceeded
      # @return [Hash] Rate limit status with :remaining and :reset_in keys
      def check_dns_rate_limit!(domain_id)
        return default_rate_limit_status if domain_id.to_s.empty?

        key = dns_rate_limit_key(domain_id)

        # Atomically check limit and increment if allowed via server-side Lua script
        current_count, ttl, _was_new_key, limit_exceeded = redis.eval(
          CHECK_AND_INCREMENT_SCRIPT,
          keys: [key],
          argv: [RATE_WINDOW, MAX_VERIFICATIONS],
        )

        if limit_exceeded == 1
          OT.li "[DnsRateLimiter] Domain #{domain_id[0..7]} rate limited: #{current_count}/#{MAX_VERIFICATIONS}, reset in #{ttl}s"
          raise Onetime::LimitExceeded.new(
            'DNS verification rate limit exceeded. Please wait before trying again.',
            retry_after: ttl > 0 ? ttl : RATE_WINDOW,
            attempts: current_count,
            max_attempts: MAX_VERIFICATIONS,
          )
        end

        remaining = MAX_VERIFICATIONS - current_count
        reset_in  = ttl > 0 ? ttl : RATE_WINDOW

        if remaining <= 2
          OT.li "[DnsRateLimiter] Domain #{domain_id[0..7]} approaching limit: #{current_count}/#{MAX_VERIFICATIONS}"
        end

        {
          remaining: remaining,
          reset_in: reset_in,
          current: current_count,

View on GitHub (pinned to f81295e41b)

Solutions

1. Wait before retrying DNS verification; confirm the TXT record is correct first so fewer attempts are needed.

When it happens

Trigger: Thrown at lib/onetime/security/dns_rate_limiter.rb:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of onetimesecret/onetimesecret@f81295e41b (2026-08-23). Data as JSON: /api/errors/80658b62a06fd28e. Report an issue: GitHub.