Hi Netlify team,
Site: darling-strudel-999fcb
Custom domain: grupoadm.net.br (and www.grupoadm.net.br)
Our Let’s Encrypt wildcard certificate (*.grupoadm.net.br, grupoadm.net.br) expired on Sep 1, 2026 and is not auto-renewing. Attempting to renew from the dashboard fails with:
SniCertificate error (CertificateValidationError) - NXDOMAIN looking up TXT for _acme-challenge.grupoadm.net.br
Investigating, I found that although a Netlify DNS zone already exists for grupoadm.net.br (showing as fully configured/green in the dashboard, and correctly mirroring all our MX/SPF/DKIM/DMARC records for our email provider plus other CNAME/TXT records), the domain’s actual NS delegation at our registrar was NOT pointed to Netlify’s nameservers. This looks like the “inactive/orphaned Netlify DNS zone” scenario described in your own troubleshooting docs - the DNS-01 challenge can’t complete because Netlify isn’t authoritative for the zone in the real world, even though the dashboard shows it as active.
To fix this at the root, I updated the nameservers at our registrar (Registro.br) to Netlify’s dns1-4.p06.nsone.net and confirmed the change was saved successfully on the registrar side. However, more than 15 hours later, public resolvers (checked via dns.google) still return the old nameservers - propagation seems stuck well beyond the normal timeframe for a .br domain.
As a secondary attempt, I removed and re-added the custom domain in the dashboard, hoping it would trigger a fresh non-wildcard certificate. This didn’t help: the certificate’s “Domains” field is unchanged (still *.grupoadm.net.br, grupoadm.net.br, same created/updated/expired timestamps), and now the domain panel shows “grupoadm.net.br doesn’t appear to be served by Netlify” - and the self-service “Renew certificate” button is gone (only “Set custom certificate” remains). For what it’s worth, the site is still reachable and correctly served over HTTPS via Netlify’s edge when I hit it directly, so this looks like a stale/false-negative check rather than an actual new outage.
Could someone from the team take a look and manually re-check the DNS zone activation and/or reissue the certificate for this domain? I also noticed a couple of other recent topics in this Support category with very similar “stuck” Let’s Encrypt / DNS zone symptoms posted around the same time, in case this is a broader issue.
Happy to provide any additional logs or details. Thanks in advance!