Add DNS propagation delay before ACME challenge validation

Wait 5 seconds after publishing DNS-01 TXT records before notifying
the ACME server, giving the DNS server time to propagate the update.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,8 @@
 
 ### Fixes
 
+- Add DNS propagation delay before ACME challenge validation
+
 ### Changes
 
 ## 0.2.0 (2026-04-12)

debian/changelog

@@ -1,6 +1,6 @@
 certforge (0.3.0-1) unstable; urgency=low
 
-  *
+  * Add DNS propagation delay before ACME challenge validation
 
  -- Roman Kivalin <roman@shl.dev>  Sat, 12 Apr 2026 22:30:00 +0000
 

src/renew.rs

@@ -227,6 +227,10 @@ async fn renew_certificate(
 
     // Run the ACME order flow, ensuring TXT cleanup happens even on failure
     let order_result = async {
+        // Wait for DNS propagation
+        tracing::debug!("waiting 5s for DNS propagation");
+        tokio::time::sleep(std::time::Duration::from_secs(5)).await;
+
         // Tell ACME server challenges are ready
         tracing::debug!(name = %cert_config.name, "setting challenges ready");
         AcmeClient::set_challenges_ready(&mut order).await?;