[0xJacky]

Problem

NGINX UI 2.x waited only for the authoritative nameservers during DNS-01, because local resolvers such as systemd-resolved at 127.0.0.53 often do not return a fresh TXT record in time (0xJacky/nginx-ui#1711, #1719). This plugin also checked the recursive resolvers unless the certificate turned that off, so issuance that worked on 2.x stalled after the upgrade with recursive nameservers: NS 127.0.0.53:53 did not return the expected TXT record (0xJacky/nginx-ui#2115).

Fix

• dns01.check queries the recursive resolvers only when the certificate sets the new option check_recursive_ns_propagation: true. The older disable_recursive_ns_propagation can only keep the check off: the 1.0.0 form wrote false for every certificate it saved, so treating that as opt-in would have kept the stall for them.
• With both nameserver checks off, dns01.check answers unsupported, so NGINX UI falls back to its fixed 60-second wait before validation (what the form's "When off, waits a fixed 60 seconds" says). Without this, the record would be reported ready at once.
• The challenge form starts with Check public resolvers off, writes the new option, and the Advanced options summary lists a switch only when it differs from its default. No new strings.
• README updated.

Tests

• TestCheckSkipsRecursiveResolversByDefault goes through Handler.Check with a recursive resolver that refuses every query. On main it fails (Detail = "recursive nameservers: DNS call to 127.0.0.1:1 failed ..."); here the check goes on to the authoritative nameservers.
• TestCheckWithBothChecksOffDefersToTheHost fails on this branch's first commit (record reported ready at once) and passes now.
• Option mapping table (missing, legacy true/false, new true/false/"true", new true with legacy false), recursive-only still queries the resolvers, other switches and settings pass through.
• go test -race -count=1 ./... ok on main and here; gofmt, go vet, webapp vue-tsc and build, plugin.json check clean.
• An independent review of the first commit found the two problems above; both are fixed and covered by tests.

🤖 Generated with Claude Code