As far as I can tell your name server is correctly resolving your names, what specifically is not resolving?

nslookup mail.botboutique.com.br ns1.locaweb.com.br
Server:  UnKnown
Address:  186.202.8.254
Name:    mail.botboutique.com.br
Address:  191.252.103.63

From what I understand your nginx is not serving the webroot verification correctly, hence the 404 response (doesn't exist). Personally I didn't find the webroot method to be a very easy to use option. I like to use Cloudflare to manage my DNS records, one of it's great features is a free API that allows certbot to directly validate your domain name in DNS.

If you want to try it, sign up at dash.cloudflare.com and add your domain, change your name servers at your registrar to the ones provided by CF. Going forward you will no longer manage your DNS where you did before, now it's on CloudFlare.

To link to the API you'll need to install certbot python3-certbot-dns-cloudflare
then create file with following contents

nano /etc/letsencrypt/cloudflare.passwd
Contents:

dns_cloudflare_email = youremail@domain.tld
dns_cloudflare_api_key = yourapikeygoeshere

chmod 600 /etc/letsencrypt/cloudflare.passwd
certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.passwd -d yourdomain.tld -d *.yourdomain.tld

Now you have a root and wildcard certificate in one

By the way you should set up your reverse PTR to match your FQDN, you'll do that with your hosting/VPS provider

After do eveything step by step, I get this message:

deploy@botboutique:~# certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.passwd -d botboutique.com.br -d *.botboutique.com.br
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator dns-cloudflare, Installer None
Obtaining a new certificate
Performing the following challenges:
dns-01 challenge for botboutique.com.br
dns-01 challenge for botboutique.com.br
Waiting 10 seconds for DNS changes to propagate
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/botboutique.com.br/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/botboutique.com.br/privkey.pem
   Your cert will expire on 2020-09-07. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"
- If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

====================================================================

At first glance, seems that everything runs ok, but I still can't acess mail.botboutique.com.br nor botboutique.com.br/mail/ nor botboutique.com.br/iredadmin, HTTP and HTTPS.

Rough times, trying to install and run iRedMail :-(

Can give me another suggestion, Mup3t33r?

Thanks a lot!

Well it looks like you have your certificate issued successfully!
Did you change your nginx config files when you were trying to do the webroot method?
You might need to revert whatever changes you made there, since we're still getting 404 errors, which means the data was not found on your server

Have you linked your letsencrypt certificate to the default iredmail cert path? and of course restart services.
https://docs.iredmail.org/letsencrypt.h … mbol-links
Although, cloudflare also has you covered with their own SSL cert now

By the way, your SPF record is incomplete, you need to specify which hosts are allowed to send mail for your domain.
You could perhaps use a record like this:
v=spf1 a mx ip4:191.252.103.63 ~all

~all means softfail (accept message but tag it as fail) or if you want strict SPF you can place -all

Oh yes, and one more thing about cloudflare DNS, about the "proxied" status, as this only does HTTPS proxying, not SMTP, you might have delivery issues, if you want to use the proxy then you should create a separate record A/CNAME unproxied to your origin server IP, and set your MX linking to the unproxied host.

EG: Create an A record named "mx" pointing to 191.252.103.63
      update MX record to point to mx.botboutique.com.br

The proxying is entirely optional though, you can get by fine without it, although it does have some nice features so no harm in using it (I do, and love it)

As an example, here's roughly how I have mine set up in screenshot.

EDIT: Your DNS setup won't be exactly the same as mine, as I use a reverse proxy on-premises which handles the splitting of my web servers, mail servers and others behind the same public IP (in total I run more than 10 web servers at the same location, so can't use simple port forwarding...

Mup3t33r,

I have a VPS that my provider registered as vps18569.publiccloud.com.br

And now I saw that I can access Roundcube and iRedAdmin using this adress!!!! More than that: mailboxes in iRedAdmin could only be created with <user>@mail.botboutique.com.br, but the desired is <user>@botboutique.com.br.

What I messed and how to fix it?

Hi, MuPp3t33r!

Is it fixable?

Sure!

00-default.conf:
server {
    # Listen on ipv4
    listen 80;
    listen [::]:80;

    server_name _;

    # Redirect all insecure http:// requests to https://
    return 301 https://$host$request_uri;
}
------------------------------------------------------
00-default-ssl.conf:
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name _;

    root /var/www/html;
    index index.php index.html;

    include /etc/nginx/templates/misc.tmpl;
    include /etc/nginx/templates/ssl.tmpl;
    include /etc/nginx/templates/iredadmin.tmpl;
    include /etc/nginx/templates/roundcube.tmpl;
    include /etc/nginx/templates/sogo.tmpl;
    include /etc/nginx/templates/netdata.tmpl;
    include /etc/nginx/templates/php-catchall.tmpl;
    include /etc/nginx/templates/stub_status.tmpl;
}
---------------------
In 00-default-ssl.conf, diretory  "root /var/www/html;" should be "root /var/www/botboutique.com.br/html", right? Because when I try to acess vps18569.publiccloud.com.br the padlock shows an error of insecure site. Doing this make using an Reverse DNS/Reverse PTR setup not necessary?

Done, the ERR_TOO_MANY_REDIRECTS has gone :-)

Everything done :-)

Now, trying to acess botboutique.com.br AND vps18569.publiccloud.com.br leads to /mail (I can see that's the same mail box,no matter the domain). And now I can receive emails in postmaster@mail.botboutique.com.br, but I the replies didn't come to it's recipient.

A note: I'm learning a lot in this thread :-)

Thanks again!