AutoSSL DNS-01 retry behavior and propagation handling for wildcard certificates

Context

cPanel's AutoSSL feature issues wildcard certificates only through the DNS-01 challenge type, which requires the configured DNS provider to expose API hooks for TXT record creation. When the DNS provider module lacks these hooks, or when propagation delays across clustered nameservers cause temporary validation failures, AutoSSL does not automatically retry the validation. Administrators must manually trigger a new check via WHM or the UAPI SSL::start_autossl_check call, or wait for the next scheduled run.

Constraints and uncertainty

• No built-in propagation wait or verification step exists before the CA is asked to validate the DNS-01 record.
• AutoSSL logs may not clearly distinguish between a permanent configuration error (missing API hooks) and a transient propagation delay.
• CAA record pre-validation is not performed, so issuance failures surface only after the CA rejects the request.

Questions

1. Is there a documented maximum number of DNS-01 validation attempts AutoSSL will make for a single wildcard certificate request before marking it as failed?
2. Can the propagation wait interval be configured or extended through WHM's Manage AutoSSL Providers interface or via a server-wide configuration file?
3. Does the autossl_check scheduler differentiate between retryable DNS propagation errors and non-retryable provider misconfigurations when deciding whether to re-queue a domain?