@@ -39,17 +39,31 @@ struct CloudflareResponse<A> {
 
 #[derive(Deserialize)]
 struct CloudflareError {
+    #[serde(default)]
+    code: u64,
     #[serde(default)]
     message: String,
 }
 
+#[derive(Deserialize)]
+struct Listed {
+    id: String,
+    #[serde(default)]
+    content: String,
+}
+
+/// Cloudflare's error for a record that exists with the same name and content.
+const CLOUDFLARE_IDENTICAL_RECORD: u64 = 81058;
+
 #[derive(Deserialize)]
 struct Created {
     id: String,
 }
 
 impl DnsProvider {
-    /// Creates a TXT record `name` (a full name, `_acme-challenge.<host>`) with `value`, TTL 60.
+    /// Creates a TXT record `name` (a full name, `_acme-challenge.<host>`) with `value`, TTL 60. A record that
+    /// already exists with that value (left by an interrupted attempt) is used as is, and deleted afterwards
+    /// like a created one.
     pub async fn create_txt(&self, name: &str, value: &str) -> Result<TxtRecord> {
         match self {
             Self::Cloudflare {
@@ -76,6 +90,21 @@ impl DnsProvider {
                         value: value.into(),
                         id: Some(created.id),
                     }),
+                    _ if body.errors.iter().any(|error| {
+                        error.code == CLOUDFLARE_IDENTICAL_RECORD
+                            || error.message.contains("identical record already exists")
+                    }) =>
+                    {
+                        let id = self.find_txt(name, value).await.unwrap_or_else(|error| {
+                            warn!(%error, name, "failed to look up an existing challenge record");
+                            None
+                        });
+                        Ok(TxtRecord {
+                            name: name.into(),
+                            value: value.into(),
+                            id,
+                        })
+                    }
                     _ => {
                         let messages: Vec<String> = body
                             .errors
@@ -111,6 +140,39 @@ impl DnsProvider {
         }
     }
 
+    /// The ID of the Cloudflare TXT record `name` with `value`, if there is one.
+    async fn find_txt(&self, name: &str, value: &str) -> Result<Option<String>> {
+        let Self::Cloudflare {
+            http,
+            api,
+            zone_id,
+            token,
+        } = self
+        else {
+            return Ok(None);
+        };
+        let mut url = url::Url::parse(&format!("{api}/zones/{zone_id}/dns_records"))?;
+        url.query_pairs_mut()
+            .append_pair("type", "TXT")
+            .append_pair("name", name);
+        let body: CloudflareResponse<Vec<Listed>> = http
+            .get(url)
+            .bearer_auth(token)
+            .timeout(Duration::from_secs(30))
+            .send()
+            .await?
+            .error_for_status()?
+            .json()
+            .await?;
+        // Cloudflare may show TXT content quoted.
+        Ok(body
+            .result
+            .unwrap_or_default()
+            .into_iter()
+            .find(|record| record.content.trim_matches('"') == value)
+            .map(|record| record.id))
+    }
+
     /// Deletes a record, logging rather than failing: a leftover TXT record is harmless.
     pub async fn delete_txt(&self, record: &TxtRecord) {
         let result = match self {
 
@@ -14,11 +14,13 @@ use crate::acme::Challenge;
 use crate::clock::{DAY_MS, HOUR_MS, MINUTE_MS};
 use crate::crypto::uuid;
 use crate::issuer::Issuer;
+use crate::retry;
 use crate::service::{RENEW_BEFORE_MS, Service};
 use crate::store::{Job, JobKind, LEASE_MS, ServerCertificate};
 use crate::tls;
 
-/// Attempts per job, like the Workflow step's two retries.
+/// Attempts per job for failures that are not known to be transient, like the Workflow step's two retries.
+/// Transient ones are retried for `retry::RETRY_WINDOW_MS`.
 pub const ATTEMPTS: u32 = 3;
 const PERSIST_FAILED: &str = "Failed to persist certificate state: tunnel or certificate not found";
 /// Imported issuance gets this long to finish on the Worker before this server takes it over.
@@ -247,18 +249,19 @@ impl Jobs {
                         .await
                         .map(drop);
                 }
-                if attempts < ATTEMPTS {
-                    let delay = self.retry_delay_ms * (1 << (attempts - 1));
+                let class = retry::classify(&error);
+                if let Some(at) = retry::next_attempt(
+                    class,
+                    attempts,
+                    self.retry_delay_ms,
+                    job.created_at,
+                    now,
+                    retry::jitter(),
+                ) {
+                    info!(certificate = %job.certificate_id, attempt = attempts, ?class, in_ms = at - now, "retrying certificate issuance");
                     return service
                         .store
-                        .retry_job(
-                            &job.certificate_id,
-                            owner,
-                            attempts,
-                            now + delay,
-                            reason,
-                            now,
-                        )
+                        .retry_job(&job.certificate_id, owner, attempts, at, reason, now)
                         .await
                         .map(drop);
                 }
@@ -334,6 +337,14 @@ pub async fn run_reconcile(service: Service) {
             Ok(resumed) => info!(resumed, "resumed certificate issuance without a job"),
             Err(error) => error!(%error, "resuming certificate issuance failed"),
         }
+        match service.retry_failed_issuance().await {
+            Ok(0) => {}
+            Ok(requeued) => info!(
+                requeued,
+                "queued transiently failed certificate issuance again"
+            ),
+            Err(error) => error!(%error, "queueing failed certificate issuance again failed"),
+        }
     }
 }
 
 
@@ -20,6 +20,7 @@ pub mod net;
 pub mod proxy_protocol;
 pub mod record;
 pub mod relay;
+pub mod retry;
 pub mod server;
 pub mod service;
 pub mod sni;