Async-only zone jobs left Ladill NS returning REFUSED for new domains, which surfaces as Let's Encrypt SERVFAIL during SSL issuance. Co-authored-by: Cursor <cursoragent@cursor.com>