Zone could not be found

[shotor]

Welcome

• Yes, I'm using a binary release within 2 latest releases.
• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've included all information below (version, config, etc).

What did you expect to see?

The DNS challenge to be performed and a certificate to be obtained

What did you see instead?

ERR github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:457 > Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [app.example.com]: error: one or more domains had a problem:\n[app.example.com] [app.example.com] acme: error presenting token: cloudflare: failed to find zone com.: zone could not be found\n"

How do you use lego?

Through Traefik

Reproduction steps

1. Add cloudflare as certifcate resolver to traefik
2. Add host label to app container
3. Start app container

Version of lego

Traefik version: 3.2.1

Logs

I read multiple issues that suggest the problem might be due to SOA dns requests.

I'm running this on a server on my home network that hijacks all DNS traffic and forward it to adguard home.

The funny thing is I was able to generate certs for 3 apps. But none since. And as far as I can tell the SOA lookups are okay.

dig @1.1.1.1 -t SOA app.example.com +recurse +nocomment

; <<>> DiG 9.18.28-1~deb12u2-Debian <<>> @1.1.1.1 -t SOA app.example.com +recurse +nocomment
; (1 server found)
;; global options: +cmd
;app.example.com.           IN      SOA
example.com.            1800    IN      SOA     alex.ns.cloudflare.com. dns.cloudflare.com. 2359040828 10000 2400 604800 1800
;; Query time: 11 msec
;; SERVER: 1.1.1.1#53(1.1.1.1) (UDP)
;; WHEN: Sat Dec 07 09:37:20 CET 2024
;; MSG SIZE  rcvd: 110

Go environment (if applicable)

$ go version && go env
# paste output here

[ldez]

Hello,

• Is your domain related to a CNAME?
• Have you checked the adguard logs?
• Have you set the resolvers? https://doc.traefik.io/traefik/https/acme/#resolvers

Your problem is related to your network.

[shotor]

Is your domain related to a CNAME?

No, the domain is exclusively used on my local network. There are no public DNS entries for the entire domain.

Have you checked the adguard logs?

While traefik is trying the DNS challenge I see DNS requests coming into adguard for acme-v02.api.letsencrypt.org and api.cloudflare.com. I don't see any SOA requests.

Have you set the resolvers? https://doc.traefik.io/traefik/https/acme/#resolvers

This did the trick. Although confusingly so:

My router hijacks every :53 connection and forwards it to adguard.

After adding resolvers to my traefik config that actually seems to be happening: I'm seeing SOA requests in the adguard logs. While before I wasn't seeing them.

[ldez]

I hope you enjoyed my work, please consider donating.
My only source of revenue is donations.
This will be appreciated, thank you ❤️

https://github.com/sponsors/ldez