DNS challenge isn't working with cloudflare #1595

New Issue

MrUnknownDE · 2026-04-05T19:36:23+02:00

MrUnknownDE commented

2026-04-05 19:36:23 +02:00

Originally created by @cantchooseaname8 on 4/21/2025

The DNS challenge isn't working with cloudflare. All of the configs are set up and it correctly adds the necessary txt records to my domain's dns. So it clearly has access to add the txt records, but traefik does not seem to even recognize them. The logs for traefik always result in an error saying the propagation time limit was exceeded. I have it set up and working perfectly in NPM without any issues. I was also able to generate certs through caddy with a dns challenge for cloudflare. I'm not sure if there is something broke with the implementation between traefik and cloudflare, but it seems to just ignore the txt records for the dns challenge and no certs are issued.

Here is what the records show (changed the name of my actual domain to domain.com so it's not listed here):

ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [pangolin.domain.com]: error: one or more domains had a problem:\n[pangolin.domain.com] propagation: time limit exceeded: last error: authoritative nameservers: NS porter.ns.cloudflare.com.:53 returned REFUSED for domain.com.\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["pangolin.domain.com"] providerName=letsencrypt.acme routerName=api-router@file rule="Host(pangolin.domain.com) && PathPrefix(/api/v1)"

*Originally created by @cantchooseaname8 on 4/21/2025* The DNS challenge isn't working with cloudflare. All of the configs are set up and it correctly adds the necessary txt records to my domain's dns. So it clearly has access to add the txt records, but traefik does not seem to even recognize them. The logs for traefik always result in an error saying the propagation time limit was exceeded. I have it set up and working perfectly in NPM without any issues. I was also able to generate certs through caddy with a dns challenge for cloudflare. I'm not sure if there is something broke with the implementation between traefik and cloudflare, but it seems to just ignore the txt records for the dns challenge and no certs are issued. Here is what the records show (changed the name of my actual domain to domain.com so it's not listed here): `ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [pangolin.domain.com]: error: one or more domains had a problem:\n[pangolin.domain.com] propagation: time limit exceeded: last error: authoritative nameservers: NS porter.ns.cloudflare.com.:53 returned REFUSED for domain.com.\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["pangolin.domain.com"] providerName=letsencrypt.acme routerName=api-router@file rule="Host(`pangolin.domain.com`) && PathPrefix(`/api/v1`)"`

MrUnknownDE closed this issue

2026-04-05 19:36:23 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#1595