Cert-manager challenge hangs at "Waiting for dns-01 challenge propagation: DNS record

Hi All,

i am not sure if this is the right forum for this question. I am stuck, so trying to see if someone has any idea about this issue.

My domain is:
skgtestk8s.com its registered with google domains

I ran this command:
kubectl get challenge

Kubernetes yaml files

apiVersion: cert-manager.io/v1alpha3
kind: Issuer
name: letsencrypt-staging
server: https://acme-staging-v02.api.letsencrypt.org/directory
email: sgk@gmail.com
name: letsencrypt-staging
- dns01:
project: white-ci-273105
name: clouddns-dns01-solver-svc-acct
key: key.json

apiVersion: cert-manager.io/v1alpha3
kind: Certificate
name: test
namespace: default
secretName: test-tls
name: letsencrypt-staging

It produced this output:

My web server is (include version):
i don't have web server

The operating system my web server runs on is (include version):
* Kubernetes version: v1.16.13-gke.1
* Cloud-provider/provisioner: GKE
* cert-manager version: v0.16.1
* Install method (e.g. helm or static manifests):
helm3 install cert-manager --namespace cert-manager --version v0.16.1 jetstack/cert-manager --set installCRDs=true --set 'extraArgs={--dns01-recursive-nameservers=,,ns-cloud-a1.googledomains.com:53}'

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
Google Console

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you're using Certbot):
Kubernetes version: v1.16.13-gke.1

Cert manager challenge hangs with following message.
"Waiting for dns-01 challenge propagation: DNS record for "skgtestk8s.com" not yet propagated"

kubectl get challenge

Presented: true
Processing: true
Reason: Waiting for dns-01 challenge propagation: DNS record for “skgtestk8s.com” not yet propagated
State: pending
Type Reason Age From Message

Normal Started 46m cert-manager Challenge scheduled for processing
Normal Presented 46m cert-manager Presented challenge using dns-01 challenge mechanism

CloudDNS shows challenge records


Just so the screenshot isn’t hidden in a code block:

It doesn’t seem that the records are actually visible, though. Google Cloud nameservers are a giving me a NXDOMAIN response for those records.

Is it definitely the correct Google Cloud DNS account that owns the DNS zone, being updated? And definitely the right nameservers (ns-cloud-c{1,2,3,4}.googledomains.com)?

I know with some DNS providers it’s (confusingly) possible to add a single domain to many accounts, but only one actually really controls it after verifying it.

Sorry, I deleted the certificate which also deleted those records.

Please try now. I tried creating a certificate those records should be visible. i can see them in CloudDNS

This is definitely the wrong Google Cloud account, or the wrong DNS zone.

Look at the nameserver list: it’s ns-cloud-a{1,2,3,4}.googledomains.com.

However, at your domain registrar, you have these NS configured:

skgtestk8s.com.         172800  IN      NS      ns-cloud-c1.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c2.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c3.googledomains.com.
skgtestk8s.com.         172800  IN      NS      ns-cloud-c4.googledomains.com.

Note the difference - a vs c.

If you want to use this Google Cloud DNS Zone, you’ll have to update your domain registrar to use the a nameservers.

1 Like

sorry, i had to bump the TTL. Here is the latest ones created

Thanks!!, a lot. i will try changing and let you know results

1 Like


Glad to see you got your domain registered today :smiley:

Thanks a lot!!! that was THE problem. i really appreciate your help!

I am new, learning setting up a domain and a dns zone. It’s so confusing to really distinguish roles of domain and dnz done servers


This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.