Sudden auth failures with DNS challenge

Help
1

My domain is: imdbratings.ancha.dev

I ran this command: not relevant

It produced this output:
2026-08-11T07:35:53Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [imdbratings.ancha.dev]: resolver: one or more domains had a problem: [imdbratings.ancha.dev: dns01: time limit exceeded: last error: recursive nameservers: NS 46.38.225.230:53 did not return the expected TXT record

My web server is (include version): Traefik 3 latest (Docker)

The operating system my web server runs on is (include version): Linux

My hosting provider, if applicable, is: Netcup

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Traefik 3 latest

I have been running Traefik in Docker with Cloudflare DNS for a few years now without issues. Yesterday I tried to add a new service and hostname and suddenly ran into auth failures. As visible in the log output above, LE tries to query the DNS server 46.38.225.230, which belongs to my hosting provider. I have not changed the DNS setup in years and as far as I can tell, it still all points to Cloudflare's DNS servers. LE's queries fail, because I am not adding anything to my hoster's DNS. I can see the validation tokens in Cloudflare's DNS, so that part is all fine. The only mystery is why LE suddenly queries the wrong DNS server.

I hope someone here has some ideas. I am completely lost.

2

@EchoVandal, welcome to the community! :slightly_smiling_face:

The good news is that your domain on the authoritative DNS servers is in a good shape. The error message is likely originating from the ACME client and probably is a pre-check before contacting the ACME server. As you mentioned that the IP 46.38.225.230 is belonging to the hosting provider Netcup, and it provides recursive DNS service. Likely that one is having trouble. I suggest to retry, and if it is still failing, you may wish to contact your hosting provider.

3

Thank you for the quick help. I misunderstood the error message and you helped me see that. The issue was that Traefik tried the default DNS to see if the entry exists before contacting Let's Encrypt. But the default DNS of my hosting provider caches rather aggressively and the entry did not show up before the timeout. The solution was to provide an explicit resolver for the ACME challenge using acme.dnsChallenge.resolvers. I set it to 1.1.1.1, Cloudflare's own public DNS and this immediately fixed the issue.