Traefik ACME DNS Challenge fails although correct TXT record is present

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: colinp.de

I ran this command: I used Traefik's integrated ACME client to request a wildcard cert. The same issue also appeared a few months ago for non-wildcard certs which is why I used the HTTPS challenge for the last months instead. The DNS challenge has worked in the past.

It produced this output: 2026-03-05T09:20:09Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [colinp.de *.colinp.de]: error: one or more domains had a problem:\n[*.colinp.de] propagation: time limit exceeded: last error: authoritative nameservers: NS casey.ns.cloudflare.com.:53 did not return the expected TXT record [fqdn: _acme-challenge.colinp.de., value: RhBjfpgc_mT-RPn_l3G0FtBvYK6PXcUoGvtJQ7oq8zM]: \n[colinp.de] propagation: time limit exceeded: last error: authoritative nameservers: NS casey.ns.cloudflare.com.:53 did not return the expected TXT record [fqdn: _acme-challenge.colinp.de., value: Eyvw6T35iMoCmdrv6Zota9mCsz3Ovq3q6SraXCjwfaI]: \n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["colinp.de","*.colinp.de"] providerName=cloudflare.acme routerName=immich@docker rule=Host(`immich.colinp.de`)

I did check the TXT record while Traefik tried getting the certificate via dig txt _acme-challenge.colinp.de @cecelia.ns.cloudflare.com -4 and it did return the correct string for multiple minutes before the request failed.

My web server is (include version): Traefik 3.6.9

The operating system my web server runs on is (include version): TrueNAS CE 25.10.2.1

My hosting provider, if applicable, is: ---

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Traefik 3.6.9

2

After reading a bit more in this forum I tried disabling the prechecks just for fun - that works but that can'T be the final solution right?

1 Like
3

Seems like Traefik tries to do a pre-flight check (which in itself is a good thing), but is prevented from doing an outbound DNS query. Check your firewall, or see whether it could do a query through a DNS resolver that it has access to.

5 Likes
4

I check that by running nslookup from within the traefik container (explicitly against cecelia.ns.cloudflare.com) - that works.

5

Unfortunately, my knowledge of Traefik ends here. Maybe try asking in their community forums?

2 Likes
6

I will, thanks nonetheless.

2 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.