ACME Cloudflare not working after 3.7.6+

Traefik Traefik v3 (latest)
,
1

Hi guys,

After I upgraded to version 3.7.6+ (Noticed this the first time in 3.7.8) I see the behavior in the log below. The behavior seen in the log goes away if I revert to version 3.7.5.
If you need more info let me know.

traefik  | 2026-07-26T09:38:36Z WRN **Traefik can reject some encoded characters in the request path.When your backend**
 **is not fully compliant with \[RFC 3986\](https://datatracker.ietf.org/doc/html/rfc3986),it is recommended to set thes**
**e options to \`false\` to avoid split-view situation.Refer to the documentation for more details: https://doc.traefik.**
**io/traefik/v3.7/migrate/v3/#encoded-characters-configuration-default-values** 
traefik  | 2026-07-26T09:38:36Z INF **Traefik version 3.7.8 built on 2026-07-15T12:43:11Z** version=3.7.8 
traefik  | 2026-07-26T09:38:36Z INF  
**traefik  |** Version check is disabled. 
traefik  | You will not be notified if a new version is available. 
traefik  | More details: https://doc.traefik.io/traefik/contributing/data-collection/ 
traefik  |  
traefik  | 2026-07-26T09:38:36Z INF **Stats collection is enabled.** 
traefik  | 2026-07-26T09:38:36Z INF **Many thanks for contributing to Traefik's improvement by allowing us to receive** 
**anonymous information from your configuration.** 
traefik  | 2026-07-26T09:38:36Z INF **Help us improve Traefik by leaving this feature on :)** 
traefik  | 2026-07-26T09:38:36Z INF **More details on: https://doc.traefik.io/traefik/contributing/data-collection/** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider aggregator \*aggregator.ProviderAggregator** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider \*file.Provider** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider \*traefik.Provider** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider \*docker.Provider** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider \*acme.ChallengeTLSALPN** 
traefik  | 2026-07-26T09:38:36Z INF **Starting provider \*acme.Provider** 
traefik  | 2026-07-26T09:38:36Z INF **Testing certificate renew...** acmeCA=https://acme-v02.api.letsencrypt.org/directo
ry providerName=cloudflare.acme 
traefik  | 2026-07-26T09:38:37Z INF **Renewing ACME certificate: {Main:\*.dhjensen.tech SANs:\[\]}** acmeCA=https://acme-v0
2.api.letsencrypt.org/directory providerName=cloudflare.acme 
traefik  | 2026-07-26T09:38:37Z INF **Trying renewal.** domains=\*.dhjensen.tech hoursRemaining=408 lib=lego 
traefik  | 2026-07-26T09:38:37Z INF **Obtaining bundled SAN certificate.** domains=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:37Z INF **Use solver.** domain=\*.dhjensen.tech lib=lego type=dns-01 
traefik  | 2026-07-26T09:38:37Z INF **dns01: preparing to solve the challenge.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:38Z INF **dns01: trying to solve the challenge.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:38Z INF **dns01: waiting for record propagation** domain=\*.dhjensen.tech interval=2000 lib=l
ego timeout=120000 
traefik  | 2026-07-26T09:38:40Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:42Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:44Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:46Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:48Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:50Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:56Z INF **The server validated our request.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:56Z INF **dns01: cleaning DNS-01 challenge.** domain=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:56Z INF **Validations succeeded; requesting certificates.** domains=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:57Z INF **Server responded with a certificate.** domains=\*.dhjensen.tech lib=lego 
traefik  | 2026-07-26T09:38:57Z INF **Renewing ACME certificate: {Main:\*.dhjensen.dk SANs:\[\]}** acmeCA=https://acme-v02.
api.letsencrypt.org/directory providerName=cloudflare.acme 
traefik  | 2026-07-26T09:38:57Z INF **Trying renewal.** domains=\*.dhjensen.dk hoursRemaining=408 lib=lego 
traefik  | 2026-07-26T09:38:57Z INF **Obtaining bundled SAN certificate.** domains=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:38:58Z INF **Use solver.** domain=\*.dhjensen.dk lib=lego type=dns-01 
traefik  | 2026-07-26T09:38:58Z INF **dns01: preparing to solve the challenge.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:38:58Z INF **dns01: trying to solve the challenge.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:38:58Z INF **dns01: waiting for record propagation** domain=\*.dhjensen.dk interval=2000 lib=leg
o timeout=120000 
traefik  | 2026-07-26T09:39:01Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:03Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:05Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:07Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:09Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:11Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:13Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:15Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:17Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:19Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:21Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:23Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:25Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:27Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:29Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:31Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:33Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:35Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:37Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:39Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:41Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:43Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:45Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:47Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:49Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:51Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:53Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:55Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:57Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:39:59Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:01Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:03Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:05Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:07Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:09Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:11Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:13Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:15Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:17Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:19Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:21Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:23Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:25Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego 
traefik  | 2026-07-26T09:40:27Z INF **dns01: waiting for record propagation.** domain=\*.dhjensen.dk lib=lego
2

I recommend you place your code/log between 3 backticks and not use the quote function.

What is the issue? It’s waiting forever?

3

It have been ticked.

I see that I didn't read my own logs properly. The dhjensen.tech domain eventually renews succesfully while the dhjensen.dk does not. It eventually times out(Not in posted logs)

But since upgrading to version 3.7.6 and newer I have seen issues with the dhjensen.tech domain as well. It also times out.

4

This may be a regression introduced by the lego v5 upgrade in Traefik v3.7.6.
Could you share the complete final error, especially the last error part?

As a diagnostic workaround, could you try:

propagation:
  requireAllRNS: false

If that resolves the issue, it would strongly indicate a recursive DNS propagation-check regression.

5

The wildcard cert *.dhjensen.tech just ran out without being renewed which is most likely related to my other issues

Here is the log showing dhjensen.dk cert failing DNS-01 challenge and I think the log shows it think the *.dhjensen.tech is valid but thats not the case?

traefik  | 2026-08-10T14:57:41Z INF dns01: cleaning DNS-01 challenge. domain=*.dhjensen.dk lib=lego
traefik  | 2026-08-10T14:57:41Z INF Deactivating authorization. lib=lego url=https://acme-v02.api.letsencrypt.org/acme/authz/2685345881/756855229591
traefik  | 2026-08-10T14:57:41Z ERR Error renewing ACME certificate: {*.dhjensen.dk []} error="resolver: one or more domains had a problem: [*.dhjensen.dk: dns01: time limit exceeded: last error: recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.dk., value: QHDa8THgl7PDAmXbCeuev3X2jm2uJJeIWy4Bf9bSVBY]: If57W7ZYXWAktZsQlH6VK7zxZVUIq1BCN2ZNDf2l0Vw]" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=cloudflare.acme
traefik  | 2026-08-10T14:57:41Z INF Renewing ACME certificate: {Main:node2-daniel-pc.vault.dhjensen.tech SANs:[node3-daniel-pc.vault.dhjensen.tech node1-pi2.vault.dhjensen.tech node2-pi2.vault.dhjensen.tech node3-pi2.vault.dhjensen.tech]} acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=cloudflare.acme
traefik  | 2026-08-10T14:57:41Z INF Trying renewal. domains="node2-daniel-pc.vault.dhjensen.tech, node3-daniel-pc.vault.dhjensen.tech, node1-pi2.vault.dhjensen.tech, node2-pi2.vault.dhjensen.tech, node3-pi2.vault.dhjensen.tech" hoursRemaining=0 lib=lego
traefik  | 2026-08-10T14:57:41Z INF Obtaining bundled SAN certificate. domains="*.dhjensen.tech, node1-daniel-pc.vault.dhjensen.tech, node1-pi2.vault.dhjensen.tech, node2-daniel-pc.vault.dhjensen.tech, node2-pi2.vault.dhjensen.tech, node3-daniel-pc.vault.dhjensen.tech, node3-pi2.vault.dhjensen.tech" lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=node2-pi2.vault.dhjensen.tech lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=node1-daniel-pc.vault.dhjensen.tech lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=node2-daniel-pc.vault.dhjensen.tech lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=node3-pi2.vault.dhjensen.tech lib=lego
traefik  | 2026-08-10T14:57:42Z INF Authorization is already valid; skipping the challenge. domain=node3-daniel-pc.vault.dhjensen.tech lib=lego
``
6

Deleted all the certificates in the store and now it fails to provision the *.dhjensen.tech certificate
I looked up the following and it says its default false config

propagation:
  requireAllRNS: false


traefik  | 2026-08-10T15:09:26Z WRN Traefik can reject some encoded characters in the request path.When your backend is not fully compliant with [RFC 3986](https://datatracker.ietf.org/doc/html/rfc3986),it is recommended to set these options to `false` to avoid split-view situation.Refer to the documentation for more details: https://doc.traefik.io/traefik/v3.7/migrate/v3/#encoded-characters-configuration-default-values
traefik  | 2026-08-10T15:09:26Z INF Traefik version 3.7.10 built on 2026-07-31T12:42:19Z version=3.7.10
traefik  | 2026-08-10T15:09:26Z INF 
traefik  | Version check is disabled.
traefik  | You will not be notified if a new version is available.
traefik  | More details: https://doc.traefik.io/traefik/contributing/data-collection/
traefik  | 
traefik  | 2026-08-10T15:09:26Z INF Stats collection is enabled.
traefik  | 2026-08-10T15:09:26Z INF Many thanks for contributing to Traefik's improvement by allowing us to receive anonymous information from your configuration.
traefik  | 2026-08-10T15:09:26Z INF Help us improve Traefik by leaving this feature on :)
traefik  | 2026-08-10T15:09:26Z INF More details on: https://doc.traefik.io/traefik/contributing/data-collection/
traefik  | 2026-08-10T15:09:26Z INF Starting provider aggregator *aggregator.ProviderAggregator
traefik  | 2026-08-10T15:09:26Z INF Starting provider *file.Provider
traefik  | 2026-08-10T15:09:26Z INF Starting provider *traefik.Provider
traefik  | 2026-08-10T15:09:26Z INF Starting provider *acme.ChallengeTLSALPN
traefik  | 2026-08-10T15:09:26Z INF Starting provider *docker.Provider
traefik  | 2026-08-10T15:09:26Z INF Starting provider *acme.Provider
traefik  | 2026-08-10T15:09:26Z INF Testing certificate renew... acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=cloudflare.acme
traefik  | 2026-08-10T15:09:27Z INF Register... providerName=cloudflare.acme
traefik  | 2026-08-10T15:09:27Z INF Registering the account. email=dhjen@outlook.com lib=lego
traefik  | 2026-08-10T15:09:27Z INF Obtaining bundled SAN certificate. domains=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:27Z INF Use solver. domain=*.dhjensen.tech lib=lego type=dns-01
traefik  | 2026-08-10T15:09:27Z INF dns01: preparing to solve the challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:28Z INF dns01: trying to solve the challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:28Z INF dns01: waiting for record propagation domain=*.dhjensen.tech interval=2000 lib=lego timeout=120000
traefik  | 2026-08-10T15:09:30Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:32Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:34Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:36Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:38Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:40Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:42Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:44Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:47Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:49Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:51Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:53Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:55Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:57Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:09:59Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:01Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:03Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:05Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:07Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:09Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:11Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:13Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:15Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:17Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:19Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:21Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:23Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:25Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:27Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:29Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:31Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:33Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:35Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:37Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:39Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:41Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:43Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:45Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:47Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:49Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:51Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:53Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:55Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:57Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:10:59Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:01Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:03Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:05Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:07Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:09Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:11Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:13Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:15Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:17Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:19Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:21Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:23Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:25Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:27Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:29Z INF dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:31Z INF dns01: cleaning DNS-01 challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-10T15:11:31Z INF Deactivating authorization. lib=lego url=https://acme-v02.api.letsencrypt.org/acme/authz/3618114701/756861683841
traefik  | 2026-08-10T15:11:31Z ERR Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [*.dhjensen.tech]: resolver: one or more domains had a problem: [*.dhjensen.tech: dns01: time limit exceeded: last error: recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: srFa7hLkaHDp1cqQsK9xpDjuqjgaGpQHyzrEztDO0Pc]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI]" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["*.dhjensen.tech"] providerName=cloudflare.acme routerName=dashboard@docker rule=Host(`traefik-pc.dhjensen.tech`)
7

I would try to add debug for more info and set resolvers explicitly.

Example:

command:
  - --log.level=DEBUG
  - --certificatesresolvers.cloudflare.acme.dnschallenge=true
  - --certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare
  - --certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53

If that doesn't help, you should share your full Traefik static and dynamic config.

8

I did try so set the resolvers explicitly but that didnt seem to work based on the debug log output
I migt add again that things work with version 3.7.5

Here Is the log output from a test install with debug enabled

traefik  | 2026-08-14T07:27:06Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > Obtaining bundled SAN certificate. domains=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:06Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Authorization authz=https://acme-v02.api.letsencrypt.org/acme/authz/3630224321/759320924091 lib=lego url=*.dhjensen.tech
traefik  | 2026-08-14T07:27:06Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > Use solver. domain=*.dhjensen.tech lib=lego type=dns-01
traefik  | 2026-08-14T07:27:06Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: preparing to solve the challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:07Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: trying to solve the challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:07Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation domain=*.dhjensen.tech interval=2000 lib=lego timeout=120000
traefik  | 2026-08-14T07:27:10Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:40Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:40Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:42Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:42Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:44Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:44Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:46Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:46Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:48Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:48Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:50Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:50Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:52Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:52Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:54Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:54Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:56Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:56Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:27:58Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:27:58Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:00Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:00Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:02Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:02Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:04Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:04Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:06Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:06Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:08Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:08Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:10Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:10Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:12Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:12Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:14Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:14Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:16Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:16Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:18Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:18Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:20Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:20Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:22Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:22Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:24Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:24Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:26Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:26Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:28Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:28Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:30Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:30Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:32Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:32Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:34Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:34Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:36Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:36Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:38Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:38Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:40Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:40Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:42Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:42Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:44Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:44Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:46Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:46Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:48Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:48Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:50Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:50Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:52Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:52Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:54Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:54Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:56Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:56Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:28:58Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:28:58Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:00Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:00Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:02Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:02Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:04Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:04Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:06Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:06Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:08Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: waiting for record propagation. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:08Z DBG github.com/go-acme/lego/v5@v5.3.1/log/logger.go:33 > Waiting for condition failed. error={"error":"recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g","kind":"*fmt.wrapError","stack":null} lib=lego
traefik  | 2026-08-14T07:29:10Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > dns01: cleaning DNS-01 challenge. domain=*.dhjensen.tech lib=lego
traefik  | 2026-08-14T07:29:10Z INF github.com/go-acme/lego/v5@v5.3.1/log/logger.go:38 > Deactivating authorization. lib=lego url=https://acme-v02.api.letsencrypt.org/acme/authz/3630224321/759320924091
traefik  | 2026-08-14T07:29:11Z ERR github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:574 > Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [*.dhjensen.tech]: resolver: one or more domains had a problem: [*.dhjensen.tech: dns01: time limit exceeded: last error: recursive nameservers: NS 127.0.0.11:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: CqTcn9KBKxjQww0vmrsSPRCI3468cHBke_RRHPnIZaM]: O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g]" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["*.dhjensen.tech"] providerName=cloudflare.acme routerName=dashboard@docker rule=Host(`traefik-test.dhjensen.tech`)
9

And here is the static and dynamic configs
Static:

global:
  checkNewVersion: false
  sendAnonymousUsage: true

entryPoints:
  web:
    address: ":80"
    reusePort: true
    http:
      redirections:
        entryPoint:
          to: websecure
          scheme: https
          permanent: true

  websecure:
    address: ":443"
    http:
      tls:
        certResolver: cloudflare
        domains:
          - main: "*.dhjensen.tech"
    asDefault: true

providers:
  docker:
    network: backend
    defaultRule: "Host(`{{ .ContainerName }}.dhjensen.tech`)"
    exposedByDefault: false
  file:
    directory: "/etc/traefik/dynamic"

accessLog: {}

api:
  dashboard: true
  insecure: false

certificatesResolvers:
  cloudflare:
    acme:
      email: dhjen@outlook.com
      storage: /ssl-certs/acme.json
      dnsChallenge:
        provider: cloudflare

tls:
  stores:
    default:
      defaultGeneratedCert:
        resolver: cloudflare
        domain:
          main: "*.dhjensen.tech"

log:
  level: debug

Dynamic.yml

http:
  serversTransports:
    speedtest-openspeedtest-transport:
      disableHTTP2: true
      forwardingTimeouts:
        responseHeaderTimeout: "999s"
10

Did you set the DNS resolver correctly? It seems to use a non-working local resolver.

Note that a root-level tls: block is not part of a Traefik static configuration, it’s dynamic config.

11

I guess I didn't because it didnt change nameserver with the command: - -- in place in the compose file.

Moving the tls: to dynamic also didn't change anything

12

I couldn't get the command: in docker compose to work so I put the resolvers on static config
I did manage to complete DNS01 certificate validation one time using the new resolvers

However when I did it again I had the same result as the default resolver

traefik  | 2026-08-14T14:58:50Z ERR github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:633 > Unable to obtain ACME certificate for domain error="unable to generate a certificate for the domains [*.dhjensen.tech]: resolver: one or more domains had a problem: [*.dhjensen.tech: dns01: time limit exceeded: last error: recursive nameservers: NS 1.1.1.1:53 did not return the expected TXT record [fqdn: _acme-challenge.dhjensen.tech., value: fWnsEnD8StQp34bgE0CeFziDRoWKy2cYXrK7J4BaU1I]: -ZBkLyZASooVosPNMWmSNg9OOPcAFsBSPwWWgvI3k_I, 1CdkC0GIWMHX6pxjscjCaEqpXMIeSVWScP7MD-KC7Kc, 7MTs2CpOf_WbAkgHqDNJqedpHIagsmuh1e35-yoLPgE, DltjOD7YyLBbdm8PLoPnkd45Qlbqc94RaBRZZlSqCxM, IMcvxuQ2FsJ84G4S8MKhqL1V-voYHPSj20_yykncmZ8, IlVOjvVq2A4-lbXO2ykAzTU-QEe7VwWmrlPTCt1uMEw, MR94DPq2isOgejVj1MZzK-Zd5YzmsCUzHRmYcAao22g, O1q58gKb2k34VfL6I37_ffinaPt31V-UK-FzjadVfLI, O7_T5yE_61f7zAYWMfM3GzhJID1gr-DvrOoILfP3ABo, RYngXyZCcSTv_VKRzTTgCPHn7j7TZEA1p5n13695mRc, Tl2tbEMoUIE9w_f8r0Mzdgz9GJKlmRFowdk7CGdZ-So, keDRLWQEJUFhR4-9bikE_qSFnVVQ9-40N3Y_V77UnPU, mKLOxzW48fF-yJQhO5QEGFuKrqKewtp6OCsyyvbSu4w, zISwlMM-ZH6YjHB59_jmbf3mnYz7IKNSGkPDa8kRUUk]" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["*.dhjensen.tech"] providerName=cloudflare.acme tlsStoreName=default
13

In version 3.7.5 with or without the new resolvers I get a certifcate every time

traefik  | 2026-08-14T15:05:34Z DBG github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:341 > Using DNS Challenge provider: cloudflare providerName=cloudflare.acme
traefik  | 2026-08-14T15:05:34Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Obtaining bundled SAN certificate lib=lego
traefik  | 2026-08-14T15:05:35Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/3631288631/759521694381 lib=lego
traefik  | 2026-08-14T15:05:35Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: use dns-01 solver lib=lego
traefik  | 2026-08-14T15:05:35Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Preparing to solve DNS-01 lib=lego
traefik  | 2026-08-14T15:05:36Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] cloudflare: new record for dhjensen.tech, ID 343b6bcb24e7c96e1b7a181e21133a62 lib=lego
traefik  | 2026-08-14T15:05:36Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Trying to solve DNS-01 lib=lego
traefik  | 2026-08-14T15:05:36Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Checking DNS record propagation. [nameservers=1.1.1.1:53,1.0.0.1:53] lib=lego
traefik  | 2026-08-14T15:05:38Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] Wait for propagation [timeout: 2m0s, interval: 2s] lib=lego
traefik  | 2026-08-14T15:05:38Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Waiting for DNS record propagation. lib=lego
traefik  | 2026-08-14T15:05:40Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Waiting for DNS record propagation. lib=lego
traefik  | 2026-08-14T15:05:49Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] The server validated our request lib=lego
traefik  | 2026-08-14T15:05:49Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Cleaning DNS-01 challenge lib=lego
traefik  | 2026-08-14T15:05:49Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] acme: Validations succeeded; requesting certificates lib=lego
traefik  | 2026-08-14T15:05:52Z DBG github.com/go-acme/lego/v4@v4.35.2/log/logger.go:48 > [INFO] [*.dhjensen.tech] Server responded with a certificate. lib=lego
14

Just weighing in, I am hitting the same problem after using DNS challenge for literally years without any issues. Setting the overrides you suggested works, but my local DNS uses 1.1.1.1 as an upstream and suddenly isn't working for Traefik. Just wanted to add this as I don't think it's limited to just @dhjensen. Before commenting, a colleague of mine noted hitting the same issue and thinking they'd missed something in the release notes.

My setup explicitly sets Docker's DNS as a "Blocky" server, just in case it's environmental and we share a similar setup.

15

Thank you for speaking out as well. It might be some flaw in my setup but the issues came after version 3.7.6. I use a local network DNS server with 8.8.8.8 configured.
I did a little bit of digging and another thing that changed in 3.7.6 was the alpine image version used from 3.23 to 3.24

16 
grep 'waiting for record propagation' traefik.log | head -n 1
2026-07-18T02:02:12Z INF dns01: waiting for record propagation domain=*.domain.org interval=2000 lib=lego timeout=120000

That's the first occurrence of the issue in my logs. I obviously didn't spot it (4838 occurrences of the log in total), and it kept occurring until all my services went down with expired cert errors.

17

I created an issue here: DNS01 challenge not working after version 3.7.6+ · Issue #13697 · traefik/traefik · GitHub

18

The issue was closed referring to the forums.

There might be something wrong with my setup however the issues wasn't there before 3.7.6

Using custom 1.1.1.1:53 resolvers had some effect but after deleting the certificates and trying again it also reached DNS timeout.

Whats next steps?

19

Thanks for filing this! This looks like a regression introduced by a version update. I'll pick it up, so please hold on a bit.

20

Thank you for reopening the issue and filling in the information gap. It now makes a lot more sense now :wink:

I suppose since I use docker I will just configure the propagation.requireAllRNS=false in all my setups no matter if you decide to honer the traefik defaults or the new lego defaults.

I have also implemented Uptime Kuma certificate monitoring just in case the cert renewal goes sideways again