# Acme: error presenting token: cloudflare: could not find zone for domain

**URL:** https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707
**Category:** Traefik v2
**Tags:** letsencrypt-acme
**Created:** [March 4, 2024, 2:37am UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707 "2024-03-04T02:37:26Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![netris](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@netris](https://community.traefik.io/u/netris)
#### Post date: [March 4, 2024, 2:37am UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/1 "2024-03-04T02:37:26Z")

</div>

I've got Traefik setup as a Docker container, and have been running it just fine for the longest time. I was looking at logs today because I was notified that one of my certs has expired, and I see the following in the container logs:

```auto
time="2024-03-04T02:13:33Z" level=error msg="Error renewing certificate from LE: {sub1.domain.com []}" providerName=cloudflare.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" error="error: one or more domains had a problem:\n[sub1.domain.com] [sub1.domain.com] acme: error presenting token: cloudflare: could not find zone for domain \"sub1.domain.com\" (_acme-challenge.sub1.domain.com.): unexpected response code 'SERVFAIL' for _acme-challenge.sub1.domain.com.\n"

```

I've looked at all the similar topics, and tried many things, but none seem to apply in this situation. The part that makes this weird, is that I have about a dozen other certs that Traefik issued for subdomains of `domain.com` (Obviously not the real domain name). As a test case, I deleted a couple of them from the acme.json, and it had no issue issuing new ones for those subdomains, just for this one particular it won't renew. Any thoughts?

Here are the pertinent bits from Docker:

```auto
version: "3.3"

services:

  traefik:
    image: "traefik:v2.11"
    container_name: "traefik"
    restart: unless-stopped
    command:
      - "--log.level=INFO"
      - "--accesslog=true"
      - "--accesslog.filepath=./access.log"
      - "--accesslog.bufferingsize=100"
      - "--serverstransport.insecureskipverify=true"
      - "--providers.docker=true"
      - "--providers.file.filename=/config.yml"
      - "--providers.file.watch=true"
      - "--providers.docker.exposedbydefault=false"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge=true"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge.provider=cloudflare"
      #- "--certificatesresolvers.cloudflare.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"
      - "--certificatesresolvers.cloudflare.acme.email=<REDACTED>"
      - "--certificatesresolvers.cloudflare.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.cloudflare.acme.dnschallenge.resolvers=1.1.1.1:53,1.0.0.1:53"

      - "--certificatesresolvers.le.acme.tlschallenge=true"
      - "--certificatesresolvers.le.acme.email=<REDACTED>"
      - "--certificatesresolvers.le.acme.storage=/letsencrypt/acme.json"
      #- "--certificatesresolvers.le.acme.caserver=https://acme-staging-v02.api.letsencrypt.org/directory"

      - "--entrypoints.websecure.http.tls=true" # websecure entrypoint is always tls
      - "--entrypoints.web.http.redirections.entryPoint.to=websecure" # global http to https redirect to entrypoint websecure
      - "--entrypoints.web.http.redirections.entryPoint.scheme=https" # global http to https redirect schema rewrite
      - "--entrypoints.websecure.http.tls.certresolver=cloudflare" # websecure entrypoint (https) should use CF resolver by default
      - "--entrypoints.websecure.http3" # <== ADD
      - "--experimental.http3=true" # <== ADD
    
    environment:
      - CF_API_EMAIL=<REDACTED>
      - CF_DNS_API_TOKEN=<REDACTED>

```

Here are the pertinent bits from the config where this subdomain is pulled from:

```auto
http:
  routers:
    sub1:
      service: sub1
      entrypoints: "websecure"
      rule: "Host(`sub1.domain.com`)"
      middlewares:
        - "secureHeaders"
      tls:
        certResolver: cloudflare

  services:
    sub1:
      loadBalancer:
        servers:
          - url: "http://192.168.2:80"
  

```

---

<div class="post-metadata">

### Author: ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [March 5, 2024, 7:39am UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/2 "2024-03-05T07:39:25Z")

</div>

Do sub-domain and domain exist with Cloudflare?

---

<div class="post-metadata">

### Author: ![netris](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@netris](https://community.traefik.io/u/netris)
#### Post date: [March 5, 2024, 12:09pm UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/3 "2024-03-05T12:09:49Z")

</div>

Yes, they are. I didn’t explicitly state that because I figured it would be obvious given this is a renewal, but yes.

---

<div class="post-metadata">

### Author: ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [March 5, 2024, 4:30pm UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/4 "2024-03-05T16:30:09Z")

</div>

Post about `SERVFAIL` ([link](https://blog.cloudflare.com/unwrap-the-servfail/)).

It still sound to me like the sub-domain is not configured the same way the other working sub-domains are.

---

<div class="post-metadata">

### Author: ![netris](https://avatars.discourse-cdn.com/v4/letter/n/919ad9/32.png) [@netris](https://community.traefik.io/u/netris)
#### Post date: [March 5, 2024, 5:46pm UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/5 "2024-03-05T17:46:51Z")

</div>

How could it be a sub domain configuration issue when 1) the DNS auth is configured just to authenticate that you own the domain, and 2) you can issue a cert for a subdomain not in dns so long as you prove the auth that you own the domain.  
If you can point to something specific you’d like for me to check I’m happy to look, but pure speculation “just because” isn’t terribly helpful.

---

<div class="post-metadata">

### Author: ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)
#### Post date: [March 5, 2024, 6:05pm UTC](https://community.traefik.io/t/acme-error-presenting-token-cloudflare-could-not-find-zone-for-domain/21707/6 "2024-03-05T18:05:34Z")

</div>

`zone` usually indicates an issue with missing or mismatched sub-domain settings.

Sorry that I am just guessing, other answers probably have better ideas how to fix it.