ACME: "server misbehaving"

Traefik Traefik v3 (latest)
,
1

Today I received notifications that me server certificates have expired. The logfile entries say this.

2026-06-26T11:44:19Z INF Error renewing ACME certificate: {Main:nextcloud.domain.one SANs:[]} error="get directory at 'https://acme-v02.api.letsencrypt.org/directory': Get \"https://acme-v02.api.letsencrypt.org/directory\": dial tcp: lookup acme-v02.api.letsencrypt.org on 127.0.0.11:53: server misbehaving" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=myresolver.acme

From using the search on this forum I found out that this means traefik likely cannot resolve the ACME server, but I don't know why that would be.

Here's my full config.

services:
  traefik:
    image: "traefik:latest"
    container_name: "traefik"
    domainname: "domain.one"
    restart: always
    cap_drop:
      - ALL
    cap_add:
      - NET_ADMIN
      - NET_BIND_SERVICE
    command:
      - "--global.sendAnonymousUsage=false"

      - "--log.level=INFO"
      - "--log.filePath=/log/traefik.log"
      - "--log.format=common"

      - "--accesslog=true"
      - "--accesslog.format=common"
      - "--accesslog.filepath=/log/access.log"

      - "--api=true"
      - "--api.dashboard=true"

      - "--providers.docker=true"
      - "--providers.docker.network=traefik_proxy"  # use this network to connect to other containers
      - "--providers.docker.exposedbydefault=false"
      - "--providers.file.directory=/rules"
      - "--providers.file.watch=true"

      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.redirections.entrypoint.to=websecure"
      - "--entrypoints.websecure.address=:443"
      - "--entrypoints.websecure.http3=true"
      ### for jitsi:
      # - "--entrypoints.video-tcp.address=:4443/tcp"
      # - "--entrypoints.video-udp.address=:10000/udp"

      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
      - "--certificatesresolvers.myresolver.acme.email=webmaster@domain.one"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      # - "--certificatesResolvers.myresolver.acme.caServer=https://acme-staging-v02.api.letsencrypt.org/directory"

    ports:
      - "80:80"
      - "443:443"
      ### for jitsi:
      # - "4443:4443"
      # - "10000:10000"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "./rules:/rules:ro"
      - "/var/run/docker.sock:/var/run/docker.sock:ro"
      - "./log:/log:rw"
      - "./auth:/auth:ro"
    networks:
      - traefik_proxy
      - bridge
    labels:
      - "traefik.enable=true"

      - "traefik.http.routers.dashboard.rule=Host(`traefik.domain.one`)"
      - "traefik.http.routers.dashboard.entrypoints=websecure"
      - "traefik.http.routers.dashboard.service=api@internal"
      - "traefik.http.routers.dashboard.tls.certresolver=myresolver"
      - "traefik.http.routers.dashboard.middlewares=securityheaders-all@docker,permissionspolicy-default@docker,authenticate@docker"

      - "traefik.http.middlewares.authenticate.basicauth.usersfile=/auth/usersfile"

      - "traefik.http.middlewares.securityheaders-default.headers.framedeny=true"
      - "traefik.http.middlewares.securityheaders-default.headers.customFrameOptionsValue=SAMEORIGIN"
      - "traefik.http.middlewares.securityheaders-default.headers.contentTypeNoSniff=true"
      - "traefik.http.middlewares.securityheaders-default.headers.stsPreload=true"
      - "traefik.http.middlewares.securityheaders-default.headers.stsIncludeSubdomains=true"
      - "traefik.http.middlewares.securityheaders-default.headers.stsSeconds=31536000"
      - "traefik.http.middlewares.securityheaders-default.headers.forceSTSHeader=true"

      - "traefik.http.middlewares.securityheaders-onlystrict.headers.contentSecurityPolicy=script-src 'self'"
      - "traefik.http.middlewares.securityheaders-onlystrict.headers.referrerPolicy=same-origin"

      - "traefik.http.middlewares.securityheaders-all.chain.middlewares=securityheaders-default@docker,securityheaders-onlystrict@docker"

      - "traefik.http.middlewares.permissionspolicy-lenient.headers.customResponseHeaders.Permissions-Policy=geolocation 'none'; microphone 'none'; autoplay 'self'; camera 'none'; display-capture 'none'; midi 'none'; payment 'none'; fullscreen 'self'"
      - "traefik.http.middlewares.permissionspolicy-default.headers.customResponseHeaders.Permissions-Policy=geolocation 'none'; microphone 'none'; autoplay 'none'; camera 'none'; display-capture 'none'; midi 'none'; payment 'none'; fullscreen 'none'"

    logging:
      options:
        max-size: '12m'
        max-file: '5'
      driver: json-file

networks:
  traefik_proxy:
    name: traefik_proxy
    external: true
  bridge:
    driver: bridge

What can I do here? Thanks in advance.

2

Are you using a special DNS service, like Pi-Hole or AdGuard?

Did it work with the same allowed network capabilities before?

3

No custom DNS server on the machine. Yes, it used to work with the same settings for years.

Found the fix in the meantime (with the help of Claude). The solution was to add

dns:
  - "8.8.8.8"

to the config. Now don't ask why it worked without that line for years. :man_shrugging:

Anyway, thanks for your help.