# Cloudflare: failed to find zone DOMAIN

**URL:** <https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [September 19, 2023, 6:28am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884 "2023-09-19T06:28:20Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 19, 2023, 6:28am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/1 "2023-09-19T06:28:20Z")

</div>

Hi There. I'm getting the `failed to find zone <insert my.domain here> : ListZonesContext command failed: Invalid request headers (6003)` error.

I need it to successfully get the certs so when I load the traefik web interface the https certs show up as valid. Currently, when I go to to the traefik interface, the https certs are shown as invalid. I.e. I appear to be getting the default treafik cert.

I've looked at a few posts here with similar issue, such as [this one](https://community.traefik.io/t/need-help-cloudflare-failed-to-find-zone-domain-net/18038). However, following those configs just doesn't appear to fix my problem.

Is there something wrong with my config?

Here are each of my config files.

`docker-compose.yml`

```yml
version: '3'

services:
  traefik:
    image: traefik:latest
    container_name: traefik
    restart: unless-stopped
    security_opt:
      - no-new-privileges:true
    networks:
      - proxy
    ports:
      - 80:80
      - 443:443

    environment:
      - CF_API_EMAIL=redacted@email.com
      #- CF_DNS_API_TOKEN=redactedAPItoken
      - CF_API_KEY=YOUR_API_KEY=RedactedAPIkey
      # be sure to use the correct one depending on if you are using a token or key
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - /home/mux/dockerfiles/traefik/data/traefik.yml:/traefik.yml:ro
      - /home/mux/dockerfiles/traefik/data/acme.json:/acme.json
      - /home/mux/dockerfiles/traefik/data/config.yml:/config.yml:ro
    
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.traefik.entrypoints=http"
      - "traefik.http.routers.traefik.rule=Host(`traefik-dashboard.local.redaced.domain`)"
      - "traefik.http.middlewares.traefik-auth.basicauth.users=redacted@email.com:redacetedSaltedPassword"
      - "traefik.http.middlewares.traefik-https-redirect.redirectscheme.scheme=https"
      - "traefik.http.middlewares.sslheader.headers.customrequestheaders.X-Forwarded-Proto=https"
      - "traefik.http.routers.traefik.middlewares=traefik-https-redirect"
      - "traefik.http.routers.traefik-secure.entrypoints=https"
      - "traefik.http.routers.traefik-secure.rule=Host(`traefik-dashboard.local.redacted.domain`)"
      - "traefik.http.routers.traefik-secure.middlewares=traefik-auth"
      - "traefik.http.routers.traefik-secure.tls=true"
      - "traefik.http.routers.traefik-secure.tls.certresolver=cloudflare"
      - "traefik.http.routers.traefik-secure.tls.domains[0].main=local.redacted.domain"
      - "traefik.http.routers.traefik-secure.tls.domains[0].sans=*.local.redacted.domain"
      - "traefik.http.routers.traefik-secure.service=api@internal"

networks:
  proxy:
    external: true

```

`traefik.yml`

```yml

api:
  dashboard: true
  debug: true
entryPoints:
  http:
    address: ":80"
  https:
    address: ":443"
serversTransport:
  insecureSkipVerify: true
providers:
  docker:
    endpoint: "unix:///var/run/docker.sock"
    exposedByDefault: false
  file:
    filename: /config.yml
certificatesResolvers:
  cloudflare:
    acme:
      email: redacted@email.com
      storage: acme.json
      dnsChallenge:
        provider: cloudflare
        resolvers:
          - "1.1.1.1:53"
          - "1.0.0.1:53"

```

I spin up the container with a :

` docker-compose up -d --build --force-recreate`

it comes up and I can login to the website, albeit with the invalid https certificates.

the error I see in the logs is :

```auto
traefik | time="2023-09-18T21:57:48-07:00" level=error msg="Unable to obtain ACME certificate for do
mains \"local.redacted.domain,*.local.redacted.domain\"" rule="Host(`traefik-dashboard.loca
l.redacted.domain`)" error="unable to generate a certificate for the domains [local.redacted.domain *.local.redacted.domain]: error: one or more domains had a problem:\n[*.local.redacted.domain] [*.local.redacted.domain] acme: error presenting token: cloudflare: failed to find
zone redacted.domain.: ListZonesContext command failed: Invalid request headers (6003)\n[local.redacted.domain] [local.redacted.domain] acme: error presenting token: cloudflare: failed to
 find zone redacted.domain.: ListZonesContext command failed: Invalid request headers (6003)\n"
providerName=cloudflare.acme ACME CA="https://acme-v02.api.letsencrypt.org/directory" routerName=trae
fik-secure@docker

```

my acme.json., oddly , appears to be getting something after I spin up the

`acme.json`

```json
{
  "cloudflare": {
    "Account": {
      "Email": "redacted@email.com",
      "Registration": {
        "body": {
          "status": "valid",
          "contact": [
            "mailto:redacted@email.com"
          ]
        },
        "uri": "https://acme-v02.api.letsencrypt.org/acme/acct/1313638246"
      },
      "PrivateKey": "MIIJKAIBBq+8wz8ViR7jOgwRrJmFRRDL_REDACTED-KEY_S/cQ=",
      "KeyType": "4096"
    },
    "Certificates": null
  }
}

```

I'm new to Cloudflare, but I _think_ I'm configuring it correctly. see image attached.

 ![cloudflare](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/d/dc480cae61a1fd14f0a59d148e9c2041311e2b95.jpeg)

my home router is forwarding port 80 and port 443 to my internal server, and the router's firewall has the same allowed.

When I load the traefik web interface I'm not seeing valid https certificates come to my browser. And I'm seeing the above described `failed to find zone ` error. How do I fix this?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 19, 2023, 7:44pm UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/2 "2023-09-19T19:44:59Z")

</div>

If you have multiple levels (sub2.sub1.domain.tld), I would assume you need to create an DNS wildcard entry for every level.

---

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 21, 2023, 6:30am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/3 "2023-09-21T06:30:26Z")

</div>

@bluepuma77  
I added the additional record for \*.sub1.domain.tld. Unfortunately it didn't fix the issue. i.e. Same error still results.

 ![Capture2](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/4/4ebdb09a8fd92180c1275fe7c56ac3f586ab2c52.jpeg)

current cloudflare config.:

 ![Capture](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/b1ea339d29fb77f21b0e9b1756b24bbed97f700d.jpeg)

Where each of the A records are being pointed to my currently assigned IP address I've received from ISP.

Any other ideas?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 21, 2023, 7:06am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/4 "2023-09-21T07:06:38Z")

</div>

Sometimes there is an issue with Traefik LetsEncrypt and CNAME, try enabling and disabling the setting ([doc](https://doc.traefik.io/traefik/https/acme/#dnschallenge)).

---

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 21, 2023, 8:16am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/5 "2023-09-21T08:16:43Z")

</div>

@bluepuma77

I added `LEGO_DISABLE_CNAME_SUPPORT=false` to my docker-compose.yml while my cloudflare dns settings were configured in the [above mentioned way](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/3) with the CNAME record. Same error still results.

I tried changing it to `- LEGO_DISABLE_CNAME_SUPPORT=true` in the environments section my `docker-compose.yml`.

And I changed my cloudflare DNS to use all `A` records.

 ![Capture3](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/b17baba1069480d70ef034dd2955fb8ec838a889.jpeg)

I stopped my traefik container. and then re-ran it with a:  
`~/dockerfiles/traefik$ docker-compose up -d --build --force-recreate`

Unfortunately, even here, the same error is still occurring.

Thanks for the help so far. What else should I look at to troubleshoot?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 21, 2023, 8:27am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/6 "2023-09-21T08:27:26Z")

</div>

You posted your `PrivateKey`, make sure to change it.

You got `error presenting token` and `Invalid request headers`, maybe your CF credentials are wrong? ([doc](https://doc.traefik.io/traefik/https/acme/#providers))

> `CF_API_EMAIL`, `CF_API_KEY` [[5](https://doc.traefik.io/traefik/https/acme/#fn:5)]  
> or  
> `CF_DNS_API_TOKEN`, `[CF_ZONE_API_TOKEN]`

---

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 21, 2023, 8:54am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/7 "2023-09-21T08:54:30Z")

</div>

@bluepuma77

> [@muxketeer](#):
>
> `"PrivateKey": "MIIJKAIBBq+8wz8ViR7jOgwRrJmFRRDL_REDACTED-KEY_S/cQ=",`

Thankfully, that isn't my private key. I removed most of it and replaced the removed part with `_REDACTED-KEY_`. I'm still secure there.

I've triple checked. The value I'm using for ` CF_API_KEY` in my `docker-compose.yml` matches the value for ` Global API Key` in my cloudflare account.

regarding `CF_DNS_API_TOKEN, ` ... It's my understanding that I should use either the key (which is what I'm using) or the Token. Not both. Is that incorrect?

I also don't see a way, in cloudflare, to generate a ZONE api token .I only see a way to generate an API token.

I believe I have a zone token , generated. not sure.  
I.e. in cloudfront I have the following setup

 ![capture4](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/0/03f5d9697862e3691f94ba21ccbaea67af1e915e.jpeg)

see that it is pointing to one zone in my account (the one with my domain)

and the permissions on the account and ... then the zone (see the sub group below the permissions) are all `read` except for `DNS` which is marked as `edit` permissions.

 ![Capture5](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/9/9ae74e9736d7174dce5566d116ac44a1092d4e60.jpeg)

But, again, I'm not using this token ... as you can see in my config in my docker-compose.yml. (it's commented out). I orginally chose the API\_key route because when I first tried with the API-token, my local traefik web interface wasn't showing the login challenge for some reason.

Should I be specifying both the token and the api\_key? both of them?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 21, 2023, 10:53am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/8 "2023-09-21T10:53:34Z")

</div>

This is a Traefik forum. You probably better check if there is a forum for the used library [le-go](https://github.com/go-acme/lego) or check directly at a Cloudflare forum.

My understanding is you use `CF_API_EMAIL` and `CF_API_KEY` or only `CF_DNS_API_TOKEN`. But I am not a CF user.

---

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 22, 2023, 7:55pm UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/9 "2023-09-22T19:55:57Z")

</div>

Ok. Understood that this is Traefik forum. I’ll go ahead and check if maybe Lego or maybe CF forums have info regarding this issue, specific to their domains of influence. Will update if I’m pointed back to issue being within Traefik domain of influence.

I’ll also try the combinations of environment variables to see if that changes things.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 22, 2023, 9:52pm UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/10 "2023-09-22T21:52:34Z")

</div>

Did you try searching for "Traefik Cloudflare Zone"? You will find a lot of posts with issues, some resolved like [this one](https://community.cloudflare.com/t/i-need-cf-zone-api-token-for-traefik-setting-but-dont-know-how-create-it/418006/).

---

<div class="post-metadata">

**Author:** ![muxketeer](https://avatars.discourse-cdn.com/v4/letter/m/71c47a/32.png) [@muxketeer](https://community.traefik.io/u/muxketeer)\
**Post date:** [September 23, 2023, 5:39am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/11 "2023-09-23T05:39:09Z")

</div>

@bluepuma77  
Yes, I did search through this forum. I had seen that post. No, it did not help me. However, I did, separately, fix my problem. As always: "it's dns. it's always dns." Regardless I appreciate the assistance.

And for good measure, I'll detail what I did to fix this, here. In hopes it also helps guide whoever runs into something similar next time.

fyi, all my config is derived from the helpful [Techno Tim video about ssl](https://youtu.be/liV3c9m_OX8?si=6HKPuJV5fXjztlcI). No sarcasm, it's really great.

So, in order to fix this there are some elements about Cloudflare that aren't quite covered in said video ... or much of any homelab-type of youtube videos.

The important part is the [api tokens section of the lego documentation that talks about cloudflare config](https://go-acme.github.io/lego/dns/cloudflare/#api-tokens). It's important that this is followed. And to pay special attention to the part that says "You also need to scope the access to all your domains for this to work."

I looked at [this cloudflare documentation about generally creating an api key](https://blog.cloudflare.com/api-tokens-general-availability/), and applied the aformentioned specific Lego documentation to this more simple process. I.e. I created the token like this

 ![Capture6](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/0/013bcb6b67801c1f67519962905c2b7b852787df.jpeg)

I left my dns wildcard and forwarding rules the way they are shown in [my previous message](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/5).

I changed the `environment:` area of my `docker-compose.yml` to the following:

```yml
environment:
      #- CF_API_EMAIL=redacted@tmail.com
      - CF_DNS_API_TOKEN=RedactedTokenCreatedWithCorrectCloudFlareOptionsNotedAbove
      #- CF_API_KEY=YOUR_API_KEY=redacted
      # be sure to use the correct one depending on if you are using a token or key
      #- LEGO_DISABLE_CNAME_SUPPORT=true

```

Note , not using email env variable + api token env variable. just token env variable.  
Then stopped my traefik server. After saving all the above changes, I started my traefik server with a:  
`~/dockerfiles/traefik$ docker-compose up -d --build --force-recreate`

and gave it a minute to acquire certs. Then opened a incognito browser (no lingering certs that may be used) and went to the dns url of my traefik server via https. then , shazam! HTTPS certs come across to the browser and everything in the https chain works and the certs and valid!

Phew.

Thanks again for the assist.

Edit:

Prologue:

it's pretty wild that CF\_API\_KEY didn't work. it's supposed to give Lego full access, but clearly it doesn't.

Also, after some testing, I was able to remove all my dns rules and just have one dns rule that pointed domain.my to my internet public IP address.. The rest I handle internally inside my internal home network via pihole dns serving.

That's all folks. Happy proxy-ing!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [September 26, 2023, 5:39am UTC](https://community.traefik.io/t/cloudflare-failed-to-find-zone-domain/19884/12 "2023-09-26T05:39:35Z")

</div>

Closed on September 26, 2023, 5:39am UTC

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.