# DNS-01 Challenge sync

**URL:** <https://community.traefik.io/t/dns-01-challenge-sync/11231>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme\
**Created:** [July 19, 2021, 6:45pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231 "2021-07-19T18:45:45Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yamakasi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/yamakasi/32/3966_2.png) [@Yamakasi](https://community.traefik.io/u/Yamakasi)\
**Post date:** [July 19, 2021, 6:45pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/1 "2021-07-19T18:45:45Z")

</div>

Is there any chance to see somewhere in the docs if Traefik waits for a DNS sync between DNS servers when doing a DNS-01 challenge ?

I would like to know how Traefik handles the timeout on sync of the TXT between the DNS servers when you actually API to one of them.

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 7:06pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/2 "2021-07-19T19:06:10Z")

</div>

Hello @Yamakasi,

Traefik verifies that the txt record is created before allowing your CA to validate the record.

If you are encountering large propogation delays, you can also use the `delayBeforeCheck` option that will allow you to delay before checking ([Let's Encrypt - Traefik](https://doc.traefik.io/traefik/https/acme/#dnschallenge))

---

<div class="post-metadata">

**Author:** ![Yamakasi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/yamakasi/32/3966_2.png) [@Yamakasi](https://community.traefik.io/u/Yamakasi)\
**Post date:** [July 19, 2021, 7:20pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/3 "2021-07-19T19:20:05Z")

</div>

Hi @daniel.tomcej ,

Thank you for your reply, I hoped so, and this is good.

But does it check all DNS servers, can you confirm that ? How does that mechanism work?

Thanks for the delay tip!

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 19, 2021, 7:27pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/4 "2021-07-19T19:27:07Z")

</div>

Hello @Yamakasi,

The lego client checks that the record has propogated to all authoritative nameservers:

> <https://github.com/go-acme/lego/blob/master/challenge/dns01/precheck.go#L55>

and it is used here:

> <https://github.com/traefik/traefik/blob/master/pkg/provider/acme/provider.go#L274>

---

<div class="post-metadata">

**Author:** ![Yamakasi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/yamakasi/32/3966_2.png) [@Yamakasi](https://community.traefik.io/u/Yamakasi)\
**Post date:** [July 20, 2021, 8:14pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/5 "2021-07-20T20:14:48Z")

</div>

Thanks a lot @daniel.tomcej !

No I'm wondering, would Traefik be able to write that record to multiple nameservers using an API instead of relying on master-slave replication while talking to the master only using the API ?

I can rely on master-slave but it's just a design thingy on my side.

---

<div class="post-metadata">

**Author:** ![daniel.tomcej](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/daniel.tomcej/32/262_2.png) [@daniel.tomcej](https://community.traefik.io/u/daniel.tomcej)\
**Post date:** [July 20, 2021, 9:03pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/6 "2021-07-20T21:03:29Z")

</div>

Hello @Yamakasi,

As Traefik just uses the `lego` library, it relies on the functionality of lego, and does not modify it.

If you are looking for different propagation implementations, you would have to discuss that on the `go-acme/lego` project.

---

<div class="post-metadata">

**Author:** ![Yamakasi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/yamakasi/32/3966_2.png) [@Yamakasi](https://community.traefik.io/u/Yamakasi)\
**Post date:** [July 20, 2021, 9:14pm UTC](https://community.traefik.io/t/dns-01-challenge-sync/11231/7 "2021-07-20T21:14:29Z")

</div>

Hi @daniel.tomcej ,

OK, if it relies on that I think its just good to stay that way, so thanks!

I'm also always trying to look beyond what is already there so that is why I asked, always good too see things from another perspective and you helped me out there!

Thanks again!
