# DNS Challenge not working with CNAMEd domains

**URL:** <https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030>\
**Category:** Traefik v2\
**Tags:** letsencrypt-acme, docker\
**Created:** [October 7, 2021, 8:55pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030 "2021-10-07T20:55:30Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bgeneto](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/bgeneto/32/4365_2.png) [@bgeneto](https://community.traefik.io/u/bgeneto)\
**Post date:** [October 7, 2021, 8:55pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/1 "2021-10-07T20:55:30Z")

</div>

I'm trying to use Traefik v2 dns challenge with duckdns along with a CNAMEd domain without success. If I use `duckdns.org` directly, say `mydomain.duckdns.org` in the static config it works:

```auto
  websecure:
    address: :443
    http:
      middlewares:
        - secureHeaders@file
      tls:
        certResolver: duckdns
        domains:
          - main: "mydomain.duckdns.org"
            sans:
              - "*.mydomain.duckdns.org"
...

certificatesResolvers:
  duckdns:
    acme:
      email: mail@mydomain.duckdns.org
      storage: acme.json
      keyType: EC384
      dnsChallenge:
        provider: duckdns

```

Now I'm trying to gen certs to my own domain, e.g. `traefik.mydomain.com.br` that is properly CNAMEd to `mydomain.duckdns.org`, and has another CNAME entry for `_acme-challenge.traefik.mydomain.com.br` that points to `mydomain.duckdns.org`. So I've changed my config to reflect this setup:

```auto
        domains:
          - main: "traefik.mydomain.com.br"
            sans:
              - "*.traefik.mydomain.com.br"

```

Problem is that the update request to duckdns is failing (url parameter `domains` has wrong value, see below). Is this a bug or am I forgetting something here?

```auto
 msg="Unable to obtain ACME certificate for domains \"traefik.mydomain.com.br\" : unable to generate a certificate for the domains [traefik.mydomain.com.br]: 
error: one or more domains had a problem:\n[traefik.mydomain.com.br] [traefik.mydomain.com.br]
acme: error presenting token: request to change TXT record for DuckDNS returned the following result (KO) this does not match expectation (OK) 
used url [https://www.duckdns.org/update?clear=false&domains=br&token=xxxxxxxxx-a0a5-4caa-a5a5-xxxxxxxx&txt=sR2pZSxxxxxxxxxvAp6jqdLmizIvWq7QCyYqk-8qySs]\n" providerName=duckdns.acme

```

If I manually submit the http request to duckdns, obviously exchanging the wrong (br) value in the `domains` parameter with the correct (CNAMEd) one then it results OK.

Any ideais? How can I instruct Traefik to use the correct domain? TIA.

---

<div class="post-metadata">

**Author:** ![cakiwi](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/cakiwi/32/3205_2.png) [@cakiwi](https://community.traefik.io/u/cakiwi)\
**Post date:** [October 12, 2021, 6:58pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/2 "2021-10-12T18:58:04Z")

</div>

Your TXT record has to be updated on the traefik.mydomain.com.br domain. So you should update your certificateProviders to the provider/account that traefik.mydomain.com.br is on.

A TXT record and CNAME are different records. CNAMEing `_acme-challenge.traefik.mydomain.com.br` won't result in a query of TXT following a CNAME.

---

<div class="post-metadata">

**Author:** ![bgeneto](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/bgeneto/32/4365_2.png) [@bgeneto](https://community.traefik.io/u/bgeneto)\
**Post date:** [October 14, 2021, 1:22am UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/3 "2021-10-14T01:22:46Z")

</div>

> [@cakiwi](#):
>
> Your TXT record has to be updated on the traefik.mydomain.com.br domain.

I thought that my TXT record could be updated/submited for the CNAMEd domain (`mydomain.duckdns.org`), like Caddy server does with the `override_domain` directive in the DNS challenge plugin, please see this [link](https://caddy.community/t/duckdns-plugin-ignoring-override-domain/13824/2).

Also, this behavior is supported by Let’s Encrypt, [let's see](https://letsencrypt.org/docs/challenge-types/#dns-01-challenge):

> Since Let’s Encrypt follows the DNS standards when looking up TXT records for DNS-01 validation, you can use CNAME records or NS records to delegate answering the challenge to other DNS zones. This can be used to delegate the `_acme-challenge` subdomain to a validation-specific server or zone. It can also be used if your DNS provider is slow to update, and you want to delegate to a quicker-updating server.

In my case, I can't simply update or change the certificateProviders because my current DNS provider is unsupported (by Traefik).

Regards.

---

<div class="post-metadata">

**Author:** ![lullis](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lullis/32/4896_2.png) [@lullis](https://community.traefik.io/u/lullis)\
**Post date:** [July 20, 2025, 5:48pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/4 "2025-07-20T17:48:16Z")

</div>

Hi, did you get a solution to this? I'm having the same problem. The documentation says that traefik supports domain delegation, but it keeps trying to resolve the DNS challenge against the domain I do not control.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [July 20, 2025, 8:18pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/5 "2025-07-20T20:18:54Z")

</div>

The TLS domain has a CNAME set to a domain you control?

---

<div class="post-metadata">

**Author:** ![lullis](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/lullis/32/4896_2.png) [@lullis](https://community.traefik.io/u/lullis)\
**Post date:** [July 20, 2025, 8:30pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/6 "2025-07-20T20:30:11Z")

</div>

No. It's for a hosted SaaS. Customers own the domain and we run the servers on a docker swarm cluster. Currently we simply instruct customers to CNAME their domain to our traefik server and then use the HTTP challenge, but this means that we can have only traefik node as ingress controller. If we want to add more traefik nodes and have some form of DNS load balancing, the only way to do it would be to have DNS challenge working.

The documentation says that it traefik can do DNS delegation, but there is no good example in the documentation showing how it could be done.

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [July 20, 2025, 8:54pm UTC](https://community.traefik.io/t/dns-challenge-not-working-with-cnamed-domains/12030/7 "2025-07-20T20:54:39Z")

</div>

Great to meet someone using Docker Swarm. Traefik-CE does not support clustered LetsEncrypt, so the only way to work around this is using `dnsChallenge` or an external process ([wild PoC](https://community.letsencrypt.org/t/how-to-continuously-create-renew-certificates-without-hitting-limits/184562/23)).

Developer feedback is usually just on GitHub, but they also close support tickets there, so it's complicated 😅

* * *

We currently handle LetsEncrypt certs with two external scripts.

1. Create TLS certs

```auto
#!/bin/zsh

# Use a here document to define a list of domains
DOMAINS=$(cat <<EOF
example.com
sub.example.com
many.more.com
EOF
)

# Iterate over each domain
for DOMAIN in ${(f)DOMAINS}; do
  echo "\n\n\n **********DOMAIN ${DOMAIN}********** \n\n\n"

  # Run the acme.sh command for each domain
  USER="123" \
  PASSWORD="456" \
  acme.sh \
    --force \
    --issue \
    --server letsencrypt \
    --dns dns_provider \
    --home . \
    -d "$DOMAIN" -d "*.$DOMAIN" \
    --cert-file "./certificates/$DOMAIN.cer" \
    --key-file "./certificates/$DOMAIN.key" \
    --fullchain-file "./certificates/$DOMAIN.pem" \

  echo sleep 5
  sleep 5

done

```

1. Inline all TLS certs into single dynamic config file

```auto
#!/bin/bash

# Define the certificates directory and the output file
CERT_DIR="./certificates"
FILE="./traefik-tls.yml"

# Start writing the Traefik dynamic configuration file
echo "TRAEFIK TLS FILE GENERATION"
printf "tls:\n options:\n default:\n minVersion: VersionTLS12\n certificates:\n" > $FILE

# Find all .key files in the certificates folder, strip the .key extension, and iterate over them
for KEY_FILE in $(find $CERT_DIR -maxdepth 1 -name "*.key" -type f | sort); do
  # Remove the .key extension to get the domain name (or file prefix)
  DOMAIN=$(basename "$KEY_FILE" .key)

  # Add the domain's certFile and keyFile to the Traefik configuration
  echo "TRAEFIK TLS FILE ADD $DOMAIN"
  printf " # CERT FILE $DOMAIN\n" >> $FILE
  printf " - certFile: |-\n" >> $FILE
  sed -e 's/^/ /' "$CERT_DIR/$DOMAIN.pem" >> $FILE
  printf " keyFile: |-\n" >> $FILE
  sed -e 's/^/ /' "$KEY_FILE" >> $FILE
  printf "\n\n\n" >> $FILE
done

echo "Traefik dynamic configuration file created at $FILE"

```