Error renewing ACME certificate: could not determine authoritative nameservers

Traefik Traefik v3 (latest)
1

I'm having trouble renewing my wildcard certificates via the DNS-01 challenge:

I can see the TXT record being created at mijn.host, and then being deleted after a minute.

traefik logs:

traefik: ERR Error renewing ACME certificate: {api.<domain>.nl [ ]} error="resolver: one or more domains had a problem: [api.<domain>.nl: dns01: time limit exceeded: last error: authoritative nameservers: [zone=<domain>.nl.] could not determine authoritative nameservers]" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme
traefik: ERR Error renewing ACME certificate: {*.<domain>.nl [ ]} error="resolver: one or more domains had a problem: [*.<domain>.nl: dns01: time limit exceeded: last error: recursive nameservers: NS 127.0.0.53:53 did not return the expected TXT record [fqdn: _acme-challenge.<domain>.nl., value: <key>]: ]" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme

using:
lego --dns mijnhost -d '*.<domain>.nl' run

[*.<domain>.nl] acme: Obtaining bundled SAN certificate
[*.<domain>.nl] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/3690272695/770256115255
[*.<domain>.nl] acme: use dns-01 solver
[*.<domain>.nl] acme: Preparing to solve DNS-01
[*.<domain>.nl] acme: Trying to solve DNS-01
[*.<domain>.nl] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
Wait for propagation [timeout: 1m0s, interval: 2s]
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Cleaning DNS-01 challenge
Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/3690272695/770256115255
Could not obtain certificates:
	error: one or more domains had a problem:
[*.<domain>.nl] propagation: time limit exceeded: last error: [zone=<domain>.nl.] could not determine authoritative nameservers

I'm not sure what's going wrong here... This config has worked without issue in the past before. Happy to provide more logs/config!

2

Make sure to update to latest Traefik version? Check related post.

3

updated to 3.7.12, and am using the config below, including the workaround in DNS01 challenge not working after version 3.7.6+ · Issue #13697 · traefik/traefik · GitHub (requireAllRNS = false). Same logs as before unfortunately.

{
  "certificatesResolvers": {
    "letsencrypt": {
      "acme": {
        "caServer": "https://acme-v02.api.letsencrypt.org/directory",
        "dnsChallenge": {
          "propagation": {
            "requireAllRNS": false
          },
          "provider": "mijnhost"
        },
        "email": "fakemail@me.com",
        "storage": "acme.json"
      }
    }
  },
  "entryPoints": {
    "web": {
      "address": ":80"
    },
    "websecure": {
      "address": ":443",
      "http": {
        "tls": {
          "certResolver": "letsencrypt"
        }
      },
      "transport": {
        "respondingTimeouts": {
          "readTimeout": "30m"
        }
      }
    }
  },
  "experimental": {
    "localPlugins": {
      "badger": {
        "moduleName": "github.com/fosrl/badger"
      }
    }
  },
  "providers": {
    "file": {
      "directory": "/var/lib/traefik/routing",
      "watch": true
    },
    "http": {
      "endpoint": "http://localhost:3001/api/v1/traefik-config",
      "pollInterval": "5s"
    }
  }
}
4

propagation.disableanschecks = true fixes this. I don't get why that would work though...

dig <domain> @ns1.mijn.host is reachable from the host traefik is running on.:

; <<>> DiG 9.20.26 <<>> <domain> @ns1.mijn.host
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55848
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;<domain>.		IN	A

;; AUTHORITY SECTION:
<domain>.	3600	IN	SOA	ns1.mijn.host. hostmaster.<domain>. 1788431805 10800 3600 604800 3600

;; Query time: 11 msec
;; SERVER: 5.254.117.200#53(ns1.mijn.host) (UDP)
;; WHEN: Thu Sep 03 12:50:23 CEST 2026
;; MSG SIZE  rcvd: 106

Is not checking with the ANS awfully insecure?