# Error renewing ACME certificate: could not determine authoritative nameservers

**URL:** <https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218>\
**Category:** Traefik v3 (latest)\
**Tags:** letsencrypt-acme\
**Created:** [September 1, 2026, 8:13am UTC](https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218 "2026-09-01T08:13:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![plating510](https://avatars.discourse-cdn.com/v4/letter/p/ee59a6/32.png) [@plating510](https://community.traefik.io/u/plating510)\
**Post date:** [September 1, 2026, 8:13am UTC](https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218/1 "2026-09-01T08:13:14Z")

</div>

I'm having trouble renewing my wildcard certificates via the DNS-01 challenge:

I can see the TXT record being created at mijn.host, and then being deleted after a minute.

traefik logs:

```auto
traefik: ERR Error renewing ACME certificate: {api.<domain>.nl []} error="resolver: one or more domains had a problem: [api.<domain>.nl: dns01: time limit exceeded: last error: authoritative nameservers: [zone=<domain>.nl.] could not determine authoritative nameservers]" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme
traefik: ERR Error renewing ACME certificate: {*.<domain>.nl []} error="resolver: one or more domains had a problem: [*.<domain>.nl: dns01: time limit exceeded: last error: recursive nameservers: NS 127.0.0.53:53 did not return the expected TXT record [fqdn: _acme-challenge.<domain>.nl., value: <key>]: ]" acmeCA=https://acme-v02.api.letsencrypt.org/directory providerName=letsencrypt.acme

```

using:  
`lego --dns mijnhost -d '*.<domain>.nl' run`

```auto
[*.<domain>.nl] acme: Obtaining bundled SAN certificate
[*.<domain>.nl] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz/3690272695/770256115255
[*.<domain>.nl] acme: use dns-01 solver
[*.<domain>.nl] acme: Preparing to solve DNS-01
[*.<domain>.nl] acme: Trying to solve DNS-01
[*.<domain>.nl] acme: Checking DNS record propagation. [nameservers=127.0.0.53:53]
Wait for propagation [timeout: 1m0s, interval: 2s]
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Waiting for DNS record propagation.
[*.<domain>.nl] acme: Cleaning DNS-01 challenge
Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz/3690272695/770256115255
Could not obtain certificates:
	error: one or more domains had a problem:
[*.<domain>.nl] propagation: time limit exceeded: last error: [zone=<domain>.nl.] could not determine authoritative nameservers

```

I'm not sure what's going wrong here... This config has worked without issue in the past before. Happy to provide more logs/config!

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [September 1, 2026, 8:16am UTC](https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218/2 "2026-09-01T08:16:38Z")

</div>

Make sure to update to latest Traefik version? Check related [post](https://community.traefik.io/t/acme-cloudflare-not-working-after-3-7-6/29983/).

---

<div class="post-metadata">

**Author:** ![plating510](https://avatars.discourse-cdn.com/v4/letter/p/ee59a6/32.png) [@plating510](https://community.traefik.io/u/plating510)\
**Post date:** [September 2, 2026, 10:35am UTC](https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218/3 "2026-09-02T10:35:27Z")

</div>

updated to `3.7.12`, and am using the config below, including the workaround in [DNS01 challenge not working after version 3.7.6+ · Issue #13697 · traefik/traefik · GitHub](https://github.com/traefik/traefik/issues/13697) (`requireAllRNS = false`). Same logs as before unfortunately.

```auto
{
  "certificatesResolvers": {
    "letsencrypt": {
      "acme": {
        "caServer": "https://acme-v02.api.letsencrypt.org/directory",
        "dnsChallenge": {
          "propagation": {
            "requireAllRNS": false
          },
          "provider": "mijnhost"
        },
        "email": "fakemail@me.com",
        "storage": "acme.json"
      }
    }
  },
  "entryPoints": {
    "web": {
      "address": ":80"
    },
    "websecure": {
      "address": ":443",
      "http": {
        "tls": {
          "certResolver": "letsencrypt"
        }
      },
      "transport": {
        "respondingTimeouts": {
          "readTimeout": "30m"
        }
      }
    }
  },
  "experimental": {
    "localPlugins": {
      "badger": {
        "moduleName": "github.com/fosrl/badger"
      }
    }
  },
  "providers": {
    "file": {
      "directory": "/var/lib/traefik/routing",
      "watch": true
    },
    "http": {
      "endpoint": "http://localhost:3001/api/v1/traefik-config",
      "pollInterval": "5s"
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![plating510](https://avatars.discourse-cdn.com/v4/letter/p/ee59a6/32.png) [@plating510](https://community.traefik.io/u/plating510)\
**Post date:** [September 3, 2026, 10:52am UTC](https://community.traefik.io/t/error-renewing-acme-certificate-could-not-determine-authoritative-nameservers/30218/4 "2026-09-03T10:52:42Z")

</div>

`propagation.disableanschecks = true` fixes this. I don't get why that would work though...

`dig <domain> @ns1.mijn.host` is reachable from the host traefik is running on.:

```auto
; <<>> DiG 9.20.26 <<>> <domain> @ns1.mijn.host
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55848
;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
;; QUESTION SECTION:
;<domain>. IN	A

;; AUTHORITY SECTION:
<domain>.	3600	IN	SOA	ns1.mijn.host. hostmaster.<domain>. 1788431805 10800 3600 604800 3600

;; Query time: 11 msec
;; SERVER: 5.254.117.200#53(ns1.mijn.host) (UDP)
;; WHEN: Thu Sep 03 12:50:23 CEST 2026
;; MSG SIZE rcvd: 106

```

Is not checking with the ANS awfully insecure?