# RFC2136 DNS challenge with Bind9

**URL:** <https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363>\
**Category:** Traefik v3 (latest)\
**Tags:** docker\
**Created:** [April 29, 2025, 1:00pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363 "2025-04-29T13:00:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![sepetuks](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/sepetuks/32/10328_2.png) [@sepetuks](https://community.traefik.io/u/sepetuks)\
**Post date:** [April 29, 2025, 1:00pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363/1 "2025-04-29T13:00:08Z")

</div>

Hello All,

I wonder if somebody would be kind to give me some guidance on troubleshooting this kind of error:

```auto
traefik | 2025-04-29T15:42:44+03:00 ERR github.com/traefik/traefik/v3/pkg/provider/acme/provider.go:482 > Unable to obtain ACME certificate for domains error="unable to generate a certificate for the domains [my.url.domain]: error: one or more domains had a problem:\n[my.url.domain] [my.url.domain] acme: error presenting token: rfc2136: failed to insert: DNS update failed: server replied: REFUSED\n" ACME CA=https://acme-v02.api.letsencrypt.org/directory acmeCA=https://acme-v02.api.letsencrypt.org/directory domains=["my.url.domain"] providerName=myresolver.acme routerName=netbox@docker rule=Host(`my.url.domain`)

```

I am pretty sure my Bind9 configuration is correct. When I used nsupdate (of course first download dnsutils) from container I am successfully creating DNS record against my DNS server. But for some reason Traefik fails with error above.

When I do that with nsupdate in Bind9 logs I see:

```auto
29-Apr-2025 13:24:25.943 info: client @0x7faf8ec51168 10.0.0.33#39934/key my-key: signer "my-key" approved

```

When Traefik tries sto make DNS record in Bind9 logs I see:

```auto
29-Apr-2025 13:24:39.560 error: client @0x7faf8ec51168 10.0.0.33#54598: update 'url.domain/IN' denied

```

Environment variables inside container, looks to be correct:  
/ # env  
HOSTNAME=fac77e892677  
SHLVL=1  
HOME=/root  
RFC2136\_NAMESERVER=_DNSServerIP_:53  
TERM=xterm  
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin  
RFC2136\_TSIG\_KEYNAME=my-key  
RFC2136\_TSIG\_ALGORITHM=hmac-sha256  
PWD=/  
RFC2136\_TSIG\_SECRET=_mybase64key_

Is there a way to troubleshoot DNS creation issue with Traefik? How?  
Why running nsupdate from container succeeds but traefik not?

---

<div class="post-metadata">

**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\
**Post date:** [April 29, 2025, 2:10pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363/2 "2025-04-29T14:10:15Z")

</div>

Did you check the [doc](https://go-acme.github.io/lego/dns/rfc2136/) and [go-acme post](https://github.com/go-acme/lego/discussions/2159)?

---

<div class="post-metadata">

**Author:** ![sepetuks](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/sepetuks/32/10328_2.png) [@sepetuks](https://community.traefik.io/u/sepetuks)\
**Post date:** [April 29, 2025, 2:47pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363/3 "2025-04-29T14:47:02Z")

</div>

Yes I did.  
I tried "propagation-disable-ans=true" but this didn't help.  
The error I get is a bit different

---

<div class="post-metadata">

**Author:** ![sepetuks](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/sepetuks/32/10328_2.png) [@sepetuks](https://community.traefik.io/u/sepetuks)\
**Post date:** [February 8, 2026, 6:53pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363/4 "2026-02-08T18:53:11Z")

</div>

just to update issue was resolved

**RFC2136\_TSIG\_KEYNAME** =my-key

Should be

**RFC2136\_TSIG\_KEY** =my-key

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/containo/original/2X/b/bd81ebdb578656e76e56ff3cc3eed021d3ba132d.png) [@system](https://community.traefik.io/u/system)\
**Post date:** [February 11, 2026, 6:54pm UTC](https://community.traefik.io/t/rfc2136-dns-challenge-with-bind9/27363/5 "2026-02-11T18:54:07Z")

</div>

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.