# Route53 DnsChallenge with multiple hosted zones not possible **URL:** \ **Category:** Traefik v3 (latest)\ **Tags:** letsencrypt-acme, docker-swarm\ **Created:** [December 31, 2024, 10:34pm UTC](https://community.traefik.io/t/route53-dnschallenge-with-multiple-hosted-zones-not-possible/25814 "2024-12-31T22:34:43Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![waffleProOps](https://avatars.discourse-cdn.com/v4/letter/w/b38774/32.png) [@waffleProOps](https://community.traefik.io/u/waffleProOps)\ **Post date:** [December 31, 2024, 10:34pm UTC](https://community.traefik.io/t/route53-dnschallenge-with-multiple-hosted-zones-not-possible/25814/1 "2024-12-31T22:34:43Z")
Four years ago, this question was posted: [Route53 dnsChallenge with multiple domains](https://community.traefik.io/t/route53-dnschallenge-with-multiple-domains/1744) I'm running in Docker Swarm. Currently, if I do not specify `AWS_HOSTED_ZONE_ID` in the environment, I get the same error > acme: error presenting token: route53: failed to determine hosted zone ID But specifying the hosted zone ID in the environment applies to _all_ certresolvers declared in traefik (we can't do one per hosted zone, like cert-manager allows for its issuers: [Failed to determine Route 53 hosted zone ID: SignatureDoesNotMatch · Issue #668 · cert-manager/cert-manager · GitHub](https://github.com/cert-manager/cert-manager/issues/668#issuecomment-419367887) I get TLS certs for my services with ACME with both LetsEncrypt for my public services, and my own internal step-ca ACME server for internal services. I must use DNS01 challenge, since HTTP01 only works on port 80, which matters because... Due to the inability to configure on instance of traefik to serve some services on an internal IP, and some on a public IP ( [Handling internal and external apps with one instance of Traefik - #10 by waffleProOps](https://community.traefik.io/t/handling-internal-and-external-apps-with-one-instance-of-traefik/16374/10) ), I must therefore use non-standard HTTP ports (e.g. 8080) for my internal services, and rely on a simple firewall to keep the public internet out. So I must use DNS01, which won't work for my public and internal hosted zone. LEGO has the permission to list hosted zones by name, why can't it determine the hosted zone IDs based on my domains, like I described here? [Route53 dnsChallenge with multiple domains - #5 by waffleProOps](https://community.traefik.io/t/route53-dnschallenge-with-multiple-domains/1744/5) This seems like it should be able to, and is a possible bug. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [January 1, 2025, 9:27am UTC](https://community.traefik.io/t/route53-dnschallenge-with-multiple-hosted-zones-not-possible/25814/2 "2025-01-01T09:27:19Z")
If this is a feature request (or bug report), then you should place it at [Traefik Github](https://github.com/traefik/traefik). ---
**Author:** ![waffleProOps](https://avatars.discourse-cdn.com/v4/letter/w/b38774/32.png) [@waffleProOps](https://community.traefik.io/u/waffleProOps)\ **Post date:** [January 1, 2025, 5:44pm UTC](https://community.traefik.io/t/route53-dnschallenge-with-multiple-hosted-zones-not-possible/25814/3 "2025-01-01T17:44:15Z")
Well, I don't know if it is a bug yet, so I wanted to post this first here, and maybe get some feedback before submitting it as a bug, out of respect for the github issues page and not flooding it. ---
**Author:** ![bluepuma77](https://avatars.discourse-cdn.com/v4/letter/b/a9adbd/32.png) [@bluepuma77](https://community.traefik.io/u/bluepuma77)\ **Post date:** [January 1, 2025, 9:46pm UTC](https://community.traefik.io/t/route53-dnschallenge-with-multiple-hosted-zones-not-possible/25814/4 "2025-01-01T21:46:16Z")
If you are looking for more feedback, you can also try [www.reddit.com/r/Traefik/](https://www.reddit.com/r/Traefik/).