{"id":"64ba2204-d9a4-4a9d-9b4c-6bb0d978d792","task":"Diagnose and fix cert-manager DNS01 propagation timeouts and CNAME delegation for ACME challenges","domain":"cert-manager.io","steps":["Run kubectl describe challenge <name> (and kubectl describe order) to confirm the failure is a DNS01 self-check/propagation issue rather than an ACME server-side or credentials problem.","By default cert-manager self-checks using the recursive nameservers from /etc/resolv.conf inside the controller pod to discover the authoritative nameservers, then queries those directly; if the pod's resolver can't reach the authoritative NS (split-horizon DNS, restrictive egress), set the controller flags --dns01-recursive-nameservers=<HOST:PORT>,<HOST:PORT> (e.g. 8.8.8.8:53,1.1.1.1:53) and, if authoritative access is blocked entirely, add --dns01-recursive-nameservers-only=true so cert-manager only queries the configured resolvers.","With the Helm chart, set these via extraArgs, e.g. --set 'extraArgs={--dns01-recursive-nameservers-only,--dns01-recursive-nameservers=8.8.8.8:53\\,1.1.1.1:53}', then restart the cert-manager controller Deployment for the flags to take effect.","If you don't want to grant cert-manager write access to the root zone, delegate the _acme-challenge subdomain: create _acme-challenge.example.com CNAME _acme-challenge.less-privileged.example.org, set cnameStrategy: Follow on the affected dns01 solver, and provide credentials scoped to less-privileged.example.org - cert-manager does not follow CNAMEs unless this is set.","Use selector.dnsZones on the solver to scope which zones use the CNAME-delegated credentials versus root-zone credentials; the selector still matches against the original zone (example.com) even though the TXT record actually lands in the delegated zone.","Re-trigger issuance (delete the stuck CertificateRequest/Order, or re-apply the Certificate) and re-check propagation; note that --dns01-recursive-nameservers-only can itself slow down the self-check due to resolver caching, so treat that as expected latency, not a new failure."],"gotchas":["cert-manager does not follow CNAME records by default (cnameStrategy defaults to None) - without explicitly setting cnameStrategy: Follow, a delegated _acme-challenge CNAME is silently ignored and the self-check keeps failing against the wrong zone.","Enabling --dns01-recursive-nameservers-only trades correctness/freshness for control over which resolvers are trusted, but can increase propagation-check latency because of caching at those recursive servers.","selector.dnsZones matches on the original (source) zone name, not the CNAME target - you still configure credentials for the delegated (target) zone even though the selector references the source zone."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/64ba2204-d9a4-4a9d-9b4c-6bb0d978d792"}