cert-manager DNS-01 challenge propagation timeout in CI
cert-manager created the _acme-challenge TXT record for a DNS-01 challenge but the self-check timed out because the record did not propagate to authoritative nameservers, or a split-horizon setup means the record is not visible from the public internet. The ACME server validates the TXT record externally, so it must be resolvable publicly. Fix the DNS provider credentials, zone, or propagation delay.
What this error means
cert-manager stays in "Waiting for DNS-01 challenge propagation" and the CertificateRequest never completes, or the order fails after the propagation check times out.
Waiting for DNS-01 challenge propagation: DNS record for "example.com" not yet
propagated: NS ... has not propagated the TXT record for _acme-challenge.example.comCommon causes
The TXT record has not propagated yet
Authoritative nameservers or downstream resolvers have not picked up the new _acme-challenge TXT record within the check window.
Wrong zone, credentials, or split-horizon DNS
The DNS-01 solver writes to the wrong zone, lacks permission to create the record, or an internal view hides the record from the public ACME server.
How to fix it
Verify the TXT record is publicly resolvable
- Query the
_acme-challengeTXT record against a public resolver, not just internal DNS. - Confirm the DNS-01 solver credentials and zone are correct.
- Raise the propagation check delay if your provider is slow to publish.
dig +short TXT _acme-challenge.example.com @8.8.8.8Fix the solver configuration
Ensure the DNS-01 solver targets the correct zone and has API credentials that can create TXT records; for split-horizon, expose the challenge record publicly.
solvers:
- dns01:
cloudflare:
apiTokenSecretRef:
name: cloudflare-api-token
key: api-tokenHow to prevent it
- Confirm DNS-01 solver credentials and zone before relying on it in CI.
- Ensure
_acme-challengerecords are publicly resolvable, even in split-horizon DNS. - Allow enough propagation time for your DNS provider.