Cloudflare - DNS Resolver cleaning up records immediately after creation

[kaouk]

Good morning,

I've had my Cloudflare/Traefik configuration setup with lego for DNS resolution on letsencrypt for a while but recently it's stopped requesting new certificates. I can see in my Cloudflare logs that the records are being created and then almost immediately deleted without waiting for propagation.

In the traefik logs I can see:

2025-12-15T10:13:19Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] [home-assistant.>DOMAIN<] acme: use dns-01 solver lib=lego
2025-12-15T10:13:19Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] [home-assistant.>DOMAIN<] acme: Preparing to solve DNS-01 lib=lego
2025-12-15T10:13:20Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] [>DOMAIN<] acme: Trying to solve DNS-01 lib=lego
2025-12-15T10:13:20Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] [>DOMAIN<] acme: Checking DNS record propagation. [nameservers=1.1.1.1:53] lib=lego
2025-12-15T10:13:22Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] Wait for propagation [timeout: 10m0s, interval: 2s] lib=lego
2025-12-15T10:13:23Z DBG github.com/go-acme/lego/v4@v4.29.0/log/logger.go:48 > [INFO] [>DOMAIN<] acme: Cleaning DNS-01 challenge lib=lego

Happy to run tests etc. but this is about as far as I've got with troubleshooting as everything else seems to be working.

I've correlated this behaviour where the DNS records are created and then deleted 3s later on my Cloudflare audit logs.

[ldez]

I see no problem inside your logs but there are missing lines in your sample.

The fact to create and delete a record within 3 seconds is expected.

[ldez]

Isn't this an issue where the creation and deletion of the record happens before propagation so it doesn't get a chance to read the record before it's removed?

This could not happen because the deletion of a record is done after the challenge is done (success or fail), and so after waiting for the propagation.

Note that the logs are not chronological: the "one or more domains had a problem" always happen after everything, but the error happen before it.

[ldez]

If you want to see the calls to the Cloudflare API, you can set the env varLEGO_DEBUG_DNS_API_HTTP_CLIENT to true.

Note, this can expose credentials in the log output, so be careful.

https://go-acme.github.io/lego/usage/cli/options/index.html#lego_debug_dns_api_http_client

[kaouk]

Thanks, I'll take a look at that. The logs don't seem to be coming down to my traefik container logs, where would I be able to read these from?

I've dug into it a bit further and can see my DNS propagation checks were disabled in my config file so it should be doing it through the API instead. Probably why it was immediately bombing out but why the checks are failing are now the next question..

[kaouk]

Ah, fixed it. Was the zone read API permission error on the Cloudflare side (despite working for ages..) thanks for your help!