From 3d670c97726a40fadda69f40d6d35d6167d9583e Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Mon, 10 Aug 2026 14:47:05 +0100 Subject: [PATCH 1/2] Warn that cnameStrategy Follow also follows wildcard-synthesized CNAMEs A wildcard CNAME covering _acme-challenge. is followed like an explicit one, so cert-manager tries to create the challenge TXT record at the wildcard target and the DNS provider rejects it as out of zone. See https://github.com/cert-manager/cert-manager/issues/5716 Co-Authored-By: Claude Fable 5 Signed-off-by: Richard Wall --- content/docs/configuration/acme/dns01/README.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/content/docs/configuration/acme/dns01/README.md b/content/docs/configuration/acme/dns01/README.md index a19ff32874f..bf22127bb4d 100644 --- a/content/docs/configuration/acme/dns01/README.md +++ b/content/docs/configuration/acme/dns01/README.md @@ -138,6 +138,18 @@ _acme-challenge.bar.example.com IN CNAME _acme-challenge.less-privileged.example With this configuration cert-manager will follow CNAME records recursively in order to determine which DNS zone to update during DNS01 challenges. +> ⚠️ With `cnameStrategy: Follow`, cert-manager follows *any* CNAME record +> found at `_acme-challenge.`, including one synthesized by a wildcard +> record. For example, a record like `*.example.com IN CNAME +> lb.example.org` also answers CNAME queries for +> `_acme-challenge.example.com`, so cert-manager will try to create the +> challenge TXT record at `lb.example.org` — typically failing with an +> error such as Route 53's `RRSet with DNS name lb.example.org. is not +> permitted in zone example.com.`. To avoid this, create an explicit record +> at `_acme-challenge.` (an exact-match name prevents wildcard +> synthesis), or use the default `cnameStrategy: None` if you are not +> delegating challenges to another zone. + ## Supported DNS01 providers From b6e6dea3d4404276fcd8e960e7cf517fd763ae3d Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Thu, 20 Aug 2026 19:48:24 +0100 Subject: [PATCH 2/2] Keep inline code spans on one line in the wildcard CNAME warning Copilot review flagged that two code spans in the blockquote were split across lines, which can render incorrectly. Co-Authored-By: Claude Fable 5 Signed-off-by: Richard Wall --- .../docs/configuration/acme/dns01/README.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/content/docs/configuration/acme/dns01/README.md b/content/docs/configuration/acme/dns01/README.md index bf22127bb4d..68e2aebf736 100644 --- a/content/docs/configuration/acme/dns01/README.md +++ b/content/docs/configuration/acme/dns01/README.md @@ -139,16 +139,17 @@ With this configuration cert-manager will follow CNAME records recursively in or which DNS zone to update during DNS01 challenges. > ⚠️ With `cnameStrategy: Follow`, cert-manager follows *any* CNAME record -> found at `_acme-challenge.`, including one synthesized by a wildcard -> record. For example, a record like `*.example.com IN CNAME -> lb.example.org` also answers CNAME queries for +> found at `_acme-challenge.`, including one synthesized by a +> wildcard record. For example, a record like +> `*.example.com IN CNAME lb.example.org` also answers CNAME queries for > `_acme-challenge.example.com`, so cert-manager will try to create the -> challenge TXT record at `lb.example.org` — typically failing with an -> error such as Route 53's `RRSet with DNS name lb.example.org. is not -> permitted in zone example.com.`. To avoid this, create an explicit record -> at `_acme-challenge.` (an exact-match name prevents wildcard -> synthesis), or use the default `cnameStrategy: None` if you are not -> delegating challenges to another zone. +> challenge TXT record at `lb.example.org` — typically failing with an error +> such as Route 53's +> `RRSet with DNS name lb.example.org. is not permitted in zone example.com.`. +> To avoid this, create an explicit record at `_acme-challenge.` +> (an exact-match name prevents wildcard synthesis), or use the default +> `cnameStrategy: None` if you are not delegating challenges to another +> zone. ## Supported DNS01 providers