DigitalOcean 404 error for challenge

[brandonkal]

Bugs should be filed for issues encountered whilst operating cert-manager.
You should first attempt to resolve your issues through the community support
channels, e.g. Slack, in order to rule out individual configuration errors.
Please provide as much detail as possible.

Describe the bug:
PresentError:
POST https://api.digitalocean.com/v2/domains/run/records: 404 The resource you were accessing could not be found.

EDIT: it appears that the issue is that it is posting to the wrong URL. My domain here is kite.run but only the TLD is present above.
When turning up logging to 6, I get this:

Returning cached zone record "run." for fqdn "_acme-challenge.fn.kite.run."

https://github.com/jetstack/cert-manager/blob/8d6e86468d4c10a14d21e09d699bd3dd37c7ffbc/pkg/issuer/acme/dns/util/wait.go#L303-L308

This is the same issue as in #1285 which was closed by the dumb bot.

Expected behaviour:
Challenge succeeds.

Steps to reproduce the bug:
Steps to reproduce the bug should be clear and easily reproducible to help people
gain an understanding of the problem.

1. New install via helm template (pulumi specifically)
2. ClusterIssuer for letsencrypt-staging
3. Domain NS are with DigitalOcean (plenty of time to propogate)

Anything else we need to know?:

Environment details::

• Kubernetes version (e.g. v1.10.2): v1.16.3-k3s.2
• Cloud-provider/provisioner (e.g. GKE, kops AWS, etc): k3s
• cert-manager version (e.g. v0.4.0): 0.12.0
• Install method (e.g. helm or static manifests): helm template

/kind bug

[brandonkal]

The issue was related to split DNS. Setting the pod to use a public DNS resolver fixed the issue.

So it is not strictly a bug but cert-manager should stop at the second level domain rather than top level when it does not find the SOA records.

[panteparak]

To those whom are passing by. Fixes can be applies as follows:
This will added Google and Cloudflare's Public DNS to cert manager pod

Via helm install

helm install \                                       
  --name cert-manager \
  --namespace cert-manager \
  ...<OTHER VALUES>
  --set extraArgs='{--dns01-recursive-nameservers-only,--dns01-dns01-recursive-nameservers=8.8.8.8:53\,1.1.1.1:53}' \
  jetstack/cert-manager

or via values files

installCRDs: true
extraArgs: 
  - "--dns01-recursive-nameservers-only"
  - "--dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53"