Edit: probably a coreDNS issue in HAOS. (Let's Encrypt app with lego use SOA records from non-authorative DNS)

[WallyDW]

Describe the issue you are experiencing

I am running a domain name on a split-DNS setup.
The public and authoritative DNS servers for the domain is hosted on Cloudflare's DNS service.
The internal is my router's DNS service.
This setup allowed me to get a wildcard certificate with the previous versions of the Let's Encrypt addon and I could then use it internally for HTTPS connections.
The new Let's Encrypt app is however using the internal DNS server, ie. the router's, to do some SOA record lookups and that is failing because the router's DNS service do not provide any SOA records.

I do not know why it do the SOA lookups for certificate generation.
My only guess is that it might try to extract the "state of authority" value for the DNS edit actions later.
In anyway the result is that it crashes due to the missing SOA record.

The app should probably have an option and maybe even have it set to default use a public DNS service, since Let's Encrypt require you to use them anyway for the authentication process.
The DNS service have to be local to the app however, since a change in HA's settings would prevent a split-DNS setup with certificates.

What type of installation are you running?

Home Assistant OS

Which operating system are you running on?

Home Assistant Operating System

Which app are you reporting an issue with?

Let's Encrypt

What is the version of the app?

6.0.4

Steps to reproduce the issue

1. configure a public domain name on an internal DNS service without a SOA record (a SOA record with false informations might be used too)
2. set HA up to use that DNS service
3. try to create a certificate for the domain name
   ...

System Health information

System Information

version	core-2026.2.2
installation_type	Home Assistant OS
dev	false
hassio	true
docker	true
container_arch	amd64
user	root
virtualenv	false
python_version	3.13.11
os_name	Linux
os_version	6.12.67-haos
arch	x86_64
timezone	Europe/Copenhagen
config_dir	/config

Home Assistant Community Store

GitHub API	ok
GitHub Content	ok
GitHub Web	ok
HACS Data	ok
GitHub API Calls Remaining	5000
Installed Version	2.0.5
Stage	running
Available Repositories	2757
Downloaded Repositories	43

Home Assistant Supervisor

host_os	Home Assistant OS 17.1
update_channel	stable
supervisor_version	supervisor-2026.02.2
agent_version	1.8.1
docker_version	29.1.3
disk_total	97.7 GB
disk_used	41.5 GB
nameservers	10.10.12.1
healthy	true
supported	true
host_connectivity	true
supervisor_connectivity	true
ntp_synchronized	true
virtualization	kvm
board	ova
supervisor_api	ok
version_api	ok
installed_addons	Node-RED (21.0.2), Log Viewer (0.17.1), Mosquitto broker (6.5.2), Samba share (12.5.4), Grafana (12.1.0), Glances (0.21.1), Studio Code Server (6.0.1), Samba Backup (5.2.0), MariaDB (2.7.2), Advanced SSH & Web Terminal (23.0.2), ESPHome Device Builder (2026.2.0), Matter Server (8.2.2), InfluxDB (5.0.2), SQLite Web (6.0.0), chrony (6.0.1), OpenThread Border Router (2.16.4), Let's Encrypt (6.0.4)

Dashboards

dashboards	6
resources	30
views	24
mode	yaml

Network Configuration

adapters	lo (disabled), enp0s18 (enabled, default, auto), docker0 (disabled), hassio (disabled), veth0ba009d (disabled), vethd0bde8f (disabled), vethe5a3de3 (disabled), veth3458ab7 (disabled), veth2e238fc (disabled), vethc955971 (disabled), veth35dd00a (disabled), veth31fb07d (disabled), vethc5eba4f (disabled), vethf82434d (disabled), veth40659b4 (disabled), wpan0 (disabled)
ipv4_addresses	lo (127.0.0.1/8), enp0s18 (10.10.12.10/24), docker0 (172.30.232.1/23), hassio (172.30.32.1/23), veth0ba009d (), vethd0bde8f (), vethe5a3de3 (), veth3458ab7 (), veth2e238fc (), vethc955971 (), veth35dd00a (), veth31fb07d (), vethc5eba4f (), vethf82434d (), veth40659b4 (), wpan0 ()
ipv6_addresses	lo (::1/128), enp0s18 (fd18:9309:ec6b:d34a:dea7:d0da:294a:1c0c/64, fe80::f90b:77d9:c156:1573/64), docker0 (fe80::ace7:20ff:fe87:a01f/64), hassio (fe80::bc10:eaff:fe55:4dd3/64), veth0ba009d (fe80::bc3d:88ff:fed1:2c81/64), vethd0bde8f (fe80::c81:36ff:fee9:2b54/64), vethe5a3de3 (fe80::78cc:91ff:fed0:ceac/64), veth3458ab7 (fe80::6080:1cff:fe47:d190/64), veth2e238fc (fe80::e8c0:77ff:fe84:7667/64), vethc955971 (fe80::dc01:b3ff:fe90:c020/64), veth35dd00a (fe80::f42f:4eff:fe68:dfa7/64), veth31fb07d (fe80::1817:88ff:fe80:4ea7/64), vethc5eba4f (fe80::8052:9eff:fecf:72f4/64), vethf82434d (fe80::6048:d3ff:fe13:228f/64), veth40659b4 (fe80::6830:71ff:fe19:c4a2/64), wpan0 (fd44:e4e9:b944:d5ea:0:ff:fe00:fc11/64, fdd3:bfaa:eebe:1:f0f6:af77:9e2:61a9/64, fd44:e4e9:b944:d5ea:0:ff:fe00:fc38/64, fd44:e4e9:b944:d5ea:0:ff:fe00:fc10/64, fd44:e4e9:b944:d5ea:0:ff:fe00:d000/64, fd44:e4e9:b944:d5ea:1eba:fbd0:9932:645f/64, fe80::f4e9:1ed3:273:3337/64)
announce_addresses	10.10.12.10, fd18:9309:ec6b:d34a:dea7:d0da:294a:1c0c, fe80::f90b:77d9:c156:1573

Recorder

oldest_recorder_run	8 January 2026 at 01:35
current_recorder_run	16 February 2026 at 19:23
estimated_db_size	3877.75 MiB
database_engine	sqlite
database_version	3.49.2

Anything in the Supervisor logs that might be useful for us?

None

Anything in the app logs that might be useful for us?

The error is listed as "certbot.errors.PluginError: cloudflare: failed to find zone dk.: zone could not be found", where dk is my TLD.
Running with verbose activated gives a lot of text related to authorization issues. However Cloudflare do not detect any attempts to connect to the API when this error occur.

Additional information

I have another domain that worked flawlessly both before and after the update, so I knew the setup works generally.
I can make the app work if I add a local DNS with a SOA record.
I can make the other domain fail if I move that to my router's DNS service without SOA.
I have used wireshark and can confirm the SOA lookup to the local DNS service for the domain that are defined on that.

There is not much on the internet regarding this error text, but Idez's last comment in this thread directed me to the cause.

[WallyDW]

This might not be limited to Cloudflare, but might affect all with a split-DNS setup regardless of DNS service provider.

I checked the site: https://go-acme.github.io/lego/usage/cli/options/index.html

It looks like there is an option to LEGO that can tackle this, but how it is integrated into certbot and the addon is not something I have delved into yet.

" --dns.resolvers value [ --dns.resolvers value ] Set the resolvers to use for performing (recursive) CNAME resolving and apex domain determination. For DNS-01 challenge verification, the authoritative DNS server is queried directly. Supported: host:port. The default is to use the system resolvers, or Google's DNS resolvers if the system's cannot be determined."

It seems the Google's DNS services are not queried if the domain exist on the local DNS service, but no SOA records do.

[WallyDW]

I have had issues with the certificate integration too and it seems that it is due to DNS servers being registered as locals and not as servers in the network settings.

I set them manually in the network settings and it is the same as my router.
It will then become registered as a locals when running "ha dns info" in the HAOS cli.
This will not work with the certificate integration and the Let's Encrypt addon.

Running "ha dns options --server dns://ip_of_router" will add the exact same DNS service as a server in the "ha dns info" print out and now everything works.

Problem is a "ha dns reset" will remove the server from "ha dns info" again and only leave the locals listed.
There seems to be no way to add a server in the GUI currently.

[zone-zero]

I was able to resolve this by removing the Unbound DNS override for the root of the domain. deleted my domain.tld record from unbound overrides, and unbound started serving up the proper public SOA record for domain.tld. This may not work for everyone, if you can't live with removing the domain.tld record.

[WallyDW]

Sound like you just remove your split-DNS, which is not an option for many and not for me.

[zone-zero]

I removed split dns for the root record only. I get that won't be an option for everyone. hostnames under that domain are still split. I removed split dns for_domain.tld_ but host1.domain.tld and host2.domain.tld are still split.

edit: ultimately this is an incompatibility between unbound (and potentially other split dns implementations) and certbot-multi-dns (lego). Unbound provides no option to pass the public SOA record through when overriding an A record, and lego provides no option for skipping the SOA check. You can potentially change the dns resolver by using the "--dns.resolvers" option, but if you have port 53 rerouted to your local dns server to prevent domain leakage, you are essentially out of luck with split dns.

[WallyDW]

Your unbound DNS is obviously a rewriting split-DNS setup, but it probably does not do DHCP registrations for the DNS zone, which is what I use in my split-DNS.
It is not an Unbound DNS, but actually more likely a BIND running on my router's OS called Vyatta or more maybe VyOS.

[zone-zero]

Huh, i thought BIND couldn't even stand up a zone without an SOA record. For my fix, all that really changed from the plugin's perspective was a valid SOA was returned when I stopped forwarding the root domain. If you run dig from your HA server, what is the response to the following?

dig domain.tld SOA

If you get a valid response back, can you then follow up with a query to the DNS server returned in the SOA record? can you get a response back for an A record from the SOA?

dig @<SOA server> domain.TLD A

[WallyDW]

I do not get a valid response for the SOA record, but I can also not deactivate the split-DNS, because then all my other stuff would die.

[WallyDW]

Looking at the CoreDNS documentation site it seems all wrong to add the DNS servers from the HAOS GUI DNS settings to locals.
It does not seem that it is what locals are for.
https://coredns.io/plugins/local/

[github-actions]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[pwsh]

Let's encrypt changelog mentions a new option, but it's not exposed in the gui and I can't find where to enable this

6.3.0

Update certbot-dns-multi to 4.33.0, adding several DNS providers (see lego's changelog for details).
Add dns_multi_nameservers option for split DNS setups where local DNS causes zone lookup failures.