Zone lookup fails to resolve the correct managed zone

dig SOA _acme-challenge.www.sub.example.com. +noall +answer
dig SOA www.sub.example.com. +noall +answer
dig SOA sub.example.com. +noall +answer
dig SOA example.com. +noall +answer

# Healthy result: every level is empty except one, which returns
# exactly one SOA record, e.g.:
# sub.example.com.  3600  IN  SOA  ns1.provider.com. admin.example.com. ...
#
# Bad result: no level ever returns an SOA (broken delegation), or two
# different levels both answer with an SOA (unexpected extra delegation)

dig NS sub.example.com. +noall +answer
dig NS example.com. +noall +answer

# If sub.example.com has its own NS set that is different from
# example.com's NS set, sub.example.com is delegated as its own zone.

curl -s "https://api.cloudflare.com/client/v4/zones?name=sub.example.com" \
  -H "Authorization: Bearer $CF_TOKEN" | jq '.result[].name'

curl -s "https://api.cloudflare.com/client/v4/zones?name=example.com" \
  -H "Authorization: Bearer $CF_TOKEN" | jq '.result[].name'

# Whichever call returns a non-empty result array is the zone actually
# registered in this Cloudflare account.

; Create zone "sub.example.com" in Cloudflare, then delegate to it
; from the parent zone (example.com) with these NS records:
sub.example.com.  NS  ns1.cloudflare.com.
sub.example.com.  NS  ns2.cloudflare.com.

# lego / Certbot dns-cloudflare plugin: pass the zone explicitly
certbot certonly --dns-cloudflare \
  --dns-cloudflare-credentials ~/.secrets/cloudflare.ini \
  --dns-cloudflare-zone example.com \
  -d sub.example.com

# Some providers also support a fixed zone id env var instead of a walk
export CF_ZONE_ID="the-known-good-zone-id"

# 1. The walk now returns exactly one SOA, at the correct apex,
#    with no SERVFAIL/NXDOMAIN at any intermediate label
dig SOA _acme-challenge.sub.example.com. +noall +answer

# 2. NS agreement: the subdomain's nameservers match the provider
#    that actually hosts that zone
dig NS sub.example.com. +short

# 3. The provider API resolves the exact apex name
curl -s "https://api.cloudflare.com/client/v4/zones?name=sub.example.com" \
  -H "Authorization: Bearer $CF_TOKEN" | jq '.result[].name'
# expected output: "sub.example.com"

# 4. Rerun the ACME client (certbot, or trigger the cert-manager
#    Certificate/Order), then confirm the TXT record landed
dig TXT _acme-challenge.sub.example.com. +short
# expected: the challenge token string, not empty

# 5. Confirm the certificate resource itself is happy
kubectl get certificate my-cert -o jsonpath='{.status.conditions}'
# expected: type Ready, status True (cert-manager)

"""Detect (and, where safe, repair) a zone lookup failure for an ACME
DNS-01 challenge name. Replicates the label walk with dnspython to find
the true DNS-side apex, then checks whether that exact name is a zone
registered in the Cloudflare account. If they disagree, this reports the
mismatch. If DRY_RUN is false and a usable zone was found, it writes the
_acme-challenge TXT record through the Cloudflare API.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("resolve_acme_zone")

DNS_DOMAIN = os.environ.get("DNS_DOMAIN", "sub.example.com")
CHALLENGE_VALUE = os.environ.get("CHALLENGE_VALUE", "placeholder-token")
CLOUDFLARE_API_TOKEN = os.environ.get("CLOUDFLARE_API_TOKEN", "")
CLOUDFLARE_ZONE_ID = os.environ.get("CLOUDFLARE_ZONE_ID", "")
DRY_RUN = os.environ.get("DRY_RUN", "true").lower() == "true"


def fqdn_labels(fqdn):
    """Split a name into labels, most-specific first, e.g.
    "sub.example.com" -> ["sub", "example", "com"]."""
    return [label for label in fqdn.strip(".").split(".") if label]


def candidate_suffixes(labels):
    """All suffixes of the label list, shortest-label-stripped-first,
    e.g. ["_acme-challenge","sub","example","com"] ->
    ["sub.example.com", "example.com", "com"] (drop the challenge label
    itself, the walk only ever tests real domain suffixes)."""
    suffixes = []
    for i in range(1, len(labels)):
        suffixes.append(".".join(labels[i:]))
    return suffixes


def resolve_zone_for_challenge(fqdn_labels, soa_present_at, api_zone_names):
    """
    fqdn_labels: labels of the challenge name from most-specific to root,
                 e.g. ["_acme-challenge","www","sub","example","com"]
    soa_present_at: maps a candidate zone apex string (e.g. "sub.example.com")
                     to whether a live DNS query returned an authoritative SOA there
    api_zone_names: set of zone names the DNS provider account actually has registered
    Returns the zone apex to write records into, or None if walk and API zone list
    never agree (i.e. the failure this issue describes).
    Pure decision logic: walk suffixes shortest-label-stripped-first, find first
    suffix with soa_present_at[suffix] True, then require that suffix to also be
    in api_zone_names; else return None.
    """
    for suffix in candidate_suffixes(fqdn_labels):
        if soa_present_at.get(suffix):
            return suffix if suffix in api_zone_names else None
    return None


def query_soa_present_at(suffixes):
    """Live DNS side: for each candidate suffix, ask for an SOA record and
    record whether an authoritative answer came back."""
    import dns.resolver
    import dns.exception

    present = {}
    for suffix in suffixes:
        try:
            dns.resolver.resolve(suffix, "SOA")
            present[suffix] = True
        except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer, dns.exception.Timeout):
            present[suffix] = False
        except Exception:
            present[suffix] = False
    return present


def fetch_cloudflare_zone_names(candidate_names):
    """Provider side: ask Cloudflare's zone list for each candidate name and
    collect which ones actually exist in this account."""
    import requests

    found = set()
    for name in candidate_names:
        r = requests.get(
            "https://api.cloudflare.com/client/v4/zones",
            params={"name": name},
            headers={"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}"},
            timeout=15,
        )
        r.raise_for_status()
        for zone in r.json().get("result", []):
            found.add(zone["name"])
    return found


def write_acme_txt_record(zone_id, challenge_fqdn, value):
    """Guarded by DRY_RUN. Writes the _acme-challenge TXT record through
    the Cloudflare DNS API once a usable zone has been confirmed."""
    import requests

    r = requests.post(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        json={"type": "TXT", "name": challenge_fqdn, "content": value, "ttl": 120},
        headers={"Authorization": f"Bearer {CLOUDFLARE_API_TOKEN}"},
        timeout=15,
    )
    r.raise_for_status()
    return r.json()


def run():
    challenge_fqdn = f"_acme-challenge.{DNS_DOMAIN}"
    labels = fqdn_labels(challenge_fqdn)
    suffixes = candidate_suffixes(labels)

    log.info("Walking labels for %s: candidates %s", challenge_fqdn, suffixes)

    soa_present_at = query_soa_present_at(suffixes)
    api_zone_names = fetch_cloudflare_zone_names(suffixes)

    log.info("SOA present at: %s", {k: v for k, v in soa_present_at.items() if v})
    log.info("Provider account zone names found: %s", sorted(api_zone_names))

    zone = resolve_zone_for_challenge(labels, soa_present_at, api_zone_names)

    if zone is None:
        log.warning(
            "Could not determine the zone for %s. The SOA walk and the provider "
            "account's zone list never agreed on an apex. Check delegation with "
            "dig NS, and confirm which name is actually registered with the "
            "provider API.",
            challenge_fqdn,
        )
        return

    log.info("Resolved zone: %s", zone)

    if DRY_RUN:
        log.info("DRY_RUN is true. Would write TXT record %s in zone %s.", challenge_fqdn, zone)
        return

    if not CLOUDFLARE_ZONE_ID:
        log.warning("DRY_RUN is false but CLOUDFLARE_ZONE_ID is not set. Not writing.")
        return

    write_acme_txt_record(CLOUDFLARE_ZONE_ID, challenge_fqdn, CHALLENGE_VALUE)
    log.info("Wrote TXT record %s in zone %s.", challenge_fqdn, zone)


if __name__ == "__main__":
    run()

/**
 * Detect (and, where safe, repair) a zone lookup failure for an ACME
 * DNS-01 challenge name. Replicates the label walk with Node's built-in
 * dns module to find the true DNS-side apex, then checks whether that
 * exact name is a zone registered in the Cloudflare account. If they
 * disagree, this reports the mismatch. If DRY_RUN is false and a usable
 * zone was found, it writes the _acme-challenge TXT record through the
 * Cloudflare API.
 */
import { pathToFileURL } from "node:url";

const DNS_DOMAIN = process.env.DNS_DOMAIN || "sub.example.com";
const CHALLENGE_VALUE = process.env.CHALLENGE_VALUE || "placeholder-token";
const CLOUDFLARE_API_TOKEN = process.env.CLOUDFLARE_API_TOKEN || "";
const CLOUDFLARE_ZONE_ID = process.env.CLOUDFLARE_ZONE_ID || "";
const DRY_RUN = (process.env.DRY_RUN || "true").toLowerCase() === "true";

export function fqdnLabels(fqdn) {
  // Split a name into labels, most-specific first, e.g.
  // "sub.example.com" -> ["sub", "example", "com"]
  return fqdn.replace(/\.$/, "").split(".").filter(Boolean);
}

export function candidateSuffixes(labels) {
  // All suffixes of the label list, shortest-label-stripped-first, e.g.
  // ["_acme-challenge","sub","example","com"] ->
  // ["sub.example.com", "example.com", "com"]
  const suffixes = [];
  for (let i = 1; i < labels.length; i++) {
    suffixes.push(labels.slice(i).join("."));
  }
  return suffixes;
}

/**
 * fqdnLabels: labels of the challenge name from most-specific to root,
 *             e.g. ["_acme-challenge","www","sub","example","com"]
 * soaPresentAt: maps a candidate zone apex string (e.g. "sub.example.com")
 *               to whether a live DNS query returned an authoritative SOA there
 * apiZoneNames: set of zone names the DNS provider account actually has registered
 * Returns the zone apex to write records into, or null if walk and API zone
 * list never agree (i.e. the failure this issue describes).
 * Pure decision logic: walk suffixes shortest-label-stripped-first, find first
 * suffix with soaPresentAt[suffix] true, then require that suffix to also be
 * in apiZoneNames; else return null.
 */
export function resolveZoneForChallenge(labels, soaPresentAt, apiZoneNames) {
  for (const suffix of candidateSuffixes(labels)) {
    if (soaPresentAt[suffix]) {
      return apiZoneNames.has(suffix) ? suffix : null;
    }
  }
  return null;
}

async function querySoaPresentAt(suffixes) {
  // Live DNS side: for each candidate suffix, ask for an SOA record and
  // record whether an authoritative answer came back.
  const dns = await import("node:dns");
  const resolveSoa = (name) =>
    new Promise((resolve) => {
      dns.resolveSoa(name, (err) => resolve(!err));
    });

  const present = {};
  for (const suffix of suffixes) {
    present[suffix] = await resolveSoa(suffix);
  }
  return present;
}

async function fetchCloudflareZoneNames(candidateNames) {
  // Provider side: ask Cloudflare's zone list for each candidate name and
  // collect which ones actually exist in this account.
  const found = new Set();
  for (const name of candidateNames) {
    const res = await fetch(
      `https://api.cloudflare.com/client/v4/zones?name=${encodeURIComponent(name)}`,
      { headers: { Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}` } }
    );
    if (!res.ok) throw new Error(`Cloudflare zone lookup failed: ${res.status}`);
    const data = await res.json();
    for (const zone of data.result || []) found.add(zone.name);
  }
  return found;
}

async function writeAcmeTxtRecord(zoneId, challengeFqdn, value) {
  // Guarded by DRY_RUN. Writes the _acme-challenge TXT record through the
  // Cloudflare DNS API once a usable zone has been confirmed.
  const res = await fetch(`https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`, {
    method: "POST",
    headers: {
      Authorization: `Bearer ${CLOUDFLARE_API_TOKEN}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ type: "TXT", name: challengeFqdn, content: value, ttl: 120 }),
  });
  if (!res.ok) throw new Error(`Cloudflare TXT write failed: ${res.status}`);
  return res.json();
}

export async function run() {
  const challengeFqdn = `_acme-challenge.${DNS_DOMAIN}`;
  const labels = fqdnLabels(challengeFqdn);
  const suffixes = candidateSuffixes(labels);

  console.log(`Walking labels for ${challengeFqdn}: candidates ${JSON.stringify(suffixes)}`);

  const soaPresentAt = await querySoaPresentAt(suffixes);
  const apiZoneNames = await fetchCloudflareZoneNames(suffixes);

  console.log("SOA present at:", Object.fromEntries(Object.entries(soaPresentAt).filter(([, v]) => v)));
  console.log("Provider account zone names found:", [...apiZoneNames].sort());

  const zone = resolveZoneForChallenge(labels, soaPresentAt, apiZoneNames);

  if (zone === null) {
    console.warn(
      `Could not determine the zone for ${challengeFqdn}. The SOA walk and the ` +
      "provider account's zone list never agreed on an apex. Check delegation " +
      "with dig NS, and confirm which name is actually registered with the " +
      "provider API."
    );
    return;
  }

  console.log(`Resolved zone: ${zone}`);

  if (DRY_RUN) {
    console.log(`DRY_RUN is true. Would write TXT record ${challengeFqdn} in zone ${zone}.`);
    return;
  }

  if (!CLOUDFLARE_ZONE_ID) {
    console.warn("DRY_RUN is false but CLOUDFLARE_ZONE_ID is not set. Not writing.");
    return;
  }

  await writeAcmeTxtRecord(CLOUDFLARE_ZONE_ID, challengeFqdn, CHALLENGE_VALUE);
  console.log(`Wrote TXT record ${challengeFqdn} in zone ${zone}.`);
}

if (import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((e) => { console.error(e); process.exit(1); });
}

from resolve_acme_zone import fqdn_labels, resolve_zone_for_challenge


LABELS = fqdn_labels("_acme-challenge.www.sub.example.com")


def test_resolves_to_parent_when_only_parent_has_soa_and_api_zone():
    soa = {"www.sub.example.com": False, "sub.example.com": False, "example.com": True, "com": False}
    api_zones = {"example.com"}
    assert resolve_zone_for_challenge(LABELS, soa, api_zones) == "example.com"


def test_resolves_to_delegated_subdomain_when_registered():
    soa = {"www.sub.example.com": False, "sub.example.com": True, "example.com": True, "com": False}
    api_zones = {"sub.example.com"}
    assert resolve_zone_for_challenge(LABELS, soa, api_zones) == "sub.example.com"


def test_none_when_soa_apex_not_in_provider_account():
    # Walk finds sub.example.com, but the account only has example.com.
    soa = {"www.sub.example.com": False, "sub.example.com": True, "example.com": True, "com": False}
    api_zones = {"example.com"}
    assert resolve_zone_for_challenge(LABELS, soa, api_zones) is None


def test_none_when_no_level_ever_answers_with_soa():
    soa = {"www.sub.example.com": False, "sub.example.com": False, "example.com": False, "com": False}
    api_zones = {"example.com"}
    assert resolve_zone_for_challenge(LABELS, soa, api_zones) is None


def test_stops_at_the_first_suffix_with_soa_not_a_later_one():
    # Both sub.example.com and example.com answer with SOA; the walk must
    # stop at the first (most specific) one, not skip ahead.
    soa = {"www.sub.example.com": False, "sub.example.com": True, "example.com": True, "com": False}
    api_zones = {"example.com", "sub.example.com"}
    assert resolve_zone_for_challenge(LABELS, soa, api_zones) == "sub.example.com"


def test_empty_provider_zone_set_is_always_none():
    soa = {"www.sub.example.com": False, "sub.example.com": False, "example.com": True, "com": False}
    assert resolve_zone_for_challenge(LABELS, soa, set()) is None

import { test } from "node:test";
import assert from "node:assert/strict";
import { fqdnLabels, resolveZoneForChallenge } from "./resolve-acme-zone.js";

const LABELS = fqdnLabels("_acme-challenge.www.sub.example.com");

test("resolves to parent when only parent has soa and api zone", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": false, "example.com": true, com: false };
  const apiZones = new Set(["example.com"]);
  assert.equal(resolveZoneForChallenge(LABELS, soa, apiZones), "example.com");
});

test("resolves to delegated subdomain when registered", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": true, "example.com": true, com: false };
  const apiZones = new Set(["sub.example.com"]);
  assert.equal(resolveZoneForChallenge(LABELS, soa, apiZones), "sub.example.com");
});

test("null when soa apex not in provider account", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": true, "example.com": true, com: false };
  const apiZones = new Set(["example.com"]);
  assert.equal(resolveZoneForChallenge(LABELS, soa, apiZones), null);
});

test("null when no level ever answers with soa", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": false, "example.com": false, com: false };
  const apiZones = new Set(["example.com"]);
  assert.equal(resolveZoneForChallenge(LABELS, soa, apiZones), null);
});

test("stops at the first suffix with soa, not a later one", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": true, "example.com": true, com: false };
  const apiZones = new Set(["example.com", "sub.example.com"]);
  assert.equal(resolveZoneForChallenge(LABELS, soa, apiZones), "sub.example.com");
});

test("empty provider zone set is always null", () => {
  const soa = { "www.sub.example.com": false, "sub.example.com": false, "example.com": true, com: false };
  assert.equal(resolveZoneForChallenge(LABELS, soa, new Set()), null);
});