{"record":{"id":"61ca7309c4bd1ae6","repo":"Billionmail/BillionMail","slug":"failed-to-set-cloudflare-dns-verification","errorCode":null,"errorMessage":"Failed to set Cloudflare DNS verification: {}","messagePattern":"Failed to set Cloudflare DNS verification: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/internal/service/acme/acme.go","lineNumber":429,"sourceCode":"\t\tcase \"alidns\":\n\t\t\terr = SetDnsAliyun(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Alibaba Cloud DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudxns\":\n\t\t\terr = SetDnsCloudxns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set CloudXNS DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"azuredns\":\n\t\t\terr = SetDnsAzuredns(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set AzureDNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"cloudflare\":\n\t\t\terr = SetDnsCloudflare(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Cloudflare DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tcase \"godaddy\":\n\t\t\terr = SetDnsGodaddy(ctx, client, dnsProviderToken)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Failed to set Godaddy DNS verification: {}\", err.Error()))\n\t\t\t}\n\t\tdefault:\n\t\t\treturn \"\", \"\", errors.New(public.LangCtx(ctx, \"Unsupported DNS provider: {}\", dnsProvider))\n\t\t}\n\t}\n\n\t// Register or query existing user on ACME server\n\tvar reg *registration.Resource\n\t// Try to query existing registration first (same key = same account)\n\treg, err = client.Registration.QueryRegistration()\n\tif err != nil || reg == nil {\n\t\t// No existing registration, register new account\n\t\treg, err = client.Registration.Register(registration.RegisterOptions{TermsOfServiceAgreed: true})","sourceCodeStart":411,"sourceCodeEnd":447,"githubUrl":"https://github.com/Billionmail/BillionMail/blob/fc36c76c050c3775c5e899faf7403cf0262d2744/core/internal/service/acme/acme.go#L411-L447","documentation":"For vtype == \"dns\" with dnsProvider == \"cloudflare\", SetDnsCloudflare constructs a lego Cloudflare provider using dnsProviderToken and registers it for the dns-01 challenge. The error means Cloudflare provider setup failed — usually an invalid or wrongly scoped API token/key, or using the legacy Global API Key format where an API Token is expected.","triggerScenarios":"ApplySSLWithExistingServer (via Apply, StartRenew, ApplyLetsEncryptCertWithHttp, ApplyConsoleCert) with vtype=\"dns\", dnsProvider=\"cloudflare\", and a dnsProviderToken that is an expired/revoked API token, a Global API Key supplied without the account email, or a token lacking Zone:DNS:Edit permission for the domain.","commonSituations":"Rotated Cloudflare token not updated in the app; token created for the wrong zone; pasting the Global API Key where the app expects a Bearer API token (or vice versa).","solutions":["Create a fresh Cloudflare API Token scoped to the zone with Zone:DNS:Edit and set it as dnsProviderToken","If using the Global API Key, supply it in the combined form the lego provider expects (email + key) per the app's token format","Verify the token with the Cloudflare API (list zones) before retrying the certificate application"],"exampleFix":"// before\ndnsProviderToken = \"legacyGlobalKey\" // without account email\n// after\ndnsProviderToken = \"cf_api_token_with_dns_edit\"","handlingStrategy":"validation","validationCode":"if dnsProvider == \"cloudflare\" && len(strings.TrimSpace(dnsProviderToken)) < 20 {\n    return errors.New(\"cloudflare API token looks invalid\")\n}\n// optional live check:\n// GET https://api.cloudflare.com/client/v4/zones with Bearer token must return success","typeGuard":"func isCloudflareConfigured(vtype, provider, token string) bool {\n    return vtype == \"dns\" && provider == \"cloudflare\" && strings.TrimSpace(token) != \"\"\n}","tryCatchPattern":"cert, _, err := ApplySSLWithExistingServer(ctx, ...)\nif err != nil && strings.Contains(err.Error(), \"Cloudflare\") {\n    return fmt.Errorf(\"check Cloudflare API token scope (Zone:DNS:Edit): %w\", err)\n}","preventionTips":["Create a scoped API Token with Zone:DNS:Edit for the target zone","Update stored tokens immediately after rotation in Cloudflare","Validate the token against the Cloudflare API before applying for certs"],"tags":["acme","dns-01","cloudflare","credentials"],"backgroundTag":"dns-provider-auth-failed","analyzedSha":"fc36c76c050c3775c5e899faf7403cf0262d2744","analyzedAt":"2026-09-05T21:28:54.019Z","contentChangedAt":"2026-09-05T21:28:54.019Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}