Hidden DNS entries are preventing to validate domain ownership

Website, Application, Performance DNS & Network
1

What is the name of the domain?

example.com

What is the error message?

An identical record already exists.

What is the issue you’re encountering

Hidden DNS entries are preventing to validate domain ownership

What steps have you taken to resolve the issue?

I followed the instructions in the email to add _acme-challenge and _acme-challenge.api entries, but I’m getting “And identical record already exists.” error even though they’re not in the DNS records table.

I also tried to export the DNS records, the mentioned entries are also not in the export.

What feature, service or problem is this related to?

DNS records

What are the steps to reproduce the issue?

Not sure, first time seeing it myself. Clearly something went wrong somewhere but I don’t know where.

Screenshot of the error

Screenshot 2025-05-09 at 11.54.38.png
Screenshot 2025-05-09 at 11.54.38.png1920×967 108 KB

2

Interestingly, I can see them when I do

$ dig +short txt _acme-challenge.example.com @8.8.8.8
"O8DFd-fcT1hLS6zdz8wtLPdWUJ3T1pDH6IMqafmYXto"
$ dig +short txt _acme-challenge.api.example.com @8.8.8.8
"UHScr6ik7BaVNrEiWbM2tmtlaf2gl1s00zW1QoUr6OA"
3

I also tried to delete or update it through API, but it’s not showing up in here:

https://api.cloudflare.com/client/v4/zones/$ZONE_ID/dns_records

And without the record_id, I cannot do anything further.

This is really funny. 2 records vanished from the ui and api responses, but they’re still somewhat there because I am not able to re-add them. And only way to get some meaningful help is this forums. I need to pay to create a support case.

This is a whole different level of evil that my simple brain cannot comprehend.

4

Can you share the actual domain name?

Universal SSL will normally be issuing certificates for you, … in the background, which from time to time can explain what appears to be “hidden DNS records”.

It does not make much sense for _acme-challenge.api though, as Universal SSL is making wildcard certificates.

→

What do you see under “Edge Certificates”?

→ https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates

1 Like
5

Hi,

Thanks for your reply.

I’ve two problems with this entire ordeal:

  • The fact that there can be unreachable and unmanageable DNS records,
  • The two emails that I got that titles “[Action required]” and tells me I need to take action until May 24.

I don’t believe this is relevant. Problem is the same for example.com or anyotherdomain.com in this context. It has nothing to do with the domain itself.

A list of previously issued certificates and expiration dates. 2 of them are marked as “pending validation”, I assume they’re the ones that I got the emails about. And some wildcard certificates with later expiration dates.

Screenshot 2025-05-10 at 13.50.16
Screenshot 2025-05-10 at 13.50.161920×1099 129 KB

6

Assuming you’re using Universal SSL and Proxied (:orange:) records, it will be mandatory for Cloudflare once in a while, to create some DNS records, in order to request a (new) certificate.

But I had personally made these DNS records visible, together with an information tag, saying something along the lines of:

These DNS records are (managed | added) by Cloudflare, in order to obtain a Universal SSL (or whatever) certificate for your domain name. Once the certificate has been issued successfully, the DNS records will be removed automatically.

Although it could possibly have been worded better, I suppose it makes enough sense, to get to the point of what I mean.

It happens from time to time, that certain domain specific, or DNS record specific things are preventing the successful issuance of a certificate.

I’m not saying it is relevant in your case, or that it will lead anywhere at all.

However, - if there is eventually something, as in just a very tiny thing, that any of the awesome Cloudflare Community members would be able to spot, when having the domain name, but that will be completely impossible to spot without, … then it would be quite sad, as we wouldn’t be able to guide you towards a better result, even though we would be happy to.

Assuming you redacted the domain alone, to “example.com”, and that you didn’t accidentally redact a part of a subdomain (e.g. making “api.lab.example.com” become “api.example.com” in your screenshot), then I am becoming curious about the following:

Is there any specific reason, why you would try to issue Advanced Certificates through a paid add-on, for a (sub-)domain, that is already covered by your Universal SSL?

In addition, -

If you expand the view of the pending certificates, does the eventual validation token(s) match the one(s), that you’re seeing via dig?

1 Like