cloudflare / cloudflare/certbot-dns-cloudflare

Plugin possibly broken with Cloudflare API changes

Open
#6 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
Python
Stars
29
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Has Cloudflare's DNS Zone Edit API made some change that's broken this plugin recently?

I've been using this DNS cloudflare certbot plugin for validation ever since more heavily using Cloudflare's attack mode to mitigate more frequent AI bot issues. This attack mode makes HTTP validation with certbot impossible, hence switching to this plugin to handle validation through DNS. I've been using this for over a year now I think, with renewals working fine.

But certbot is no longer able to renew SSL certificates (on my origin server behind Cloudflare) using this plugin as of this month. Specifically, it seems to be unable to lookup the `zone_id` for my zone to use for DNS edits:

Certbot logs (actual domain redacted):

```
2026-03-29 09:09:25,025:DEBUG:urllib3.connectionpool:Starting new HTTPS connection (1): api.cloudflare.com:443
2026-03-29 09:09:25,072:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:25,072:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=sub.example.org&per_page=1'): Retry(total=4, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,072:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=sub.example.org&per_page=1
2026-03-29 09:09:26,079:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,080:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=sub.example.org&per_page=1'): Retry(total=3, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,080:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=sub.example.org&per_page=1
2026-03-29 09:09:26,086:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,086:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=sub.example.org&per_page=1'): Retry(total=2, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,086:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=sub.example.org&per_page=1
2026-03-29 09:09:26,092:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,092:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=sub.example.org&per_page=1'): Retry(total=1, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,092:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=sub.example.org&per_page=1
2026-03-29 09:09:26,099:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,099:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=sub.example.org&per_page=1'): Retry(total=0, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,099:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=sub.example.org&per_page=1
2026-03-29 09:09:26,106:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=sub.example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,108:DEBUG:certbot_dns_cloudflare._internal.dns_cloudflare:Unrecognised CloudFlareAPIError while finding zone_id: 971 Please wait and consider throttling your request speed. Continuing with next zone guess...
2026-03-29 09:09:26,115:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,115:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=example.org&per_page=1'): Retry(total=4, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,115:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=example.org&per_page=1
2026-03-29 09:09:26,121:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,122:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=example.org&per_page=1'): Retry(total=3, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,122:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=example.org&per_page=1
2026-03-29 09:09:26,128:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,128:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=example.org&per_page=1'): Retry(total=2, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,129:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=example.org&per_page=1
2026-03-29 09:09:26,135:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,136:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=example.org&per_page=1'): Retry(total=1, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,136:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=example.org&per_page=1
2026-03-29 09:09:26,142:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,142:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=example.org&per_page=1'): Retry(total=0, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,142:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=example.org&per_page=1
2026-03-29 09:09:26,149:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=example.org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,149:DEBUG:certbot_dns_cloudflare._internal.dns_cloudflare:Unrecognised CloudFlareAPIError while finding zone_id: 971 Please wait and consider throttling your request speed. Continuing with next zone guess...
2026-03-29 09:09:26,156:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,156:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=org&per_page=1'): Retry(total=4, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,156:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=org&per_page=1
2026-03-29 09:09:26,163:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,163:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=org&per_page=1'): Retry(total=3, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,163:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=org&per_page=1
2026-03-29 09:09:26,171:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,171:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=org&per_page=1'): Retry(total=2, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,171:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=org&per_page=1
2026-03-29 09:09:26,176:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,177:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=org&per_page=1'): Retry(total=1, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,177:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=org&per_page=1
2026-03-29 09:09:26,182:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,182:DEBUG:urllib3.util.retry:Incremented Retry for (url='/client/v4/zones?name=org&per_page=1'): Retry(total=0, connect=None, read=None, redirect=None, status=None)
2026-03-29 09:09:26,182:DEBUG:urllib3.connectionpool:Retry: /client/v4/zones?name=org&per_page=1
2026-03-29 09:09:26,189:DEBUG:urllib3.connectionpool:https://api.cloudflare.com:443 "GET /client/v4/zones?name=org&per_page=1 HTTP/1.1" 429 136
2026-03-29 09:09:26,190:DEBUG:certbot_dns_cloudflare._internal.dns_cloudflare:Unrecognised CloudFlareAPIError while finding zone_id: 971 Please wait and consider throttling your request speed. Continuing with next zone guess...
2026-03-29 09:09:26,190:DEBUG:certbot_dns_cloudflare._internal.dns_cloudflare:Encountered error finding zone_id during deletion: Unable to determine zone_id for sub.example.org using zone names: ['sub.example.org', 'example.org', 'org']. The error from Cloudflare was: 971 Please wait and consider throttling your request speed.
```

It seems like maybe it's triggering API rate limits, resulting in throttling.

That can be related to what kind of API auth/token is used, so to clarify that: Up until now, I've been using a scoped (to `Zone.DNS`) User API token, but I know Cloudflare has since added (and recommends) using Account API tokens. I've created that scoped (again to `Zone.DNS`) account API token, and configured that, however, it seems to still be getting the same 429 rate limiting, even on a brand new auth token that shouldn't be rate limited.

I'm wondering if there's something else broken with the plugin that just happens to eventually result in hitting rate limits due to too many retries for some kind of error that can't just be retried anyway (it does seem to attempt this zone_id lookup with 18 requests for just this one domain, despite the 429 errors for example).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.