title: Cert-manager fails to complete dns01 challenge with cloudflare
body: <p>Cert-manager various versions ( 15 and 16 ) installed on both k3s version v1.18.8+k3s1 and docker-desktop version v1.16.6-beta.0 using the following command:</p>
  <pre class="lang-sh prettyprint-override"><code>helm install cert-manager \
  --namespace cert-manager jetstack/cert-manager \
  --version v0.16.1 \
  --set installCRDs=true \
  --set 'extraArgs={--dns01-recursive-nameservers=1.1.1.1:53}'
  </code></pre>
  <p>I applied the following test yaml file:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
  kind: Namespace
  metadata:
    name: test
  ---
  apiVersion: v1
  kind: Secret
  metadata:
    name: cloudflare-api-token-secret
    namespace: test
  type: Opaque
  stringData:
    api-token: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
  ---
  apiVersion: cert-manager.io/v1alpha2
  kind: Issuer
  metadata:
    name: letsencrypt
    namespace: test
  spec:
    acme:
      email: user@example.com
      server: https://acme-staging-v02.api.letsencrypt.org/directory
      privateKeySecretRef:
        name: letsencrypt
      solvers:
      - dns01:
          cloudflare:
            email: user@example.com
            apiTokenSecretRef:
              name: cloudflare-api-token-secret
              key: api-token
  ---
  apiVersion: cert-manager.io/v1alpha2
  kind: Certificate
  metadata:
    name: example.com
    namespace: test
  spec:
    secretName: example.com-tls
    issuerRef:
      name: letsencrypt
    dnsNames:
    - example.com
  </code></pre>
  <p>Result (I have waited even hours):</p>
  <pre><code>kubectl -n test get certs,certificaterequests,order,challenges,ingress -o wide
  NAME                                      READY   SECRET            ISSUER        STATUS                                         AGE
  certificate.cert-manager.io/example.com   False   example.com-tls   letsencrypt   Issuing certificate as Secret does not exist   57s
  
  NAME                                                   READY   ISSUER        STATUS                                                                                   AGE
  certificaterequest.cert-manager.io/example.com-rx7jg   False   letsencrypt   Waiting on certificate issuance from order test/example.com-rx7jg-273779930: &quot;pending&quot;   56s
  
  NAME                                                     STATE     ISSUER        REASON   AGE
  order.acme.cert-manager.io/example.com-rx7jg-273779930   pending   letsencrypt            55s
  
  NAME                                                                   STATE     DOMAIN        REASON                                                                                AGE
  challenge.acme.cert-manager.io/example.com-rx7jg-273779930-625151916   pending   example.com   Cloudflare API error for POST &quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxx xxxxx/dns_records&quot;   53s
  </code></pre>
  <p>Cloudflare setting are the ones from:
  <a href="https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/" rel="nofollow noreferrer">https://cert-manager.io/docs/configuration/acme/dns01/cloudflare/</a> and i have tried with both token and key.</p>
  <p>Cert-manager pod logs:</p>
  <pre><code>I0828 08:34:51.370299       1 dns.go:102] cert-manager/controller/challenges/Present &quot;msg&quot;=&quot;presenting DNS01 challenge for domain&quot; &quot;dnsName&quot;=&quot;example.com&quot; &quot;domain&quot;=&quot;example.com&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;example.com-m72dq-3139291111-641020922&quot; &quot;resource_namespace&quot;=&quot;test&quot; &quot;type&quot;=&quot;dns-01&quot;
  E0828 08:34:55.251730       1 controller.go:158] cert-manager/controller/challenges &quot;msg&quot;=&quot;re-queuing item  due to error processing&quot; &quot;error&quot;=&quot;Cloudflare API error for POST \&quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\&quot;&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
  I0828 08:35:35.251982       1 controller.go:152] cert-manager/controller/challenges &quot;msg&quot;=&quot;syncing item&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
  I0828 08:35:35.252131       1 dns.go:102] cert-manager/controller/challenges/Present &quot;msg&quot;=&quot;presenting DNS01 challenge for domain&quot; &quot;dnsName&quot;=&quot;example.com&quot; &quot;domain&quot;=&quot;example.com&quot; &quot;resource_kind&quot;=&quot;Challenge&quot; &quot;resource_name&quot;=&quot;example.com-m72dq-3139291111-641020922&quot; &quot;resource_namespace&quot;=&quot;test&quot; &quot;type&quot;=&quot;dns-01&quot;
  E0828 08:35:38.797954       1 controller.go:158] cert-manager/controller/challenges &quot;msg&quot;=&quot;re-queuing item  due to error processing&quot; &quot;error&quot;=&quot;Cloudflare API error for POST \&quot;/zones/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/dns_records\&quot;&quot; &quot;key&quot;=&quot;test/example.com-m72dq-3139291111-641020922&quot;
  </code></pre>
  <p>What's wrong?</p>
  <p>Thank you!</p>