# cert-manager can't be given API access to the DNS zone for example.com. How can you still use DNS-01 for it?

cert-manager, Hard (Expert), Concepts. https://k8wiz.com/uquiz/cert-manager-cant-be-given-api-access-to-the-dns-zone-for-examplecom-how-can-you-still-use-dns-01-for-it

- A. Use the HTTP-01 solver together with a DNS provider plugin
- B. Set the solver's zone to example.com and leave credentials empty
- C. CNAME _acme-challenge to a zone it can edit and set cnameStrategy: Follow
- D. It can't be done, because DNS-01 needs write access to that exact zone

**Answer:** CNAME _acme-challenge to a zone it can edit and set cnameStrategy: Follow

**Explanation:** The ACME server follows CNAMEs when it looks up the TXT record. With cnameStrategy: Follow, cert-manager resolves the CNAME and writes the TXT record at its target, in a zone where it has credentials. The credentials for the main zone never enter the cluster.