SSL certificate renewal failing — DNS on Cloudflare, domain pointing to non-Netlify IPs

Support
1

Hi Netlify team,
I’m hoping someone can help me sort out an SSL certificate renewal issue before my current certificate expires on August 2, 2026.
The error I’m getting:
SniCertificate::CertificateValidationError: Unable to verify challenge for *.marketdrops.shop: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.marketdrops.shop - check that a DNS record exists for this domain
I tried clicking “Renew” in the SSL/TLS settings but got the same error.
My setup:

  • Site name: resonant-malasada-e03296
  • Primary domain: marketdrops.shop
  • WWW subdomain: www.marketdrops.shop (redirects to primary)
  • DNS provider: Cloudflare (nameservers are Cloudflare’s)
  • All Cloudflare proxy clouds are grey/DNS-only (not orange/proxied)
  • Certificate created: May 4, 2026
  • Certificate expires: August 2, 2026
  • The site is currently live and working fine with the existing certificate
    Current DNS records on Cloudflare (A records only):
  • marketdrops.shop → A record → 18.208.88.157
  • marketdrops.shop → A record → 98.84.224.111
  • www.marketdrops.shop → A record → (two A records, same IPs)
    What’s confusing me:
    My A records are pointing to IPs that don’t match what Netlify’s documentation recommends (75.2.60.5). But my site is working fine right now on the current IPs. I’m not sure if:
  • These are old IPs from a previous setup that happen to still work
  • There’s some kind of redirect happening behind the scenes
  • I should change them to 75.2.60.5 as the docs suggest
    I don’t want to change the DNS records and risk breaking a working site without confirmation from someone who can see my account.
    What I’d like help with:
  1. Can the certificate renewal be fixed to work with Cloudflare DNS? (e.g., changing verification method from DNS-01 to HTTP-01, or another approach)
  2. Should my A records point to 75.2.60.5 instead of the current IPs? Why does the site work on the current non-Netlify IPs?
  3. Is there anything I need to add to Cloudflare DNS for the renewal to work automatically going forward?
    Other records on Cloudflare that I’m not touching (in case it’s relevant):
  • MX records for email routing (Cloudflare Email Routing → Protonmail)
  • TXT records (domain verification, domain key)
  • media.marketdrops.shop CNAME for Cloudflare R2 storage
    I’d really appreciate some guidance here. I have until August 2 before the certificate expires, so there’s some time, but I want to get this sorted properly. Thank you!
2

Update: Still no response and my certificate expires in a few days. I need to launch my site July 31. Can someone from Netlify staff please look at this? I just need to know if I should change my A records to 75.2.60.5 or if there’s another fix. Thank you.

3

Hi, @marketdrops. You have an inactive Netlify DNS zone here:

https://app.netlify.com/account/dns/marketdrops.shop

This zone causes Netlify to attempt to provision the SSL certificate using a TXT record for verification using DNS. However, because the DNS zone is inactive, this TXT record check is failing.

If you delete the inactive DNS zone, this will cause Netlify to use HTTP instead of DNS for verification and the HTTP check will succeed.

4

Hi Luke, that did the trick. I deleted the inactive DNS zone and the SSL certificate renewed successfully via HTTP verification. The new cert is now valid through October 26. Thank you for the clear and quick help — much appreciated!