Split-horizon DNS made lego's propagation check query the container's internal resolver, which doesn't serve the public _acme-challenge TXT record, so the challenge timed out. Add ACME_RESOLVERS (comma-separated host:port, default 8.8.8.8:53) → one --dns.resolvers flag each. Documented in .env + DEPLOY.md.