diff --git a/pkg/issuer/acme/dns/cloudflare/cloudflare.go b/pkg/issuer/acme/dns/cloudflare/cloudflare.go
index cf42f7b6c..50c696b30 100644
--- a/pkg/issuer/acme/dns/cloudflare/cloudflare.go
+++ b/pkg/issuer/acme/dns/cloudflare/cloudflare.go
@@ -102,6 +102,7 @@ func FindNearestZoneForFQDN(c DNSProviderType, fqdn string) (DNSZone, error) {
 	}
 	mappedFQDN := strings.Split(fqdn, ".")
 	nextName := util.UnFqdn(fqdn) //remove the trailing dot
+	var lastErr error
 	for i := 0; i < len(mappedFQDN)-1; i++ {
 		var from, to = len(mappedFQDN[i]) + 1, len(nextName)
 		if from > to {
@@ -111,8 +112,10 @@ func FindNearestZoneForFQDN(c DNSProviderType, fqdn string) (DNSZone, error) {
 			nextName = string([]rune(nextName)[from:to])
 			continue
 		}
+		lastErr = nil
 		result, err := c.makeRequest("GET", "/zones?name="+nextName, nil)
 		if err != nil {
+			lastErr = err
 			continue
 		}
 		var zones []DNSZone
@@ -126,6 +129,9 @@ func FindNearestZoneForFQDN(c DNSProviderType, fqdn string) (DNSZone, error) {
 		}
 		nextName = string([]rune(nextName)[from:to])
 	}
+	if lastErr != nil {
+		return DNSZone{}, fmt.Errorf("while attempting to find Zones for domain %s\n%s", fqdn, lastErr)
+	}
 	return DNSZone{}, fmt.Errorf("Found no Zones for domain %s (neither in the sub-domain nor in the SLD) please make sure your domain-entries in the config are correct and the API key is correctly setup with Zone.read rights.", fqdn)
 }
 
diff --git a/pkg/issuer/acme/dns/cloudflare/cloudflare_test.go b/pkg/issuer/acme/dns/cloudflare/cloudflare_test.go
index e278e71b6..aff26eabc 100644
--- a/pkg/issuer/acme/dns/cloudflare/cloudflare_test.go
+++ b/pkg/issuer/acme/dns/cloudflare/cloudflare_test.go
@@ -10,6 +10,7 @@ package cloudflare
 
 import (
 	"encoding/json"
+	"fmt"
 	"io"
 	"os"
 	"testing"
@@ -42,8 +43,9 @@ func (c *DNSProviderMock) makeRequest(method, uri string, body io.Reader) (json.
 func init() {
 	cflareEmail = os.Getenv("CLOUDFLARE_EMAIL")
 	cflareAPIKey = os.Getenv("CLOUDFLARE_API_KEY")
+	cflareAPIToken = os.Getenv("CLOUDFLARE_API_TOKEN")
 	cflareDomain = os.Getenv("CLOUDFLARE_DOMAIN")
-	if len(cflareEmail) > 0 && len(cflareAPIKey) > 0 && len(cflareDomain) > 0 {
+	if len(cflareEmail) > 0 && (len(cflareAPIKey) > 0 || len(cflareAPIToken) > 0) && len(cflareDomain) > 0 {
 		cflareLiveTest = true
 	}
 }
@@ -108,7 +110,25 @@ func TestFindNearestZoneForFQDN(t *testing.T) {
 
 	assert.NoError(t, err)
 	assert.Equal(t, zone, DNSZone{ID: "1a23cc4567b8def91a01c23a456e78cd", Name: "sub.domain.com"})
+}
 
+func TestFindNearestZoneForFQDNInvalidToken(t *testing.T) {
+	dnsProvider := new(DNSProviderMock)
+
+	noResult := []byte(`[]`)
+
+	dnsProvider.On("makeRequest", "GET", "/zones?name=_acme-challenge.test.sub.domain.com", mock.Anything).Maybe().Return(noResult, nil)
+	dnsProvider.On("makeRequest", "GET", "/zones?name=test.sub.domain.com", mock.Anything).Maybe().Return(noResult, nil)
+	dnsProvider.On("makeRequest", "GET", "/zones?name=sub.domain.com", mock.Anything).Maybe().Return(noResult, nil)
+	dnsProvider.On("makeRequest", "GET", "/zones?name=domain.com", mock.Anything).Return(noResult,
+		fmt.Errorf(`while attempting to find Zones for domain _acme-challenge.test.sub.domain.com
+while querying the Cloudflare API for GET "/zones?name=_acme-challenge.test.sub.domain.com"
+	 Error: 9109: Invalid access token`))
+
+	_, err := FindNearestZoneForFQDN(dnsProvider, "_acme-challenge.test.sub.domain.com.")
+
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "Invalid access token")
 }
 
 func TestCloudFlarePresent(t *testing.T) {