diff --git a/pkg/certmanager/provisioner.go b/pkg/certmanager/provisioner.go
index 8e4ded3cf..0816000b6 100644
--- a/pkg/certmanager/provisioner.go
+++ b/pkg/certmanager/provisioner.go
@@ -17,6 +17,7 @@ package certmanager
 import (
 	"context"
 	"fmt"
+	"net"
 	"strings"
 	"time"
 
@@ -79,9 +80,6 @@ func (p *Provisioner) Run(ctx context.Context) error {
 }
 
 func (p *Provisioner) checkDNSConfiguration(domain string) error {
-	if p.cnameTarget == "" {
-		return nil
-	}
 	cnameRecords, err := net.LookupCNAME(domain)
 	if err != nil {
 		return fmt.Errorf("DNS lookup Failed: %w", err)
@@ -91,12 +89,13 @@ func (p *Provisioner) checkDNSConfiguration(domain string) error {
 
 	if !strings.EqualFold(actualTarget, expectedTarget) {
 		return fmt.Errorf(
-			"DNS configuration mismatch: domain %q  resolves to %q, expected %q",
+			"cname target mismatch: domain %q resolves to %q, expected %q",
 			domain,
 			actualTarget,
-			expectedTarget,
+			p.cnameTarget,
 		)
 	}
+
 	return nil
 }
 
@@ -236,11 +235,12 @@ func (p *Provisioner) provisionDomainCertificate(
 		if err := p.checkDNSConfiguration(domain.Domain); err != nil {
 			p.logger.WarnCtx(
 				ctx,
-				"DNS configuration check failed, skipping ACME challenge",
+				"dns configuration check failed",
 				log.String("domain", domain.Domain),
 				log.Error(err),
 			)
-			return fmt.Errorf("DNS configuration not ready: %w", err)
+
+			return err
 		}
 
 		p.logger.InfoCtx(ctx, "DNS configuration verified, initiating HTTP challenge for domain", log.String("domain", domain.Domain))