diff --git a/webmin/letsencrypt-cleanup.pl b/webmin/letsencrypt-cleanup.pl
index 0c09c03b5..834f2a773 100755
--- a/webmin/letsencrypt-cleanup.pl
+++ b/webmin/letsencrypt-cleanup.pl
@@ -21,6 +21,7 @@ $dname || die "Missing CERTBOT_DOMAIN environment variable";
 # Find the DNS domain and records
 my ($zone, $zname) = &get_bind_zone_for_domain($dname);
 $zone || die "No zone named $dname found";
+$zone->{'file'} || die "Zone $dname does not have a records file";
 &lock_file(&bind8::make_chroot(&bind8::absolute_path($zone->{'file'})));
 my @recs = &bind8::read_zone_file($zone->{'file'}, $zname);
 
diff --git a/webmin/letsencrypt-dns.pl b/webmin/letsencrypt-dns.pl
index 1d57f7703..ad5df3916 100755
--- a/webmin/letsencrypt-dns.pl
+++ b/webmin/letsencrypt-dns.pl
@@ -23,6 +23,7 @@ $val || die "Missing CERTBOT_VALIDATION environment variable";
 # Find the DNS domain and records
 my ($zone, $zname) = &get_bind_zone_for_domain($dname);
 $zone || die "No zone named $dname found";
+$zone->{'file'} || die "Zone $dname does not have a records file";
 &lock_file(&bind8::make_chroot(&bind8::absolute_path($zone->{'file'})));
 my @recs = &bind8::read_zone_file($zone->{'file'}, $zname);
 
diff --git a/webmin/letsencrypt-lib.pl b/webmin/letsencrypt-lib.pl
index 6a8a5cbe0..a72c5ce4f 100755
--- a/webmin/letsencrypt-lib.pl
+++ b/webmin/letsencrypt-lib.pl
@@ -388,7 +388,7 @@ my ($d) = @_;
 my $bd = $d;
 while ($bd =~ /\./) {
 	my $z = &bind8::get_zone_name($bd, "any");
-	if ($z) {
+	if ($z && $z->{'file'} && $z->{'type'} eq 'master') {
 		return ($z, $bd);
 		}
 	$bd =~ s/^[^\.]+\.//;