diff --git a/src/apptask.js b/src/apptask.js
index e91c1afe2..0a0642f56 100644
--- a/src/apptask.js
+++ b/src/apptask.js
@@ -335,7 +335,7 @@ function waitForDnsPropagation(app, callback) {
 function waitForAltDomainDnsPropagation(app, callback) {
     if (!app.altDomain) return callback(null);
 
-    waitForDns(app.altDomain, config.appFqdn(app.location), 'CNAME', app.altDomain /* zone */, callback); // waits forever
+    waitForDns(app.altDomain, config.appFqdn(app.location), 'CNAME', callback); // waits forever
 }
 
 // updates the app object and the database
diff --git a/src/certificates.js b/src/certificates.js
index b161a62a8..6d06b96fd 100644
--- a/src/certificates.js
+++ b/src/certificates.js
@@ -17,7 +17,6 @@ var acme = require('./cert/acme.js'),
     safe = require('safetydance'),
     settings = require('./settings.js'),
     sysinfo = require('./sysinfo.js'),
-    tld = require('tldjs'),
     user = require('./user.js'),
     util = require('util'),
     waitForDns = require('./waitfordns.js'),
@@ -92,8 +91,7 @@ function installAdminCertificate(callback) {
         sysinfo.getIp(function (error, ip) {
             if (error) return callback(error);
 
-            var zoneName = tld.getDomain(config.fqdn());
-            waitForDns(config.adminFqdn(), ip, zoneName, function (error) {
+            waitForDns(config.adminFqdn(), ip, function (error) {
                 if (error) return callback(error); // this cannot happen because we retry forever
 
                 ensureCertificate({ location: constants.ADMIN_LOCATION }, function (error, certFilePath, keyFilePath) {
diff --git a/src/waitfordns.js b/src/waitfordns.js
index 4c76375e0..a6c19ed64 100644
--- a/src/waitfordns.js
+++ b/src/waitfordns.js
@@ -6,7 +6,8 @@ var assert = require('assert'),
     async = require('async'),
     attempt = require('attempt'),
     debug = require('debug')('box:src/waitfordns'),
-    dns = require('native-dns');
+    dns = require('native-dns'),
+    tld = require('tldjs');
 
 // the first arg to callback is not an error argument; this is required for async.every
 function isChangeSynced(domain, value, type, nameserver, callback) {
@@ -49,11 +50,10 @@ function isChangeSynced(domain, value, type, nameserver, callback) {
  }
 
 // check if IP change has propagated to every nameserver
-function waitForDns(domain, value, type, zoneName, options, callback) {
+function waitForDns(domain, value, type, options, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof value, 'string');
     assert(type === 'A' || type === 'CNAME');
-    assert.strictEqual(typeof zoneName, 'string');
 
     var defaultOptions = {
         retryInterval: 5000,
@@ -68,6 +68,7 @@ function waitForDns(domain, value, type, zoneName, options, callback) {
         assert.strictEqual(typeof callback, 'function');
     }
 
+    var zoneName = tld.getDomain(zoneName);
     debug('waitForIp: domain %s to be %s in zone %s.', domain, value, zoneName);
 
     attempt(function (attempts) {