diff --git a/src/apptask.js b/src/apptask.js
index b903f7ed7..07a5714ed 100644
--- a/src/apptask.js
+++ b/src/apptask.js
@@ -331,7 +331,7 @@ function waitForDnsPropagation(app, callback) {
 function waitForAltDomainDnsPropagation(app, callback) {
     if (!app.altDomain) return callback(null);
 
-    waitForDns(app.altDomain, config.appFqdn(app.location), 'CNAME', callback); // waits forever
+    waitForDns(app.altDomain, config.appFqdn(app.location), 'CNAME', { interval: 5000, times: 50000 }, callback);
 }
 
 // updates the app object and the database
diff --git a/src/certificates.js b/src/certificates.js
index cc72bbeb2..3e0e684f8 100644
--- a/src/certificates.js
+++ b/src/certificates.js
@@ -95,8 +95,8 @@ function installAdminCertificate(callback) {
         sysinfo.getIp(function (error, ip) {
             if (error) return callback(error);
 
-            waitForDns(config.adminFqdn(), ip, 'A', function (error) {
-                if (error) return callback(error); // this cannot happen because we retry forever
+            waitForDns(config.adminFqdn(), ip, 'A', { interval: 5000, times: 50000 }, function (error) {
+                if (error) return callback(error);
 
                 ensureCertificate({ location: constants.ADMIN_LOCATION }, function (error, certFilePath, keyFilePath) {
                     if (error) { // currently, this can never happen
diff --git a/src/waitfordns.js b/src/waitfordns.js
index 4502ada9f..47683cb60 100644
--- a/src/waitfordns.js
+++ b/src/waitfordns.js
@@ -64,17 +64,18 @@ function isChangeSynced(domain, value, type, nameserver, callback) {
  }
 
 // check if IP change has propagated to every nameserver
-function waitForDns(domain, value, type, callback) {
+function waitForDns(domain, value, type, options, callback) {
     assert.strictEqual(typeof domain, 'string');
     assert.strictEqual(typeof value, 'string');
     assert(type === 'A' || type === 'CNAME');
+    assert(options && typeof options === 'object'); // { interval: 5000, times: 50000 }
     assert.strictEqual(typeof callback, 'function');
 
     var zoneName = tld.getDomain(domain);
     debug('waitForIp: domain %s to be %s in zone %s.', domain, value, zoneName);
 
     var attempt = 1;
-    async.retry({ interval: 5000, times: 50000 }, function (retryCallback) {
+    async.retry(options, function (retryCallback) {
         debug('waitForDNS: %s attempt %s.', domain, attempt++);
 
         dns.resolveNs(zoneName, function (error, nameservers) {