No TXT records added just A and AAAA

[seb-steuer]

What happened:
When adding ingress external-dns only inserts A and AAAA records and no TXT records. Then when resource is recreated and new target loadbalancer is created for same domain, records are not updated. external-dns runs in upsert only mode.

This is on 0.19.0

log:

time="2025-10-23T14:36:39Z" level=info msg="All records are already up to date"
time="2025-10-23T14:37:39Z" level=info msg="Applying provider record filter for domains: [xxx-yyy.aaa.bbbb.ccc. .xxx-yyy.aaa.bbbb.ccc.]"
time="2025-10-23T14:37:39Z" level=info msg="Desired change: CREATE xxx-yyy.aaa.bbbb.ccc A" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-23T14:37:39Z" level=info msg="Desired change: CREATE xxx-yyy.aaa.bbbb.ccc AAAA" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-23T14:37:39Z" level=info msg="2 record(s) were successfully updated" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-23T14:38:40Z" level=info msg="Applying provider record filter for domains: [xxx-yyy.aaa.bbbb.ccc. .xxx-yyy.aaa.bbbb.ccc.]"
time="2025-10-23T14:38:40Z" level=info msg="All records are already up to date"

What you expected to happen:
I expect TXT records to accompany A and AAAA records and updates happen for records already created if target has changed.

How to reproduce it (as minimally and precisely as possible):
Set up public hosted zone in Route53
Deploy external-dns with filtering for that zone
Define ingress for apex record of the zone

spec:
  automountServiceAccountToken: true
  containers:
  - args:
    - --log-level=info
    - --log-format=text
    - --interval=1m
    - --source=service
    - --source=ingress
    - --policy=upsert-only
    - --registry=txt
    - --txt-owner-id=xxx-yyy.aaa.bbbb.ccc-owner
    - --domain-filter=xxx-yyy.aaa.bbbb.ccc
    - --provider=aws

Anything else we need to know?:

Environment:

• External-DNS version (use external-dns --version): 0.19.0
• DNS provider: AWS Route53
• Others:

[seb-steuer]

When in ingress instead of apex record i specify a subdomain the TXT records are created properly.
So the problem only happens for apex records.

time="2025-10-24T13:42:58Z" level=info msg="All records are already up to date"
time="2025-10-24T13:43:58Z" level=info msg="Applying provider record filter for domains: [xxx-yyy.aaa.bbbb.ccc. .xxx-yyy.aaa.bbbb.ccc.]"
time="2025-10-24T13:43:58Z" level=info msg="Desired change: CREATE aaaa-sub.xxx-yyy.aaa.bbbb.ccc TXT" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-24T13:43:58Z" level=info msg="Desired change: CREATE cname-sub.xxx-yyy.aaa.bbbb.ccc TXT" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-24T13:43:58Z" level=info msg="Desired change: CREATE sub.xxx-yyy.aaa.bbbb.ccc A" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-24T13:43:58Z" level=info msg="Desired change: CREATE sub.xxx-yyy.aaa.bbbb.ccc AAAA" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-24T13:43:58Z" level=info msg="4 record(s) were successfully updated" profile=default zoneID=/hostedzone/XXXXXXXXXXXXXXXXXXXXX zoneName=xxx-yyy.aaa.bbbb.ccc.
time="2025-10-24T13:44:58Z" level=info msg="Applying provider record filter for domains: [xxx-yyy.aaa.bbbb.ccc. .xxx-yyy.aaa.bbbb.ccc.]"
time="2025-10-24T13:44:58Z" level=info msg="All records are already up to date"

Although the prefixes used by TXT records are aaaa- and cname- but both records are alias records A and AAAA not a CNAME

[seb-steuer]

I have raised log level to debug and for the missing TXT for apex records there are the following messages.

time="2025-10-24T14:03:57Z" level=debug msg="Skipping record cname-xxx-yyy.aaa.bbbb.ccc because no hosted zone matching record DNS Name was detected"
time="2025-10-24T14:03:57Z" level=debug msg="Skipping record aaaa-xxx-yyy.aaa.bbbb.ccc because no hosted zone matching record DNS Name was detected"

which makes sense from the perspective of records it is trying to create but doesn't make sense from the behavior perspective. I'm pretty sure this worked when i used it in the past probably around 0.14 version

[u-kai]

@seb-steuer

As the docs caution, when you want to manage apex records with the TXT registry, you must set an appropriate --txt-prefix.
If the txt-prefix isn’t suitable for apex, ExternalDNS can’t place the ownership TXT at the root, so it creates only the A/AAAA,CNAME and so on and skips the TXT ownership record — which matches the behavior you’re observing.

For additional context:
I have a PR(#5864) in progress that emits a warn log and blocks creating the record when someone tries to create an apex record under TXT registry without a valid txt-prefix.
However, due to various considerations, it’s still unclear whether that PR will be merged.

[seb-steuer]

@u-kai

The bigger problem for me is the fact that behavior changed. upsert-only worked well for apex records with txt registry pre AAAA record handling support.

Right now its just not upserting its insert only in that situation. I blamed it here on the missing ownership records but in fact i personally dont really even care about them. What I care about is that the updates happen.
Right now when I delete my ingress for apex record and recreate it which results in new ALB the A/AAAA records wont be updated.

I think it would be preferable for the update to happen with warning of not managing ownership record than for update to not happen at all.

I will look into the txt-prefix and test upgrade scenario for a zone with many existing records

[u-kai]

@seb-steuer

I think the recent update caused the old txt registry format to stop working.
In the new implementation, apex records require a properly configured txt-prefix to create ownership TXT records correctly.
Without that configuration, ExternalDNS cannot determine that it owns the A/AAAA records, so updates no longer occur even when the ALB target changes.

[ivankatliarchuk]

If old registry format was in use, they should be migrated manually. Best option is to create a script and move things to new format.

Notes https://github.com/kubernetes-sigs/external-dns/releases/tag/v0.18.0

If the issue is related to apex. Apex records are always was a gray area. Example issue #449

Share your k8s manifests and what records was created before, share all of them.

Have you tried ``--txt-prefixor--txt-suffix`?

[seb-steuer]

i'll be moving to --txt-prefix='__%{record_type}__.' i just don't understand why the default prefix for new format is something that breaks apex records. It makes no sense to me.
Now i'll have to deal with changing all TXT records in many zones.

[ivankatliarchuk]

The behavior of the current TXT record format was decided years ago, and I’m not sure who could even speak to the original reasoning at this point. If the older/legacy TXT format works better for your use case, it may be best to remain on that version.

Relevant issue from years back #3757

To be honest, we don’t have a defined roadmap. Anyone can submit a PR, and if it’s merged, we often deal with the long-term consequences. Since this is a volunteer-driven project, we don’t have the capacity to validate every PR across all edge cases. Fully automated end-to-end testing would also require resources and funding that we currently don’t have.