← Problem Library
K8s L4 K8S 1388 · 12 min

A cert-manager DNS01 challenge keeps creating TXT records in the wrong zone

Automation is healthy, yet the challenge lands in the parent zone because two controllers normalize the target name differently.

K8sPlatform ReliabilityLevel 4Pro12 min
Scenario

A delegated subzone migration completes and later certificate renewals begin failing with seemingly correct TXT record automation.

What to check first
  • Identify the primary failure signal in the The TXT Record Existed and It Lived in the Wrong Zone Boundary scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Compare exact zone selection logic across controllers before editing credentials or TXT cleanup.

Questions worth viewing together
What should you verify first when A cert-manager DNS01 challenge keeps creating TXT records in the wrong zone appears?

Community-field Kubernetes problem inspired by cert-manager and DNS automation cases where a DNS01 TXT landed in the parent zone after subzone migration. DNS01 failures often come from conflicting zone normalization rules rather than from missing write permission.

What usually causes A cert-manager DNS01 challenge keeps creating TXT records in the wrong zone in production?

Teams often blame provider API permissions when the record is being created successfully in the wrong zone.

What should you document after resolving A cert-manager DNS01 challenge keeps creating TXT records in the wrong zone?

Subzone delegation changes should be validated against every controller that normalizes or filters zone names.