OVH provider: IDN/punycode zone matching fails in v0.18.0 (empty zone -> 404)

[jj3l]

What happened?

With ExternalDNS v0.18.0 and OVH provider, records are not created for hostnames in a delegated IDN zone when using punycode.

Example anonymized zone:

• Zone (punycode): apps.xn--bcher-kva.example
• Unicode form: apps.bücher.example
• Affected hosts: *.apps.xn--bcher-kva.example

ExternalDNS discovers endpoints, but fails to map them to the OVH zone and tries to apply changes with an empty zone name.

Logs / symptoms

• ExternalDNS logs show:
  • OVH: "": <n> changes will be done
• OVH API request fails with:
  • 404 on /domain/zone//record
• Ingress resources are discovered, but DNS records are not created.

What did you expect to happen?

Endpoints for *.apps.xn--bcher-kva.example should match zone apps.xn--bcher-kva.example, and OVH records should be created/updated successfully.

How to reproduce it (as minimally and precisely as possible)

1. Configure ExternalDNS v0.18.0 with OVH provider.
2. Use a delegated zone in punycode form (example: apps.xn--bcher-kva.example).
3. Create an Ingress with host under that zone (example: id-staging.apps.xn--bcher-kva.example).
4. Observe logs and OVH API behavior.

ExternalDNS version

v0.18.0

DNS provider

OVH

Suspected root cause

In provider/zonefinder.go (v0.18.0), hostname labels appear to be converted to Unicode before suffix matching, while OVH zone names remain in punycode.
For IDN zones this can break suffix matching and result in an empty zone name ("").

Workaround

Downgrading to ExternalDNS app v0.15.0 (chart 1.15.0) avoids the issue in our setup.

Additional context

• This affects delegated sub-zones with IDN/punycode names.
• Non-IDN zones do not show this behavior in the same environment.

[ivankatliarchuk]

https://github.com/kubernetes-sigs/external-dns/blob/master/docs/contributing/bug-report.md#checklist-before-submitting

[ivankatliarchuk]

Most likely resolved and fix lives in staging version #5914

[jj3l]

Thanks for the hint and for linking #5914.

Our report is about delegated IDN/punycode zones (example only):

• zone: apps.xn--bcher-kva.example
• hosts: *.apps.xn--bcher-kva.example

The symptom matches the empty-zone behavior (OVH: "": changes, then 404 on /domain/zone//record).

From our side, #5980 looks like the relevant fix path. Since #5980 was merged after v0.20.0 was released, we currently keep the workaround pin and will track the first release that includes #5980 for this scenario.

If there is already a published version/tag that you consider definitive for delegated IDN/punycode OVH zones, we can align this issue accordingly.