Missing txt records in R53

[charles-br1]

What happened:
No txt record in route 53

What you expected to happen:
A txt record to appear in route 53

How to reproduce it (as minimally and precisely as possible):
Delete A record and watch it deploy again

Anything else we need to know?:

The A record shows correctly but no txt record is made in the account

    containers:
        - args:
            - '--log-level=info'
            - '--log-format=text'
            - '--interval=1m'
            - '--source=service'
            - '--source=ingress'
            - '--policy=sync'
            - '--registry=txt'
            - '--txt-owner-id=model-gateway-cluster'
            - '--domain-filter=<redacted>'
            - '--managed-record-types=A'
            - '--provider=aws'

These are the only logs around the time

time="2025-09-19T07:54:32Z" level=info msg="Desired change: CREATE <redacted> A" profile=default zoneID=/hostedzone/<redacted> zoneName=<redacted>.
time="2025-09-19T07:54:32Z" level=info msg="1 record(s) were successfully updated" profile=default zoneID=/hostedzone/<redacted> zoneName=<redacted>

Environment:

• External-DNS version (use external-dns --version):
  version is helm chart 1.19.0
• DNS provider: AWS
• Others:

[u-kai]

Are the TXT records you mentioned the ownership TXT records that external-dns creates alongside A records?
Also, just to confirm, your steps were: external-dns first created the A record, then you deleted that A record manually, and then let external-dns recreate it again?

In that case, the TXT record is usually created only on the initial creation. If the TXT record is still present and valid, external-dns won’t recreate it. Could you check in the AWS console whether the TXT record is still there or not?

[charles-br1]

Yes it's the ownership TXT records. I get the A record so was trying to "force" the flow again by deleting it which just adds the A record back but not txt.

Is there a better way to force it to reconcile?

[u-kai]

@charles-br1
Thanks!
Since v0.19.0, external-dns skips creating ownership TXT records if they already exist. That’s why you don’t see them in the logs. However, they should still be present in the AWS console. If they are not, that would indeed be an issue, and we’d need more details.

Could you clarify whether the A record you deleted was originally created by external-dns or by some other means? It would also help if you could share the Service manifest (or other resource) that external-dns is reconciling.

[charles-br1]

Ingress

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: model-gateway-ingress
  namespace: model-gateway
  annotations:
    alb.ingress.kubernetes.io/load-balancer-name: model-gateway-alb
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/certificate-arn: <redacted>
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-Ext2-2021-06
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/healthcheck-path: /healthz
spec:
  ingressClassName: alb
  rules:
    - host: <redacted>
      http:
        paths:
          - path: /healthz
            pathType: Exact
            backend:
              service:
                name: model-gateway
                port:
                  number: 8080

Installed via helm external-dns but here is the values. Added the txtPrefix after creating this issue to see if it would help but nothing.

provider: aws
aws:
  region: us-east-2
domainFilters:
  - <redacted>
policy: sync
managedRecordTypes:
  - A
registry: txt
txtPrefix: staging
txtOwnerId: model-gateway-cluster
serviceAccount:
  create: true
  name: external-dns-sa
  annotations:
    eks.amazonaws.com/role-arn: <redacted>

The hosted zone is new so only had SOA/NS records + CNAME for the ACM cert validation. There was never a txt record to delete.

Role policy as well

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:ChangeResourceRecordSets"
      ],
      "Resource": [
        "arn:aws:route53:::hostedzone/*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListResourceRecordSets",
        "route53:ListTagsForResources"
      ],
      "Resource": [
        "*"
      ]
    }
  ]
}

[charles-br1]

Oh and the A record was originally by external-dns.

I checked the HZ again as of this comment and still only A/NS/SOA/CNAME

[charles-br1]

I turned on debugging logs and saw this

time="2025-09-19T20:12:18Z" level=debug msg="Skipping record stagingcname-api.example.me because no hosted zone matching record DNS Name was detected"

The hostedzone is api.example.me. Am I doing something fundamentally wrong? The ingress host host name is also api.example.me

spec:
  ingressClassName: alb
  rules:
    - host: api.example.me

[u-kai]

@charles-br1
Thanks for the details!
Is your hosted zone actually api.example.me or example.me?
If it’s api.example.me, then api.example.me is the APEX record of the zone. In that case, you need to configure the TXT record prefix so that ownership records don’t conflict with the APEX.

For example, you can use something like:

--txt-prefix=%{record_type}-record.

This way, %{record_type} will be dynamically replaced with the record type, and the trailing . ensures that the ownership TXT record is created properly even for APEX records.(e.g. cname-record.api.example.me)

[charles-br1]

Thanks this worked so was a problem on my end! My previous company we had the APEX at the root so why it worked out-of-the-box.

Will close it!