feat(crd): Support MX record with trailing dot

[HartmannVolker]

What does it do ?

This PR allows trailing dots in MX Record targets, allowing to use a different FQDN for your Mail server

Motivation

Currently trailing dots are not supported in MX records that are created using the DNSEndpoint CRD. But an MX record with a trailing dot signifies a FQDN, instructing the DNS server not to append the root domain to the entry, which is important in case your Mail server is not running under the same domain.

Currently external DNS throughs a warning like this if the target has a trailing dot:

Endpoint <endpoint name> with DNSName fqdn.example.com. has an illegal target format.

More

• Yes, this PR title follows Conventional Commits
• Yes, I added unit tests
• Yes, I updated end user documentation accordingly

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: HartmannVolker / name: Volker Hartmann (a8db90b, f6cd8c1)

[k8s-ci-robot]

Welcome @HartmannVolker!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @HartmannVolker. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ivankatliarchuk]

Missing before and after evidences/how-to-reproduce , so not clear how to reproduce and validate. Example expected #5085 (comment)

Missing documentation about MX record trailing dots requirement. Could be a breaking change, so the risk modifying this no clear.

[ivankatliarchuk]

can we have test without trailing dot as well

[ivankatliarchuk]

nesting if is not a great idea

consider something like

for _, target := range ep.Targets {
	hasDot := strings.HasSuffix(target, ".")

	// TXT can contain arbitrary text, skip dot validation.
	if isTXT {
		continue
	}

	// Records that require a trailing dot (hostnames).
	requiresDot := isNAPTR || isMx

	if requiresDot && !hasDot {
		illegalTarget = true
		break
	}

	if !requiresDot && hasDot {
		illegalTarget = true
		break
	}
}

[ivankatliarchuk]

Or we could avoid growing list of boolean variables entiretly

illegalTarget := false
for _, target := range ep.Targets {
	hasDot := strings.HasSuffix(target, ".")

	switch ep.RecordType {
	case endpoint.RecordTypeTXT:
		 continue // TXT records allow arbitrary text, skip validation
	case endpoint.RecordTypeNAPTR, endpoint.RecordTypeMX:
		illegalTarget = !hasDot // Must have trailing dot
	default:
		illegalTarget = hasDot // Must NOT have trailing dot
	}

	if illegalTarget {
		break
	}
}

[ivankatliarchuk]

/ok-to-test

[coveralls]

Pull Request Test Coverage Report for Build 22139056954

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• 2 unchanged lines in 1 file lost coverage.
• Overall coverage increased (+0.004%) to 79.162%

---

Files with Coverage Reduction	New Missed Lines	%
crd.go	2	67.3%

Totals
Change from base Build 21559764040:	0.004%
Covered Lines:	16043
Relevant Lines:	20266

---

💛 - Coveralls

[ivankatliarchuk]

MX target could have trailing dot, but is not mandatory. Most likely both cases are valid

[HartmannVolker]

First of all: Thanks for the review!

MX target could have trailing dot, but is not mandatory. Most likely both cases are valid
To my knowledge both should be allowed. An MX target with a trailing dot means that the target represents the full domain of the mail server. A record without trailing dot indicates that the mail server is a subdomain of the domain of the record set.

I added a second test to make sure that MX records work with and without a trailing dot.

[HartmannVolker]

Since this change is only adding support for trailing dots, I don't think it is a breaking change, because it only enables a feature that was blocked by the validation before. But there could be cases where people created MX record with trailing dots that where never created, and could now change their behaviour if no one removed or adjusted them.

[ivankatliarchuk]

Looks good. Could you share example similar to this one #6017 (comment)

We need to make sure the feature is working end-2-end before we merge to master.

[HartmannVolker]

Current behaviour:

With the example DNSEndpoint:

apiVersion: externaldns.k8s.io/v1alpha1
kind: DNSEndpoint
metadata:
  name: zfl-mx-google
  namespace: example
spec:
  endpoints:
    - dnsName: example.com
      recordTTL: 300
      recordType: MX
      targets:
        - 1 smtp.google.com.

We see this warning in the logs of external-dns:

time="2026-02-18T16:02:32Z" level=warning msg="Endpoint example/zfl-mx-google with DNSName example.com has an illegal target format."

No DNS records are created in our DNS Provider (we are using STACKIT Webhook Provider)

Removing the trailing dot results in an invalid DNS record: MX 1 smtp.google.com.example.com

Expected Behaviour:

The DNS Record is created with the trailing dot, because that indicates that the target contains an FQDN.

[ivankatliarchuk]

We are w8 for a second review
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ivankatliarchuk

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [ivankatliarchuk]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ivankatliarchuk]

/lgtm