TXT records with _acme-challenge from cert-manager are skipped due to strict IDNA validation in v0.18.0

[a-pallari]

What happened:
After upgrading the Bitnami Helm chart from 8.8.6 to 8.9.1, we started seeing the following warning in the logs:
{"level":"warning","msg":"Got error while parsing domain _acme-challenge.<some_xyz_domain>: idna: disallowed rune U+005F","time":"2025-07-14T08:25:49Z"}.
External-dns then skips that record set. As a result, the companion A record is never deleted, so stale DNS entries remain.
This behavior did not occur in earlier versions.

What you expected to happen:
ExternalDNS continues to manage _acme-challenge TXT records created by cert-manager.

How to reproduce it (as minimally and precisely as possible):

1. ExternalDNS is configured to sync with Azure DNS. An example of flags:

--registry=txt
--txt-owner-id=default
--provider=azure
--azure-resource-group=<resource-group-name>
--domain-filter=<some_xyz_domain>

2. Deploy cert-manager configured to issue certificates using the ACME DNS-01 challenge (e.g., Let’s Encrypt).
3. Deploy an Ingress resource with the following annotation:

    cert-manager.io/cluster-issuer: <your_cluster-issuer>

4. Wait until an IP is assigned and cert-manager creates the DNS-01 challenge record (_acme-challenge.<some_xyz_domain>).
5. Delete the Ingress resource to trigger cleanup.
6. Observe the external dns logs - the mentioned above warning should appear. The record is not being cleaned up

Anything else we need to know?:
We're using Azure DNS, cert-manager, let’s encrypt. Maybe it's caused by stricter domain validation introduced in a newer version of Go or the ExternalDNS codebase

Environment:

• External-DNS version (use external-dns --version): v0.18.0
• DNS provider: azure

[ivankatliarchuk]

Could you share ingress manifest with all annotations and etc. Is there is a tutorial I could use to configure cert-manager with kind or minikube, so I could validate the behavior locally? Could you share some CRDs maybe.

To clarify, version 0.18.0 could create but could not delete the DNS record? I'm a bit confused, as cert-manager creates DNS record. And external-dns creates records from Kind:Ingress?