PowerShell / PowerShell/DSC

DNS subdomain address don't work idempotently

Open
#924 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Issue-Bug Waiting on Author
Dominant language
Rust
Stars
523
Forks
75
Avg merge
3d 16h
Merged PRs (30d)
24

Description

Prerequisites
  • Write a descriptive title.
  • Make sure you are able to repro it on the latest version
  • Search the existing issues.
Summary

I'm trying to manage our DNS with this and am really close. The issue I'm running into is that this code works... once. Then it throws an error because it isn't properly detecting that the DNS record already exists.

Steps to reproduce

create test AD-integrated DNS zone.
Add-DnsServerPrimaryZone -Name "test-dangerzone.com" -ReplicationScope "Domain" -DynamicUpdate Secure

create DSC3 yaml file in known location, we'll call ours: "c:\temp\dsc\test-cname-subDomain-not-idempotent.yaml"

$schema: https://raw.githubusercontent.com/PowerShell/DSC/main/schemas/2024/04/config/document.json
metadata:
  name: Create-Flat-DNS-Records-in-data-subdomain
resources:
- name: Use Windows PowerShell resources
  type: Microsoft.Windows/WindowsPowerShell
  properties:
    resources:
    - name: CNAME-test-01
      type: DnsServerDsc/DnsRecordCNAME
      properties:
        ZoneName: test-dangerzone.com
        Name: test-01.data
        HostNameAlias: rawvm01.data.test-dangerzone.com.
        Ensure: Present
    - name: CNAME-test-02
      type: DnsServerDsc/DnsRecordCNAME
      properties:
        ZoneName: test-dangerzone.com
        Name: test-02.data
        HostNameAlias: rawvm02.data.test-dangerzone.com.
        Ensure: Present

ran with this command on intended machine and it works!... but only the first time.
dsc config set -f C:\temp\dsc\test-cname-subDomain-not-idempotent.yaml

Expected behavior

I expect idempotent behavior. I have a similar dsc3 yaml file that DOES work properly (and idempotently) when running it many times in a row. No errors. The difference is it is not creating any DNS entries in a subdomain. (e.g. fileserver01.dangerzone.com [works], db01.data.dangerzone.com [doesn't work idempotently])

Actual behavior

dsc config set command fails to apply my desired state and returns an error that I see when it tries to create DNS entries that already exist. I believe it is failing to properly recognize the entry. I only observe this behavior when dealing with a sub-domain (like "data" in my example)

Error details
2025-06-29T01:43:49.141681Z ERROR PID 11124: Exception: Failed to create resource record test-01.data in zone test-dangerzone.com on server localhost.
2025-06-29T01:43:49.218475Z ERROR Error: Command: Resource 'powershell' [exit code 1] manifest description: Error
Environment data
$PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.7
PSEdition                      Core
GitCommitId                    7.4.7
OS                             Microsoft Windows 10.0.20348
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0
Version

dsc 3.1.0

Visuals

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue with the provided DSC YAML, dsc config set command, and DnsServerDsc/DnsRecordCNAME resources, comparing the subdomain records with the working flat records. Trace how existing records are detected during repeated runs; done means the same configuration applies successfully multiple times without attempting to recreate test-01.data or test-02.data.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
devops, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.