RFC2136: AXFR error: dns: no signature found on multi-message AXFR despite successful transfer on server side

What happened:

The RFC2136 provider logs AXFR error: dns: no signature found on every sync cycle, for a zone that is TSIG-secured and configured correctly. The DNS server (Knot DNS) logs show the AXFR completing successfully every time, with the TSIG key applied — there is no error, rejection, or missing signature on the server side.

The zone in question is large enough that AXFR responses span multiple TCP DNS messages (5 messages per transfer, ~80KB). The error appears to only occur when the AXFR response is split into multiple messages.

Despite the client-side error, subsequent reconciliation shows no incorrect adds/deletes — the sync appears to otherwise behave correctly (0 unexpected changes over multiple sync cycles), suggesting this is an isolated TSIG-verification issue on a subset of messages in the multi-message transfer, not a full transfer failure.

External-dns log (repeats every sync interval):

{"level":"error","msg":"AXFR error: dns: no signature found","time":"2026-09-15T15:13:08Z"}

Knot DNS server log for the same transfer window (shows success):

knotd: info: [<zone>.] AXFR, outgoing, remote <external-dns-pod-ip>@59300 TCP, key tsig_key., started, serial <serial>
knotd: info: [<zone>.] AXFR, outgoing, remote <external-dns-pod-ip>@59300 TCP, key tsig_key., finished, 0.00 seconds, 5 messages, 81963 bytes

What you expected to happen:

The AXFR should verify cleanly with no error, since Knot completes and signs the transfer without issue on its end.

How to reproduce it (as minimally and precisely as possible):

1. Configure Knot DNS as authoritative for a zone large enough that AXFR responses span multiple TCP DNS messages.
2. Configure an ACL requiring a TSIG key (hmac-sha256) for transfer, attached to the zone:

   key:
     - id: tsig_key
       algorithm: hmac-sha256
       secret: <redacted>

   acl:
     - id: slave_zone_transfer
       address: [<redacted>]
       key: tsig_key
       action: [transfer]

   zone:
     - domain: <zone>
       notify: slave
       acl: [slave_zone_transfer]

1. Configure external-dns's RFC2136 provider against this zone:

--provider=rfc2136
--rfc2136-host=<redacted>
--rfc2136-port=53
--rfc2136-zone=<zone>
--rfc2136-tsig-axfr
--rfc2136-tsig-secret-alg=hmac-sha256
--rfc2136-tsig-keyname=tsig_key
--registry=txt
--txt-owner-id=<redacted>
--policy=sync
--interval=1m
--source=service
--source=ingress
--source=ambassador-host
--source=gateway-httproute
--source=gateway-tlsroute
--gateway-listener-sets
--domain-filter=<zone>

1. Observe AXFR error: dns: no signature found in external-dns logs every sync interval, while Knot's logs show the transfer completing successfully with the correct TSIG key applied.

Anything else we need to know?:

Our working theory: per RFC 2845/8945, only the first and last messages in a multi-message TSIG-signed transfer require a full signature; intermediate messages carry a running MAC context rather than a standalone signature. We suspect the TSIG verification path (via miekg/dns) may be flagging an intermediate message as missing a signature, when this is expected per spec for non-final messages.

Environment:

• External-DNS version (use external-dns --version): v0.22.0 (registry.k8s.io/external-dns/external-dns:v0.22.0)
• DNS provider: rfc2136
• Others: DNS server is Knot DNS (version: <fill in — knotd -V>): 3.4.0

Checklist

• I have searched existing issues and tried to find a fix myself
• I am using the latest release, or have checked the staging image to confirm the bug is still reproducible
• I have provided the actual process flags (not Helm values)
• I have provided kubectl get <resource> -o yaml output including status
• I have provided full external-dns debug logs (see issue-evidence.md)
• I have described what DNS records exist and what I expected

issue-evidence.md rfc2136-pod.yaml