fix(zonefinder): handle underscores in dns records

[arthlr]

Hello 👋

Description

This PR updates the FindZone method in zonefinder.go to gracefully handle DNS labels that contain underscores (_). Previously, the method attempted to convert the entire hostname to Unicode using idna.Lookup.ToUnicode, which fails when labels include underscores — a character that, while disallowed in IDNA, is valid in DNS records like TXT and SRV.

This caused zone discovery to fail for hostnames such as cname._metadata.example.com, that can used in TXT records for metadata verification.

The new logic processes each label in the hostname individually, skipping IDNA conversion for labels containing underscores, thus preserving compatibility with such use cases. This change prevents the function from failing and ensures zone matching continues as expected.

Fixes #5275

Checklist

• Unit tests updated

[k8s-ci-robot]

Hi @arthlr. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mloiseleur]

/ok-to-test
@lexisother Do you think you can review this PR ?

[lexisother]

Good catch! The solution looks good to me.
Did some local testing, seems to work as expected.

[k8s-ci-robot]

@lexisother: changing LGTM is restricted to collaborators

In response to this:

Good catch! The solution looks good to me.
Did some local testing, seems to work as expected.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[mloiseleur]

@arthlr You'll need to fix the linter and rebase on top of #5268 in order to fix the data race condition in test.

[ivankatliarchuk]

What about other charachters ! " # $ % & ' ( ) * + , - / : ; < = > ? @ [ \ ] ^ { | } ~`, how they supported?

[arthlr]

Great question! Here's the quick summary:

• The RFC 1035 only allows: A-Z, a-z, 0-9, and - (hyphen). Underscores are not included in this definition.
• Despite the original restriction, many later RFCs explicitly allow or require underscore-prefixed names for TXT and other record types used in various protocols (especially RFC 8552)
• All other characters from your list (e.g. ! " # $ % & ' ( ) * + , / : ; < = > ? @ [ \ ] ^ { | } ~) These are not permitted in DNS labels and will cause resolution or parsing failures.

[ivankatliarchuk]

/lgtm

[mloiseleur]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ivankatliarchuk, lexisother, mloiseleur

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [mloiseleur]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment