It looks like this is specifically on PTR records, the original error was: "Failed to save: Conflict DNS PTR Records 123.12.123.1/<old.hostname> already exists"

I see app/models/orchestration/dns.rb queries the domain model for its SOA nameservers and gets a new DNS resolver with these configured, but doesn't do the equivalent for the subnet and reverse DNS zone.

I wonder why the Foreman is doing a DNS request at all. I thought the Proxy did this so it shouldn't be needed. This also requires that the foreman has an entire view of the system and while that's generally what you want with DNS, there are situations where firewalls can be in the way.

I did hit into this now as well, this feature should be turned off entirely, or atleast add configuration possiblity to turn this off. Imagine this situation, you have in DNS *.example.com, which is CNAME to host1.example.com A 191.168.0.1. Now you want to create host2.example.com with 191.168.0.2, but bum, Conflict IPv4 DNS record because it did resolve host1.example.com A 191.168.0.1. And this is happening even when foreman has DNS proxy set for this subnet - instead doing it via proxy (which would work), it uses local resolver and everything is broken. I even added codewrap around that creates correct A record before foreman host is created, but this fails too, as it takes some time to DNS refresh so foreman can resolve it good, which again was workarounded by some sleep() but this all is just not right.

Thanks for your comment, I'm afraid this does not qualify to Urgent Priority, so resetting it back.