Could be that it’s related to the OpenSSL update in Zammad 7. Which means the new OpenSSL versions are now using the current, more modern defaults which should be used these days.
Seems to be that the Idoit-Server is using an older OpenSSL version and should be updated.
Zammad tries to connect the wrong server, for whatever reason, it falls for a *.mydomain.com DNS WIldcard and not idoit.mydomain.com.
Did DNS resolve change in 7.0? if i roll back, it resolves idoit. On my Zammad Testserver in see the same issues, as soon as a update to 7.0, Zammad prefers to resolve to a wildcard and connects an unrelated reverse proxy server in the internet.
From command line, i can properly resolve idoit, modifing hosts has no effect. Is Zammad maybe using public DNS Servers? or something is really wrong with resolve in ruby.
All my systems are dualstack IPv4 and IPv6, same for Zammad and i-doit. I have a wildcard in my domain (*.mydomain.com), it is related to some netbird proxy stuff and has nothing to do with Zammad/i-doit, but leads to an interesting issue with 7.0.
idoit.mydomain.com currently only has an A record. Normal behaviour on linux is to look for AAAA, and then A. If nothing is found, then the wildcard in my domain wins.
What happens in Zammad?
Behaviour on 7.0: AAAA record idoit.mydomain.com does not exist, it uses the wildcard in my domain and talks to a wrong server where the wildcard points to.
Behaviour on 6.5.2: AAAA record idoit.mydomain.com does not exist, Zammad uses the A records and connects via IPv4 to i-doit.
My solution: provide a proper AAAA record for idoit.mydomain.com, now 6.5.x and 7.0 can connect to i-doit, and both do this via IPv6 now.
For me this looks like a bug in the resolving mechanism between 6.5.2 and 7.0, Resolver should always look for AAAA and A records, but never use a wildcard if one of the records A or AAAA exist. I can go forth and back between 6.5.2 and 7.0.0, always repeatable.
So the issue is essentialy fixed for me, by putting AAAA records in my idoit.mydomain.com, but the behaviour is imho wrong.
You were luck it worked by ‚accident‘. For me this is invalid DNS configuration not a bug personally. Possibly rails behaves slightly different - but esentially Zammad always prefers IPv6 over v4 if applicable.
Correct behaviour, dns server tells the resolver that there is no AAAA record, but it does not send the wildcard information because it knows there is an A record and that the hostname exist, but not for the requested type AAAA.
Now lets use something that does not have A or AAAA.
