Unable to convert parameter from table when using failOnIncompleteCheck

[DeBuXer]

Hi all,

Since PowerDNS Auth 5.0.0-alpha1 it has been possible[1] to use failOnIncompleteCheck with the ifurlup Lua function. I am now trying to configure this in a pdns-auth 5.0.3 environment, but whenever this is set the Lua record can no longer be read by the pdns server and the following message appears in the log:

2026-03-10T16:09:27.401422+01:00 debug pdns_server[2397216]: Remote XXXXX wants 'sub.yottabit.nl|A', do = 0, bufsize = 1232: packetcache MISS
2026-03-10T16:09:27.401849+01:00 debug pdns_server[2397216]: Lua record (sub.yottabit.nl|A) reported: Unable to convert parameter from table to N5boost8optionalISt13unordered_mapINSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES7_St4hashIS7_ESt8equal_toIS7_ESaISt4pairIKS7_S7_EEEEE
2026-03-10T16:09:27.401861+01:00 debug pdns_server[2397216]: stack traceback:
2026-03-10T16:09:27.401871+01:00 debug pdns_server[2397216]: #011[C]: at 0x55bd85a156f0

The Lua record looks as follows:

sub.yottabit.nl 30 IN LUA A "ifurlup('http://health.yottabit.nl/', { { '87.xxx.xxx.xxx','213.xxx.xxx.xxx','213.xxx.xxx.xxx','213.xxx.xxx.xxx','87.xxx.xxx.xxx','213.xxx.xxx.xxx' } }, { selector='random', timeout=2, interval=5, minimumFailures=2, failOnIncompleteCheck=true })"

I have also tried putting true in quotes and adding the backupSelector option to the record, but so far I have not found the correct way to do it.

Does anyone know what the record should look like? Or am I running into a bug here? Without failOnIncompleteCheck the Lua record works as expected.

Environment:

• Ubuntu 24.04
• PowerDNS Authoritative Server 5.0.3 (5.0.3-1pdns.ubuntu24.04)

Thanks!

[1] https://doc.powerdns.com/authoritative/changelog/5.0.html#change-5.0.0-alpha1

[miodvallat]

It works for me using failOnIncompleteCheck='true'...

[DeBuXer]

Thanks for your reply!

Do you actually get a SERVFAIL when all addresses have a failed health check? I didn’t explain this clearly in my previous message, but with failOnIncompleteCheck='true' I also don’t get an Unable to convert parameter from table error. However, I also don’t get a SERVFAIL when all addresses have a failed health check.

Without backupSelector, I keep receiving the records as configured in the selector. And with backupSelector, I get the result configured there when all health checks fail. This makes it seem like failOnIncompleteCheck='true' does not override the backupSelector, even though the documentation states that it should.

[miodvallat]

When all health checks have failed, backupSelector applies, and returns one address accordingly.
In order to get a SERVFAIL in this case, backupSelector needs to be set to 'empty', but this value is not allowed until the upcoming 5.1 version.

[DeBuXer]

So if I understand correctly, even though the documentation states that failOnIncompleteCheck will cause a SERVFAIL and backupSelector will be ignored, backupSelector still needs to be set to empty. Only the value empty is not allowed yet.

Would it perhaps be useful to mention this in the documentation? Because the value empty for backupSelector is also already listed as an option in the documentation[1].

backupSelector: used to pick the address from all addresses if all addresses are down. Choices include ‘pickclosest’, ‘random’, ‘hashed’, ‘all’, ‘empty’ (default ‘random’).
...
failOnIncompleteCheck: if set to true, return SERVFAIL instead of applying backupSelector, if none of the addresses have completed their background health check yet.

Thanks for your help!

[1] https://doc.powerdns.com/authoritative/lua-records/functions.html#ifurlup

[miodvallat]

The documentation correctly states that failOnIncompleteCheck will cause SERVFAIL if none of the addresses have completed their health check yet. Once the health checks have completed, their results and the value of backupSelector are used to decide what to return.

I will add a mention that empty is only available from 5.1 onwards.

[DeBuXer]

Ah, then I simply misunderstood the function of failOnIncompleteCheck. My apologies!

Then it’s just a matter of waiting for version 5.1 :)

Thanks again for your help!