Neutron DNS Integration: External Provider Record Cleanup and TLS Verification Behavior

Context

OpenStack Neutron's DNS integration supports external DNS providers through plugins that communicate over HTTPS. The configuration allows optional TLS certificate verification, and the plugin is expected to propagate port lifecycle events to the provider.

Goal

Determine whether the external DNS plugin guarantees DNS record removal when a Neutron port is deleted, and whether TLS verification state influences that propagation.

Constraints and Uncertainty

Documentation indicates the dnsmasq plugin does not automatically purge records on port deletion, leaving stale entries until TTL expiry. For external provider plugins, the cleanup behavior is not explicitly documented, and TLS verification can be disabled via configuration or environment variables, potentially altering the plugin's ability to reach the provider during deletion events.

Questions

1. Does the external DNS provider plugin emit a delete operation to the provider API when a port is removed, or does it rely solely on TTL expiration?
2. If TLS verification is disabled, does the plugin fall back to insecure connections silently, and does that affect delete-event delivery?
3. Are there configuration knobs to enforce synchronous record cleanup on port deletion regardless of provider response?