Currently provision is setting up the dns-${HOSTNAME} user that is only useful for the BIND_DLZ plugin regardless of the DNS plugin selected. This user breaks TKEY negotiation for the internal DNS server.
let's fix this before 4.0
Isn't it fixed in the latest version (post rc1 ?)
I'm going to say this is fixed.