Before applying replace the secret with the actual one.
For debugging add - --log-level=debug:
kubectl apply -n external-dns -f external-dns.yml
Insert TSIG secret:
kubectl -n external-dns create secret generic tsig-secret \
--from-literal=TSIG_SECRET=<secret>