diff --git a/integrationTest/integration_test.go b/integrationTest/integration_test.go
index 327061f5d0..5bb42e15c7 100644
--- a/integrationTest/integration_test.go
+++ b/integrationTest/integration_test.go
@@ -2087,158 +2087,225 @@ func makeTests() []*TestGroup {
 
 		testgroup("IGNORE main",
 			tc("Create some records",
-				txt("foo", "simple"),
 				a("foo", "1.2.3.4"),
+				a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
 				a("bar", "5.5.5.5"),
-			),
-			tc("ignore label=foo",
+				cname("mail", "ghs.googlehosted.com."),
+			),
+			tc("ignore label",
+				// NB(tlim): This ignores 1 record of a recordSet. This should
+				// fail for diff2.ByRecordSet() providers if diff2 is not
+				// implemented correctly.
+				//a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
+				//txt("foo", "simple"),
 				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
 				ignore("foo", "", ""),
 			).ExpectNoChanges(),
-			tc("ignore type=txt",
+			tc("ignore label,type",
+				//a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("foo", "A", ""),
+			).ExpectNoChanges(),
+			tc("ignore label,type,target",
+				//a("foo", "1.2.3.4"),
+				a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("foo", "A", "1.2.3.4"),
+			).ExpectNoChanges(),
+			tc("ignore type",
+				//a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
+				//a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "A", ""),
+			).ExpectNoChanges(),
+			tc("ignore type,target",
 				a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
 				a("bar", "5.5.5.5"),
-				ignore("", "TXT", ""),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "A", "2.3.4.5"),
 			).ExpectNoChanges(),
-			tc("ignore target=1.2.3.4",
+			tc("ignore target",
+				a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
 				txt("foo", "simple"),
 				a("bar", "5.5.5.5"),
-				ignore("", "", "1.2.3.4"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "", "2.3.4.5"),
 			).ExpectNoChanges(),
+			//
+			// Many types:
 			tc("ignore manytypes",
+				//a("foo", "1.2.3.4"),
+				//a("foo", "2.3.4.5"),
+				//txt("foo", "simple"),
+				//a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
 				ignore("", "A,TXT", ""),
 			).ExpectNoChanges(),
+			//
+			// Target with wildcard:
+			tc("ignore label,type,target=*",
+				a("foo", "1.2.3.4"),
+				a("foo", "2.3.4.5"),
+				txt("foo", "simple"),
+				a("bar", "5.5.5.5"),
+				//cname("mail", "ghs.googlehosted.com."),
+				ignore("", "CNAME", "*.googlehosted.com."),
+			).ExpectNoChanges(),
 		),
 
+		// Same as "main" but with an apex ("@") record.
 		testgroup("IGNORE apex",
 			tc("Create some records",
-				txt("@", "simple"),
 				a("@", "1.2.3.4"),
-			).UnsafeIgnore(),
-			tc("ignore label=apex",
+				a("@", "2.3.4.5"),
+				txt("@", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+			),
+			tc("ignore label",
+				// NB(tlim): This ignores 1 record of a recordSet. This should
+				// fail for diff2.ByRecordSet() providers if diff2 is not
+				// implemented correctly.
+				//a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
+				//txt("@", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
 				ignore("@", "", ""),
+				//ignore("", "NS", ""),
+				// NB(tlim): .UnsafeIgnore is needed because the NS records
+				// that providers injects into zones are treated like input
+				// from dnsconfig.js.
 			).ExpectNoChanges().UnsafeIgnore(),
-			tc("ignore type=txt",
-				a("@", "1.2.3.4"),
-				ignore("", "TXT", ""),
-			).ExpectNoChanges().UnsafeIgnore(),
-			tc("ignore target=1.2.3.4",
+			tc("ignore label,type",
+				//a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
 				txt("@", "simple"),
-				ignore("", "", "1.2.3.4"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("@", "A", ""),
+			).ExpectNoChanges(),
+			tc("ignore label,type,target",
+				//a("@", "1.2.3.4"),
+				a("@", "2.3.4.5"),
+				txt("@", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("@", "A", "1.2.3.4"),
+				// NB(tlim): .UnsafeIgnore is needed because the NS records
+				// that providers injects into zones are treated like input
+				// from dnsconfig.js.
 			).ExpectNoChanges().UnsafeIgnore(),
+			tc("ignore type",
+				//a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
+				txt("@", "simple"),
+				//a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "A", ""),
+			).ExpectNoChanges(),
+			tc("ignore type,target",
+				a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
+				txt("@", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "A", "2.3.4.5"),
+			).ExpectNoChanges(),
+			tc("ignore target",
+				a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
+				txt("@", "simple"),
+				a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
+				ignore("", "", "2.3.4.5"),
+			).ExpectNoChanges(),
+			// Many types:
 			tc("ignore manytypes",
+				//a("@", "1.2.3.4"),
+				//a("@", "2.3.4.5"),
+				//txt("@", "simple"),
+				//a("bar", "5.5.5.5"),
+				cname("mail", "ghs.googlehosted.com."),
 				ignore("", "A,TXT", ""),
-			).ExpectNoChanges().UnsafeIgnore(),
+			).ExpectNoChanges(),
 		),
 
-		// Legacy IGNORE_NAME and IGNORE_TARGET tests.
+		// IGNORE with unsafe notation
 
-		testgroup("IGNORE_NAME function",
+		testgroup("IGNORE cross",
 			tc("Create some records",
 				txt("foo", "simple"),
 				a("foo", "1.2.3.4"),
-				a("bar", "1.2.3.4"),
+				txt("@", "asimple"),
+				a("@", "2.2.2.2"),
 			),
-			tc("ignore foo",
-				ignoreName("foo"),
-				a("bar", "1.2.3.4"),
-			).ExpectNoChanges(),
-			clear(),
-			tc("Create some records",
-				txt("bar.foo", "simple"),
-				a("bar.foo", "1.2.3.4"),
-				a("bar", "1.2.3.4"),
-			),
-			tc("ignore *.foo",
-				ignoreName("*.foo"),
-				a("bar", "1.2.3.4"),
-			).ExpectNoChanges(),
-			clear(),
-			tc("Create some records",
-				txt("bar.foo", "simple"),
-				a("bar.foo", "1.2.3.4"),
-			),
-			tc("ignore *.foo while we add 1",
-				ignoreName("*.foo"),
-				a("bar", "1.2.3.4"),
-			),
-		),
-
-		testgroup("IGNORE_NAME apex",
-			tc("Create some records",
-				txt("@", "simple"),
-				a("@", "1.2.3.4"),
-				txt("bar", "stringbar"),
-				a("bar", "2.4.6.8"),
-			).UnsafeIgnore(),
-			tc("ignore apex",
-				ignoreName("@"),
-				txt("bar", "stringbar"),
-				a("bar", "2.4.6.8"),
+			tc("ignore label=apex",
+				txt("foo", "simple"),
+				a("foo", "1.2.3.4"),
+				txt("@", "asimple"),
+				a("@", "2.2.2.2"),
+				ignore("foo", "TXT", ""),
+			).ExpectNoChanges().UnsafeIgnore(),
+			tc("ignore label=apex",
+				txt("foo", "simple"),
+				a("foo", "1.2.3.4"),
+				txt("@", "asimple"),
+				a("@", "2.2.2.2"),
+				ignore("@", "TXT", ""),
 			).ExpectNoChanges().UnsafeIgnore(),
-			clear(),
-			tc("Add a new record - ignoring apex",
-				ignoreName("@"),
-				txt("bar", "stringbar"),
-				a("bar", "2.4.6.8"),
-				a("added", "4.6.8.9"),
-			).UnsafeIgnore(),
 		),
 
-		testgroup("IGNORE_TARGET function CNAME",
-			tc("Create some records",
-				cname("foo", "test.foo.com."),
-				cname("keep", "keeper.example.com."),
-			),
-			tc("ignoring CNAME=test.foo.com.",
-				ignoreTarget("test.foo.com.", "CNAME"),
-				cname("keep", "keeper.example.com."),
-			).ExpectNoChanges(),
-			tc("ignoring CNAME=test.foo.com. and add",
-				ignoreTarget("test.foo.com.", "CNAME"),
-				cname("keep", "keeper.example.com."),
-				a("adding", "1.2.3.4"),
-				cname("another", "www.example.com."),
-			),
-		),
+		// IGNORE with wildcards
 
-		testgroup("IGNORE_TARGET function CNAME*",
+		testgroup("IGNORE wilds",
 			tc("Create some records",
-				cname("foo1", "test.foo.com."),
-				cname("foo2", "my.test.foo.com."),
-				cname("bar", "test.example.com."),
-			).UnsafeIgnore(),
-			tc("ignoring CNAME=test.foo.com.",
-				ignoreTarget("*.foo.com.", "CNAME"),
-				cname("foo2", "my.test.foo.com."),
-				cname("bar", "test.example.com."),
-			).ExpectNoChanges().UnsafeIgnore(),
-			tc("ignoring CNAME=test.foo.com. and add",
-				ignoreTarget("*.foo.com.", "CNAME"),
-				cname("foo2", "my.test.foo.com."),
-				cname("bar", "test.example.com."),
-				a("adding", "1.2.3.4"),
-				cname("another", "www.example.com."),
-			).UnsafeIgnore(),
+				a("foo.bat", "1.2.3.4"),
+				a("foo.bat", "2.3.4.5"),
+				txt("foo.bat", "simple"),
+				a("bar.bat", "5.5.5.5"),
+				cname("mail.bat", "ghs.googlehosted.com."),
+			),
+			tc("ignore label=foo.*",
+				//a("foo.bat", "1.2.3.4"),
+				//a("foo.bat", "2.3.4.5"),
+				//txt("foo.bat", "simple"),
+				a("bar.bat", "5.5.5.5"),
+				cname("mail.bat", "ghs.googlehosted.com."),
+				ignore("foo.*", "", ""),
+			).ExpectNoChanges(),
+			tc("ignore label=foo.bat,type",
+				//a("foo.bat", "1.2.3.4"),
+				//a("foo.bat", "2.3.4.5"),
+				txt("foo.bat", "simple"),
+				//a("bar.bat", "5.5.5.5"),
+				cname("mail.bat", "ghs.googlehosted.com."),
+				ignore("*.bat", "A", ""),
+			).ExpectNoChanges(),
+			tc("ignore target=*.domain",
+				a("foo.bat", "1.2.3.4"),
+				a("foo.bat", "2.3.4.5"),
+				txt("foo.bat", "simple"),
+				a("bar.bat", "5.5.5.5"),
+				//cname("mail.bat", "ghs.googlehosted.com."),
+				ignore("", "", "*.googlehosted.com."),
+			).ExpectNoChanges(),
 		),
 
-		testgroup("IGNORE_TARGET function CNAME**",
-			tc("Create some records",
-				cname("foo1", "test.foo.com."),
-				cname("foo2", "my.test.foo.com."),
-				cname("bar", "test.example.com."),
-			).UnsafeIgnore(),
-			tc("ignoring CNAME=test.foo.com.",
-				ignoreTarget("**.foo.com.", "CNAME"),
-				cname("bar", "test.example.com."),
-			).ExpectNoChanges().UnsafeIgnore(),
-			tc("ignoring CNAME=test.foo.com. and add",
-				ignoreTarget("**.foo.com.", "CNAME"),
-				cname("bar", "test.example.com."),
-				a("adding", "1.2.3.4"),
-				cname("another", "www.example.com."),
-			).UnsafeIgnore(),
-		),
+		// IGNORE repro bug reports
 
 		// https://github.com/StackExchange/dnscontrol/issues/2285
 		testgroup("IGNORE_TARGET b2285",
@@ -2273,6 +2340,26 @@ func makeTests() []*TestGroup {
 			).ExpectNoChanges().UnsafeIgnore(),
 		),
 
+		// https://github.com/StackExchange/dnscontrol/issues/3227
+		testgroup("IGNORE w/change b3227",
+			tc("Create some records",
+				a("testignore", "8.8.8.8"),
+				a("testdefined", "9.9.9.9"),
+			),
+			tc("ignore",
+				//a("testignore", "8.8.8.8"),
+				a("testdefined", "9.9.9.9"),
+				ignore("testignore", "", ""),
+			).ExpectNoChanges(),
+			tc("ignore with change",
+				//a("testignore", "8.8.8.8"),
+				a("testdefined", "2.2.2.2"),
+				ignore("testignore", "", ""),
+			),
+		),
+
+		// OVH features
+
 		testgroup("structured TXT",
 			only("OVH"),
 			tc("Create TXT",