7.5.0

fix(dnsserver): Fix SOA record timeout issue by correcting RRSIG field formatting

- Fixed RRSIG generation by using correct field name 'signersName' (not 'signerName')
- Fixed label count calculation in RRSIG by filtering empty strings
- Added SOA records to DNSSEC signing map for proper RRSIG generation
- Added error logging and fallback values for RRSIG generation robustness
- Updated test expectations to match corrected DNSSEC RRset signing behavior
- Added comprehensive SOA test coverage including timeout, debug, and simple test scenarios

.gitignore

@@ -1,4 +1,20 @@
-node_modules/
+.nogit/
-pages/
+
-public/
+# artifacts
 coverage/
+public/
+pages/
+
+# installs
+node_modules/
+
+# caches
+.yarn/
+.cache/
+.rpt2_cache
+
+# builds
+dist/
+dist_*/
+
+# custom

.gitlab-ci.yml

@@ -1,59 +0,0 @@
-image: hosttoday/ht-docker-node:npmts
-
-stages:
-- test
-- release
-- trigger
-- pages
-
-testLEGACY:
-  stage: test
-  script:
-    - npmci test legacy
-  tags:
-    - docker
-  allow_failure: true
-
-testLTS:
-  stage: test
-  script:
-    - npmci test lts
-  tags:
-    - docker
-    
-testSTABLE:
-  stage: test
-  script:
-    - npmci test stable
-  tags:
-    - docker
-
-release:
-  stage: release
-  script:
-    - npmci publish
-  only:
-    - tags
-  tags:
-    - docker
-
-trigger:
-  stage: trigger
-  script:
-    - npmci trigger
-  only:
-    - tags
-  tags:
-    - docker
-
-pages:
-  image: hosttoday/ht-docker-node:npmpage
-  stage: pages
-  script:
-    - npmci command npmpage --host gitlab
-  only:
-    - tags
-  artifacts:
-    expire_in: 1 week
-    paths:
-    - public

.vscode/launch.json

@@ -0,0 +1,11 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "command": "npm test",
+      "name": "Run npm test",
+      "request": "launch",
+      "type": "node-terminal"
+    }
+  ]
+}

.vscode/settings.json

@@ -0,0 +1,26 @@
+{
+  "json.schemas": [
+    {
+      "fileMatch": ["/npmextra.json"],
+      "schema": {
+        "type": "object",
+        "properties": {
+          "npmci": {
+            "type": "object",
+            "description": "settings for npmci"
+          },
+          "gitzone": {
+            "type": "object",
+            "description": "settings for gitzone",
+            "properties": {
+              "projectType": {
+                "type": "string",
+                "enum": ["website", "element", "service", "npm", "wcc"]
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}

README.md

@@ -1,32 +0,0 @@
-# dnsly
-smart dns methods written in TypeScript
-
-## Availabililty
-[![npm](https://push.rocks/assets/repo-button-npm.svg)](https://www.npmjs.com/package/dnsly)
-[![git](https://push.rocks/assets/repo-button-git.svg)](https://gitlab.com/pushrocks/dnsly)
-[![git](https://push.rocks/assets/repo-button-mirror.svg)](https://github.com/pushrocks/dnsly)
-[![docs](https://push.rocks/assets/repo-button-docs.svg)](https://pushrocks.gitlab.io/dnsly/)
-
-## Status for master
-[![build status](https://gitlab.com/pushrocks/dnsly/badges/master/build.svg)](https://gitlab.com/pushrocks/dnsly/commits/master)
-[![coverage report](https://gitlab.com/pushrocks/dnsly/badges/master/coverage.svg)](https://gitlab.com/pushrocks/dnsly/commits/master)
-[![Dependency Status](https://david-dm.org/pushrocks/dnsly.svg)](https://david-dm.org/pushrocks/dnsly)
-[![bitHound Dependencies](https://www.bithound.io/github/pushrocks/dnsly/badges/dependencies.svg)](https://www.bithound.io/github/pushrocks/dnsly/master/dependencies/npm)
-[![bitHound Code](https://www.bithound.io/github/pushrocks/dnsly/badges/code.svg)](https://www.bithound.io/github/pushrocks/dnsly)
-[![TypeScript](https://img.shields.io/badge/TypeScript-2.x-blue.svg)](https://nodejs.org/dist/latest-v6.x/docs/api/)
-[![node](https://img.shields.io/badge/node->=%206.x.x-blue.svg)](https://nodejs.org/dist/latest-v6.x/docs/api/)
-[![JavaScript Style Guide](https://img.shields.io/badge/code%20style-standard-brightgreen.svg)](http://standardjs.com/)
-
-## Usage
-we recommend the use of TypeScript for optimal intellisense
-```javascript
-import * as dnsly from 'dnsly'
-
-let myDnsly = new dnsly.Dnsly('google') // uses Google DNS Servers e.g 8.8.8.8
-myDnsly.getRecord('example.com','AAAA') // returns promise
-    .then((record: dnsly.I_AAAA) => { // AAAA record for google.com, the I_AAAA will give you proper typings for the record return type
-        // do something 
-    })
-```
-
-[![npm](https://push.rocks/assets/repo-header.svg)](https://push.rocks)

changelog.md

@@ -0,0 +1,241 @@
+# Changelog
+
+## 2025-06-01 - 7.5.0 - feat(dnssec)
+Add MX record DNSSEC support for proper serialization and authentication of mail exchange records
+
+- Serialize MX records by combining a 16-bit preference with the exchange domain name
+- Enable DNSSEC signature generation for MX records to authenticate mail exchange data
+- Update documentation to include the new MX record DNSSEC support in version v7.4.8
+
+## 2025-05-30 - 7.4.7 - fix(dnsserver)
+Update documentation to clarify the primaryNameserver option and SOA record behavior in the DNS server. The changes detail how the primaryNameserver configuration customizes the SOA mname, ensures proper DNSSEC signing for RRsets, and updates the configuration interface examples.
+
+- Documented the primaryNameserver option in IDnsServerOptions with default behavior (ns1.{dnssecZone})
+- Clarified SOA record generation including mname, rname, serial, and TTL fields
+- Updated readme examples to demonstrate binding interfaces and proper DNS server configuration
+
+## 2025-05-30 - 7.4.6 - docs(readme)
+Document the primaryNameserver option and SOA record behavior in the DNS server documentation.
+
+- Added comprehensive documentation for the primaryNameserver option in IDnsServerOptions
+- Explained SOA record automatic generation and the role of the primary nameserver
+- Clarified that only one nameserver is designated as primary in SOA records
+- Updated the configuration options interface documentation with all available options
+
+## 2025-05-30 - 7.4.3 - fix(dnsserver)
+Fix DNSSEC RRset signing, SOA record timeout issues, and add configurable primary nameserver support.
+
+- Fixed DNSSEC to sign entire RRsets together instead of individual records (one RRSIG per record type)
+- Fixed SOA record serialization by implementing proper wire format encoding in serializeRData method
+- Fixed RRSIG generation by using correct field names (signersName) and types (string typeCovered)
+- Added configurable primary nameserver via primaryNameserver option in IDnsServerOptions
+- Enhanced test coverage with comprehensive SOA and DNSSEC test scenarios
+
+## 2025-05-30 - 7.4.2 - fix(dnsserver)
+Enable multiple DNS record support by removing the premature break in processDnsRequest. Now the DNS server aggregates answers from all matching handlers for NS, A, and TXT records, and improves NS record serialization for DNSSEC.
+
+- Removed the break statement in processDnsRequest to allow all matching handlers to contribute responses.
+- Updated NS record serialization to properly handle domain names in DNSSEC context.
+- Enhanced tests for round-robin A records and multiple TXT records scenarios.
+
+## 2025-05-28 - 7.4.1 - fix(test/server)
+Fix force cleanup in DNS server tests by casting server properties before closing sockets
+
+- Cast server to any to safely invoke close() on httpsServer and udpServer in test cleanup
+- Ensures proper emergency cleanup of server sockets without direct access to private properties
+
+## 2025-05-28 - 7.4.0 - feat(manual socket handling)
+Add comprehensive manual socket handling documentation for advanced DNS server use cases
+
+- Introduced detailed examples for configuring manual UDP and HTTPS socket handling
+- Provided sample code for load balancing, clustering, custom transport protocols, and multi-interface binding
+- Updated performance and best practices sections to reflect manual socket handling benefits
+
+## 2025-05-28 - 7.3.0 - feat(dnsserver)
+Add manual socket mode support to enable external socket control for the DNS server.
+
+- Introduced new manualUdpMode and manualHttpsMode options in the server options interface.
+- Added initializeServers, initializeUdpServer, and initializeHttpsServer methods for manual socket initialization.
+- Updated start() and stop() methods to handle both automatic and manual socket binding modes.
+- Enhanced UDP and HTTPS socket error handling and IP address validations.
+- Removed obsolete internal documentation file (readme.plan2.md).
+
+## 2025-05-28 - 7.2.0 - feat(dns-server)
+Improve DNS server interface binding by adding explicit IP validation, configurable UDP/HTTPS binding, and enhanced logging.
+
+- Added udpBindInterface and httpsBindInterface options to IDnsServerOptions
+- Implemented IP address validation for both IPv4 and IPv6 in the start() method
+- Configured UDP and HTTPS servers to bind to specified interfaces with detailed logging
+- Updated documentation to include interface binding examples (localhost and specific interfaces)
+- Enhanced tests to cover valid and invalid interface binding scenarios
+
+## 2025-05-27 - 7.1.0 - feat(docs)
+Improve documentation for advanced DNS features and update usage examples for both DNS client and server.
+
+- Revamped readme.hints with expanded architecture overview and detailed explanations of DNSSEC, Let's Encrypt integration, and advanced handler patterns.
+- Updated readme.md with clearer instructions and code examples for A, AAAA, TXT, MX record queries, DNS propagation checks, and usage of UDP and DNS-over-HTTPS.
+- Enhanced TAP tests documentation demonstrating both client and server flows.
+- Bumped version from 7.0.2 to 7.1.0 in preparation for the next release.
+
+## 2025-05-27 - 7.1.0 - feat(docs)
+Improve documentation for advanced DNS features by updating usage examples for DNS client and server, and enhancing instructions for DNSSEC and Let's Encrypt integration.
+
+- Revamped readme.hints with an expanded architecture overview and detailed client/server feature explanations.
+- Updated readme.md to include clearer instructions and code examples for A, AAAA, TXT, MX record queries and DNS propagation checks.
+- Enhanced examples for using DNSSEC, including detailed examples for DNSKEY, DS, and RRSIG records.
+- Added new instructions for setting up DNS-over-HTTPS (DoH), UDP-based resolution, and pattern-based routing for handlers.
+- Improved testing documentation with updated TAP tests demonstrating both DNS client and server flows.
+
+## 2025-05-27 - 7.0.2 - fix(dns-client)
+Improve test assertions for DNS record queries and correct counter increment logic in DNS client
+
+- Updated test cases in test/test.client.ts to use dynamic assertions with 'google.com' instead of fixed values
+- Adjusted checkUntilAvailable tests to verify proper behavior when DNS TXT record is missing
+- Fixed counter increment in ts_client/classes.dnsclient.ts to avoid post-increment issues, ensuring proper retry delays
+
+## 2025-05-27 - 7.0.1 - fix(test & plugins)
+Rename test client variable and export smartrequest in client plugins
+
+- Renamed variable 'testDnsly' to 'testDnsClient' in test/test.client.ts for better clarity.
+- Added @push.rocks/smartrequest dependency in package.json and updated ts_client/plugins.ts to export it.
+
+## 2025-05-27 - 7.0.0 - BREAKING CHANGE(core)
+Refactor module entry point and update plugin imports; remove deprecated dnsly.plugins, update dependency versions, and adjust test imports
+
+- Changed module export in package.json from './dist_ts_server/index.js' to './dist_ts/index.js'
+- Updated dependency versions, notably upgrading '@tsclass/tsclass' from 5.0.0 to 9.2.0 and updating tap bundles to '@git.zone/tstest' packages
+- Removed the redundant ts_client/dnsly.plugins.ts file and replaced its usage with the updated ts_client/plugins.ts
+- Adjusted test files to use export default tap.start() and updated import paths for tap bundles
+- Added tspublish.json files in ts, ts_client, and ts_server directories to control publish order
+
+## 2025-03-21 - 6.3.0 - feat(dns-server)
+Enhance DNS server functionality with advanced DNSSEC signing (supporting both ECDSA and ED25519), improved SSL certificate retrieval using Let's Encrypt, and refined handler management for cleaner shutdowns.
+
+- Updated package metadata with expanded keywords and revised dependency versions
+- Improved DNSSEC signing logic to support both ECDSA and ED25519 algorithms
+- Added unregisterHandler method for cleaner handler lifecycle management
+- Enhanced SSL certificate retrieval workflow with better DNS challenge handling
+- Refined test utilities for more robust DNS operations
+
+## 2025-03-21 - 6.3.0 - feat(dns-server)
+Enhance DNS server functionality with advanced DNSSEC signing (including ED25519 support), improved certificate retrieval using Let's Encrypt, updated package metadata, and refined test utilities for more robust DNS operations.
+
+- Updated package.json and npmextra.json with expanded keywords and revised dependency versions
+- Improved DNSSEC signing logic to support both ECDSA and ED25519 algorithms
+- Added unregisterHandler method and enhanced server stop logic for cleaner shutdowns
+- Enhanced SSL certificate retrieval workflow with better challenge handling and test support
+
+## 2024-09-21 - 6.2.1 - fix(core)
+Fixing issues with keywords and readme formatting.
+
+- Synchronized keywords field between npmextra.json and package.json.
+- Updated readme.md to fix formatting issues and added new sections.
+
+## 2024-09-19 - 6.2.0 - feat(dnssec)
+Introduced DNSSEC support with ECDSA algorithm
+
+- Added `DnsSec` class for handling DNSSEC operations.
+- Updated `DnsServer` to support DNSSEC with ECDSA.
+- Shifted DNS-related helper functions to `DnsServer` class.
+- Integrated parsing and handling of DNSKEY and RRSIG records in `DnsServer`.
+
+## 2024-09-19 - 6.1.1 - fix(ts_server)
+Update DnsSec class to fully implement key generation and DNSKEY record creation.
+
+- Added complete support for ECDSA and ED25519 algorithms in the DnsSec class.
+- Implemented DNSKEY generation and KeyTag computation methods.
+- Improved error handling and initialized the appropriate cryptographic instances based on the algorithm.
+
+## 2024-09-18 - 6.1.0 - feat(smartdns)
+Add DNS Server and DNSSEC tools with comprehensive unit tests
+
+- Updated package dependencies to the latest versions
+- Introduced DnsServer class for handling DNS requests over both HTTPS and UDP with support for custom handlers
+- Added DnsSec class for generating and managing DNSSEC keys and DS records
+- Implemented unit tests for DnsServer and Smartdns classes
+
+## 2024-06-02 - 6.0.0 - server/client
+Main description here
+
+- **Breaking Change:** Move from client only to server + client exports.
+
+## 2024-03-30 - 5.0.4 - maintenance
+Range contains relevant changes
+
+- Switch to new org scheme
+
+## 2023-04-08 - 5.0.4 - core
+Main description here
+
+- Core update
+- Fixes applied to the system
+
+## 2022-07-27 - 5.0.0 - core
+Update contains relevant changes
+
+- **Breaking Change:** Major update and core changes
+- Fixes and updates applied
+
+## 2022-07-27 - 4.0.11 - core
+Range contains relevant changes
+
+- **Breaking Change:** Core update and changes applied
+
+## 2021-08-24 - 4.0.10 - core
+Range contains relevant changes
+
+- Fixes applied to the core functionalities
+
+## 2021-01-23 - 4.0.8 - core
+Range contains relevant changes
+
+- Updates and fixes to the core components
+
+## 2020-08-05 - 4.0.4 - core
+Range contains relevant changes
+
+- Multiple core fixes applied
+
+## 2020-02-15 - 4.0.0 - core
+Main description here
+
+- Core updates
+- Fixes applied across the system
+
+## 2020-02-15 - 3.0.8 - core
+Core updates with major changes
+
+- **Breaking Change:** Now uses Google DNS HTTPS API and handles DNSSEC validation
+
+## 2019-01-07 - 3.0.6 - core
+Range contains relevant changes
+
+- Fixes and updates applied to the core
+
+## 2018-05-13 - 3.0.4 - core
+Range contains relevant changes
+
+- Fixes applied, including `fix .checkUntilAvailable` error
+
+## 2018-05-13 - 3.0.0 - ci
+Main description here
+
+- CI changes and updates to the access level and global packages
+
+## 2017-07-31 - 2.0.10 - package
+Update to new package name and improved record retrieval
+
+- **Breaking Change:** Package name update and record retrieval improvements
+
+## 2017-01-27 - 2.0.1 - maintenance
+Multiple fixes and merges
+
+## 2017-01-27 - 2.0.0 - core
+Fix typings and update to better API
+
+## 2016-11-15 - 1.0.7 - initial
+Initial setup and improvements
+
+- Initial deployment
+- README improvements
+

dist/dnsly.plugins.d.ts

@@ -1,5 +0,0 @@
-import 'typings-global';
-import * as beautylog from 'beautylog';
-import * as dns from 'dns';
-import * as smartdelay from 'smartdelay';
-export { beautylog, dns, smartdelay };

dist/dnsly.plugins.js

@@ -1,9 +0,0 @@
-"use strict";
-require("typings-global");
-const beautylog = require("beautylog");
-exports.beautylog = beautylog;
-const dns = require("dns");
-exports.dns = dns;
-const smartdelay = require("smartdelay");
-exports.smartdelay = smartdelay;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZG5zbHkucGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL2Ruc2x5LnBsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLDBCQUF1QjtBQUN2Qix1Q0FBc0M7QUFLbEMsOEJBQVM7QUFKYiwyQkFBMEI7QUFLdEIsa0JBQUc7QUFKUCx5Q0FBd0M7QUFLcEMsZ0NBQVUifQ==

dist/index.d.ts

@@ -1,44 +0,0 @@
-export declare type TDnsProvider = 'google';
-export declare type TDnsRecordType = 'A' | 'AAAA' | 'CNAME' | 'PTR' | 'MX' | 'NAPTR' | 'NS' | 'SOA' | 'SRV' | 'TXT';
-export interface IDnsRecord {
-    chunked?: string[];
-    name: string;
-    type: TDnsRecordType;
-    value: string;
-}
-/**
- * class dnsly offers methods for working with dns from a dns provider like Google DNS
- */
-export declare class Dnsly {
-    dnsServerIp: string;
-    dnsServerPort: number;
-    /**
-     * constructor for class dnsly
-     */
-    constructor(dnsProviderArg?: TDnsProvider);
-    /**
-     * gets a record
-     */
-    getRecord(recordNameArg: string, recordTypeArg: TDnsRecordType): Promise<IDnsRecord[]>;
-    checkUntilAvailable(recordNameArg: string, recordTypeArg: TDnsRecordType, expectedValue: string): Promise<any>;
-    /**
-     * get A Dns Record
-     */
-    getRecordA(recordNameArg: string): Promise<IDnsRecord[]>;
-    /**
-     * get AAAA Record
-     */
-    getRecordAAAA(recordNameArg: string): Promise<IDnsRecord[]>;
-    /**
-     * gets a txt record
-     */
-    getRecordTxt(recordNameArg: string): Promise<IDnsRecord[]>;
-    /**
-     * get oridinary record
-     */
-    private getOrdinaryRecord(recordNameArg, recordTypeArg);
-    /**
-     * set the DNS provider
-     */
-    private _setDnsProvider(dnsProvider);
-}

dist/index.js

@@ -1,144 +0,0 @@
-"use strict";
-var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
-    return new (P || (P = Promise))(function (resolve, reject) {
-        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
-        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
-        function step(result) { result.done ? resolve(result.value) : new P(function (resolve) { resolve(result.value); }).then(fulfilled, rejected); }
-        step((generator = generator.apply(thisArg, _arguments || [])).next());
-    });
-};
-const q = require("smartq");
-const plugins = require("./dnsly.plugins");
-/**
- * class dnsly offers methods for working with dns from a dns provider like Google DNS
- */
-class Dnsly {
-    /**
-     * constructor for class dnsly
-     */
-    constructor(dnsProviderArg = 'google') {
-        this._setDnsProvider(dnsProviderArg);
-    }
-    /**
-     * gets a record
-     */
-    getRecord(recordNameArg, recordTypeArg) {
-        return __awaiter(this, void 0, void 0, function* () {
-            switch (recordTypeArg) {
-                case 'TXT':
-                    return yield this.getRecordTxt(recordNameArg);
-                case 'A':
-                    return yield this.getRecordA(recordNameArg);
-                case 'AAAA':
-                    return yield this.getRecordAAAA(recordNameArg);
-            }
-        });
-    }
-    checkUntilAvailable(recordNameArg, recordTypeArg, expectedValue) {
-        return __awaiter(this, void 0, void 0, function* () {
-            let cycleArg = 0;
-            let doCheck = () => __awaiter(this, void 0, void 0, function* () {
-                if (cycleArg < 30) {
-                    cycleArg++;
-                    try {
-                        let myRecordArray = yield this.getRecord(recordNameArg, recordTypeArg);
-                        let myRecord = myRecordArray[0].value;
-                        if (myRecord === expectedValue) {
-                            return true;
-                        }
-                        else {
-                            yield plugins.smartdelay.delayFor(500);
-                            return yield doCheck();
-                        }
-                    }
-                    catch (err) {
-                        yield plugins.smartdelay.delayFor(500);
-                        return yield doCheck();
-                    }
-                }
-                else {
-                    console.log('failed permanently...');
-                    return false;
-                }
-            });
-            return yield doCheck();
-        });
-    }
-    /**
-     * get A Dns Record
-     */
-    getRecordA(recordNameArg) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.getOrdinaryRecord(recordNameArg, 'A');
-        });
-    }
-    /**
-     * get AAAA Record
-     */
-    getRecordAAAA(recordNameArg) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield this.getOrdinaryRecord(recordNameArg, 'AAAA');
-        });
-    }
-    /**
-     * gets a txt record
-     */
-    getRecordTxt(recordNameArg) {
-        let done = q.defer();
-        plugins.dns.resolveTxt(recordNameArg, (err, recordsArg) => {
-            if (err) {
-                done.reject(err);
-                return;
-            }
-            let responseArray = [];
-            for (let record of recordsArg) {
-                let recordAny = record; // fix wrong typings
-                responseArray.push({
-                    chunked: recordAny,
-                    name: recordNameArg,
-                    value: recordAny.join(' '),
-                    type: 'TXT'
-                });
-            }
-            done.resolve(responseArray);
-        });
-        return done.promise;
-    }
-    /**
-     * get oridinary record
-     */
-    getOrdinaryRecord(recordNameArg, recordTypeArg) {
-        let done = q.defer();
-        plugins.dns.resolve(recordNameArg, recordTypeArg, (err, recordsArg) => {
-            if (err) {
-                done.reject(err);
-                return;
-            }
-            let responseArray = [];
-            for (let record of recordsArg) {
-                responseArray.push({
-                    name: recordNameArg,
-                    value: record,
-                    type: recordTypeArg
-                });
-            }
-            done.resolve(responseArray);
-        });
-        return done.promise;
-    }
-    /**
-     * set the DNS provider
-     */
-    _setDnsProvider(dnsProvider) {
-        if (dnsProvider === 'google') {
-            this.dnsServerIp = '8.8.8.8';
-            this.dnsServerPort = 53;
-            plugins.dns.setServers(['8.8.8.8', '8.8.4.4']);
-        }
-        else {
-            throw new Error('unknown dns provider');
-        }
-    }
-}
-exports.Dnsly = Dnsly;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7QUFBQSw0QkFBMkI7QUFDM0IsMkNBQTBDO0FBcUIxQzs7R0FFRztBQUNIO0lBR0k7O09BRUc7SUFDSCxZQUFZLGlCQUErQixRQUFRO1FBQy9DLElBQUksQ0FBQyxlQUFlLENBQUMsY0FBYyxDQUFDLENBQUE7SUFDeEMsQ0FBQztJQUVEOztPQUVHO0lBQ0csU0FBUyxDQUFDLGFBQXFCLEVBQUUsYUFBNkI7O1lBQ2hFLE1BQU0sQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7Z0JBQ3BCLEtBQUssS0FBSztvQkFDTixNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFBO2dCQUNqRCxLQUFLLEdBQUc7b0JBQ0osTUFBTSxDQUFDLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxhQUFhLENBQUMsQ0FBQTtnQkFDL0MsS0FBSyxNQUFNO29CQUNQLE1BQU0sQ0FBQyxNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsYUFBYSxDQUFDLENBQUE7WUFDdEQsQ0FBQztRQUNMLENBQUM7S0FBQTtJQUVLLG1CQUFtQixDQUFDLGFBQXFCLEVBQUUsYUFBNkIsRUFBRSxhQUFxQjs7WUFDakcsSUFBSSxRQUFRLEdBQUcsQ0FBQyxDQUFBO1lBQ2hCLElBQUksT0FBTyxHQUFHO2dCQUNWLEVBQUUsQ0FBQyxDQUFDLFFBQVEsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO29CQUNoQixRQUFRLEVBQUUsQ0FBQTtvQkFDVixJQUFJLENBQUM7d0JBQ0QsSUFBSSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLGFBQWEsRUFBRSxhQUFhLENBQUMsQ0FBQTt3QkFDdEUsSUFBSSxRQUFRLEdBQUcsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQTt3QkFDckMsRUFBRSxDQUFDLENBQUMsUUFBUSxLQUFLLGFBQWEsQ0FBQyxDQUFDLENBQUM7NEJBQzdCLE1BQU0sQ0FBQyxJQUFJLENBQUE7d0JBQ2YsQ0FBQzt3QkFBQyxJQUFJLENBQUMsQ0FBQzs0QkFDSixNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFBOzRCQUN0QyxNQUFNLENBQUMsTUFBTSxPQUFPLEVBQUUsQ0FBQTt3QkFDMUIsQ0FBQztvQkFDTCxDQUFDO29CQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUM7d0JBQ1gsTUFBTSxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQTt3QkFDdEMsTUFBTSxDQUFDLE1BQU0sT0FBTyxFQUFFLENBQUE7b0JBQzFCLENBQUM7Z0JBQ0wsQ0FBQztnQkFBQyxJQUFJLENBQUMsQ0FBQztvQkFDSixPQUFPLENBQUMsR0FBRyxDQUFDLHVCQUF1QixDQUFDLENBQUE7b0JBQ3BDLE1BQU0sQ0FBQyxLQUFLLENBQUE7Z0JBQ2hCLENBQUM7WUFDTCxDQUFDLENBQUEsQ0FBQTtZQUNELE1BQU0sQ0FBQyxNQUFNLE9BQU8sRUFBRSxDQUFBO1FBQzFCLENBQUM7S0FBQTtJQUVEOztPQUVHO0lBQ0csVUFBVSxDQUFDLGFBQXFCOztZQUNsQyxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsaUJBQWlCLENBQUMsYUFBYSxFQUFFLEdBQUcsQ0FBQyxDQUFBO1FBQzNELENBQUM7S0FBQTtJQUVEOztPQUVHO0lBQ0csYUFBYSxDQUFDLGFBQXFCOztZQUNyQyxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsaUJBQWlCLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxDQUFBO1FBQzlELENBQUM7S0FBQTtJQUVEOztPQUVHO0lBQ0gsWUFBWSxDQUFDLGFBQXFCO1FBQzlCLElBQUksSUFBSSxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQWdCLENBQUE7UUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUMsR0FBRyxFQUFFLFVBQVU7WUFDbEQsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztnQkFDTixJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFBO2dCQUNoQixNQUFNLENBQUE7WUFDVixDQUFDO1lBQ0QsSUFBSSxhQUFhLEdBQWlCLEVBQUUsQ0FBQTtZQUNwQyxHQUFHLENBQUMsQ0FBQyxJQUFJLE1BQU0sSUFBSSxVQUFVLENBQUMsQ0FBQyxDQUFDO2dCQUM1QixJQUFJLFNBQVMsR0FBUSxNQUFNLENBQUEsQ0FBQyxvQkFBb0I7Z0JBQ2hELGFBQWEsQ0FBQyxJQUFJLENBQUM7b0JBQ2YsT0FBTyxFQUFFLFNBQVM7b0JBQ2xCLElBQUksRUFBRSxhQUFhO29CQUNuQixLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7b0JBQzFCLElBQUksRUFBRSxLQUFLO2lCQUNkLENBQUMsQ0FBQTtZQUNOLENBQUM7WUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxDQUFBO1FBQy9CLENBQUMsQ0FBQyxDQUFBO1FBQ0YsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUE7SUFDdkIsQ0FBQztJQUVEOztPQUVHO0lBQ0ssaUJBQWlCLENBQUMsYUFBcUIsRUFBRSxhQUE2QjtRQUMxRSxJQUFJLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFnQixDQUFBO1FBQ2xDLE9BQU8sQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLGFBQWEsRUFBRSxhQUFhLEVBQUUsQ0FBQyxHQUFHLEVBQUUsVUFBVTtZQUM5RCxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO2dCQUNOLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUE7Z0JBQ2hCLE1BQU0sQ0FBQTtZQUNWLENBQUM7WUFDRCxJQUFJLGFBQWEsR0FBaUIsRUFBRSxDQUFBO1lBQ3BDLEdBQUcsQ0FBQyxDQUFDLElBQUksTUFBTSxJQUFJLFVBQVUsQ0FBQyxDQUFDLENBQUM7Z0JBQzVCLGFBQWEsQ0FBQyxJQUFJLENBQUM7b0JBQ2YsSUFBSSxFQUFFLGFBQWE7b0JBQ25CLEtBQUssRUFBRSxNQUFNO29CQUNiLElBQUksRUFBRSxhQUFhO2lCQUN0QixDQUFDLENBQUE7WUFDTixDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsQ0FBQTtRQUMvQixDQUFDLENBQUMsQ0FBQTtRQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFBO0lBQ3ZCLENBQUM7SUFFRDs7T0FFRztJQUNLLGVBQWUsQ0FBQyxXQUF5QjtRQUM3QyxFQUFFLENBQUMsQ0FBQyxXQUFXLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQztZQUMzQixJQUFJLENBQUMsV0FBVyxHQUFHLFNBQVMsQ0FBQTtZQUM1QixJQUFJLENBQUMsYUFBYSxHQUFHLEVBQUUsQ0FBQTtZQUN2QixPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFBO1FBQ2xELENBQUM7UUFBQyxJQUFJLENBQUMsQ0FBQztZQUNKLE1BQU0sSUFBSSxLQUFLLENBQUMsc0JBQXNCLENBQUMsQ0FBQTtRQUMzQyxDQUFDO0lBQ0wsQ0FBQztDQUNKO0FBNUhELHNCQTRIQyJ9

npmextra.json

@@ -0,0 +1,40 @@
+{
+  "gitzone": {
+    "projectType": "npm",
+    "module": {
+      "githost": "code.foss.global",
+      "gitscope": "push.rocks",
+      "gitrepo": "smartdns",
+      "description": "A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.",
+      "npmPackagename": "@push.rocks/smartdns",
+      "license": "MIT",
+      "keywords": [
+        "TypeScript",
+        "DNS",
+        "DNS records",
+        "DNS resolution",
+        "DNS management",
+        "DNSSEC",
+        "Node.js",
+        "Google DNS",
+        "Cloudflare",
+        "UDP DNS",
+        "HTTPS DNS",
+        "ACME",
+        "Let's Encrypt",
+        "SSL Certificates",
+        "Feature Flagging",
+        "Domain Propagation",
+        "DNS Server"
+      ]
+    }
+  },
+  "npmci": {
+    "npmGlobalTools": [],
+    "npmAccessLevel": "public",
+    "npmRegistryUrl": "registry.npmjs.org"
+  },
+  "tsdoc": {
+    "legal": "\n## License and Legal Information\n\nThis repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license) file within this repository. \n\n**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.\n\n### Trademarks\n\nThis project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.\n\n### Company Information\n\nTask Venture Capital GmbH  \nRegistered at District court Bremen HRB 35230 HB, Germany\n\nFor any legal inquiries or if you require further information, please contact us via email at hello@task.vc.\n\nBy using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.\n"
+  }
+}

package.json

@@ -1,35 +1,81 @@
 {
-  "name": "dnsly",
+  "name": "@push.rocks/smartdns",
-  "version": "2.0.3",
+  "version": "7.5.0",
-  "description": "smart dns methods written in TypeScript",
+  "private": false,
-  "main": "dist/index.js",
+  "description": "A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.",
-  "typings": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist_ts/index.js",
+    "./server": "./dist_ts_server/index.js",
+    "./client": "./dist_ts_client/index.js"
+  },
   "scripts": {
-    "test": "(npmts)"
+    "test": "(tstest test/ --verbose --timeout 60)",
+    "build": "(tsbuild tsfolders --web --allowimplicitany)",
+    "buildDocs": "tsdoc"
   },
   "repository": {
     "type": "git",
-    "url": "git+ssh://git@gitlab.com/pushrocks/dnsly.git"
+    "url": "https://code.foss.global/push.rocks/smartdns.git"
   },
   "keywords": [
-    "dns",
+    "TypeScript",
-    "google dns",
+    "DNS",
-    "dns record"
+    "DNS records",
+    "DNS resolution",
+    "DNS management",
+    "DNSSEC",
+    "Node.js",
+    "Google DNS",
+    "Cloudflare",
+    "UDP DNS",
+    "HTTPS DNS",
+    "ACME",
+    "Let's Encrypt",
+    "SSL Certificates",
+    "Feature Flagging",
+    "Domain Propagation",
+    "DNS Server"
   ],
   "author": "Lossless GmbH",
   "license": "MIT",
   "bugs": {
     "url": "https://gitlab.com/pushrocks/dnsly/issues"
   },
-  "homepage": "https://gitlab.com/pushrocks/dnsly#README",
+  "homepage": "https://code.foss.global/push.rocks/smartdns",
   "dependencies": {
-    "beautylog": "^6.0.0",
+    "@push.rocks/smartdelay": "^3.0.1",
-    "smartdelay": "^1.0.1",
+    "@push.rocks/smartenv": "^5.0.5",
-    "smartq": "^1.0.4",
+    "@push.rocks/smartpromise": "^4.2.3",
-    "typings-global": "^1.0.14"
+    "@push.rocks/smartrequest": "^2.1.0",
+    "@tsclass/tsclass": "^9.2.0",
+    "@types/dns-packet": "^5.6.5",
+    "@types/elliptic": "^6.4.18",
+    "acme-client": "^5.4.0",
+    "dns-packet": "^5.6.1",
+    "elliptic": "^6.6.1",
+    "minimatch": "^10.0.1"
   },
   "devDependencies": {
-    "smartchai": "^1.0.1",
+    "@git.zone/tsbuild": "^2.6.4",
-    "typings-test": "^1.0.3"
+    "@git.zone/tsrun": "^1.3.3",
-  }
+    "@git.zone/tstest": "^2.3.1",
+    "@types/node": "^22.15.21"
+  },
+  "files": [
+    "ts/**/*",
+    "ts_web/**/*",
+    "dist/**/*",
+    "dist_*/**/*",
+    "dist_ts/**/*",
+    "dist_ts_web/**/*",
+    "assets/**/*",
+    "cli.js",
+    "npmextra.json",
+    "readme.md"
+  ],
+  "browserslist": [
+    "last 1 chrome versions"
+  ],
+  "type": "module",
+  "packageManager": "pnpm@10.10.0+sha512.d615db246fe70f25dcfea6d8d73dee782ce23e2245e3c4f6f888249fb568149318637dca73c2c5c8ef2a4ca0d5657fb9567188bfab47f566d1ee6ce987815c39"
 }

readme.hints.md

@@ -0,0 +1,122 @@
+# smartdns - Implementation Hints
+
+## Architecture Overview
+
+The smartdns library is structured into three main modules:
+
+1. **Client Module** (`ts_client/`) - DNS client functionality
+2. **Server Module** (`ts_server/`) - DNS server implementation
+3. **Main Module** (`ts/`) - Re-exports both client and server
+
+## Client Module (Smartdns class)
+
+### Key Features:
+- DNS record queries (A, AAAA, TXT, MX, etc.)
+- Support for multiple DNS providers (Google DNS, Cloudflare)
+- DNS propagation checking with retry logic
+- DNSSEC verification support
+- Both HTTP-based (DoH) and Node.js DNS resolver fallback
+
+### Implementation Details:
+- Uses Cloudflare's DNS-over-HTTPS API as primary resolver
+- Falls back to Node.js DNS module for local resolution
+- Implements automatic retry logic with configurable intervals
+- Properly handles quoted TXT records and trailing dots in domain names
+
+### Key Methods:
+- `getRecordsA()`, `getRecordsAAAA()`, `getRecordsTxt()` - Type-specific queries
+- `getRecords()` - Generic record query with retry support
+- `checkUntilAvailable()` - DNS propagation verification
+- `getNameServers()` - NS record lookup
+- `makeNodeProcessUseDnsProvider()` - Configure system DNS resolver
+
+## Server Module (DnsServer class)
+
+### Key Features:
+- Full DNS server supporting UDP and HTTPS (DoH) protocols
+- DNSSEC implementation with multiple algorithms
+- Dynamic handler registration for custom responses
+- Let's Encrypt integration for automatic SSL certificates
+- Wildcard domain support with pattern matching
+
+### DNSSEC Implementation:
+- Supports ECDSA (algorithm 13), ED25519 (algorithm 15), and RSA (algorithm 8)
+- Automatic DNSKEY and DS record generation
+- RRSIG signature generation for authenticated responses
+- Key tag computation following RFC 4034
+
+### Let's Encrypt Integration:
+- Automatic SSL certificate retrieval using DNS-01 challenges
+- Dynamic TXT record handler registration for ACME validation
+- Certificate renewal and HTTPS server restart capability
+- Domain authorization filtering for security
+
+### Handler System:
+- Pattern-based domain matching using minimatch
+- Support for all common record types
+- **Multiple Handler Support**: As of v7.4.2+, multiple handlers can contribute records of the same type
+- Handler chaining for complex scenarios
+- Automatic SOA response for unhandled queries
+
+### Multiple Records Support (v7.4.2+):
+- Server now processes ALL matching handlers for a query (previously stopped after first match)
+- Enables proper multi-NS record support for domain registration
+- Supports round-robin DNS with multiple A/AAAA records
+- Allows multiple TXT records (SPF, DKIM, domain verification)
+- Each handler contributes its record to the response
+
+## Key Dependencies
+
+- `dns-packet`: DNS packet encoding/decoding (wire format)
+- `elliptic`: Cryptographic operations for DNSSEC
+- `acme-client`: Let's Encrypt certificate automation
+- `minimatch`: Glob pattern matching for domains
+- `@push.rocks/smartrequest`: HTTP client for DoH queries
+- `@tsclass/tsclass`: Type definitions for DNS records
+
+## Testing Insights
+
+The test suite demonstrates:
+- Mock ACME client for testing Let's Encrypt integration
+- Self-signed certificate generation for HTTPS testing
+- Unique port allocation to avoid conflicts
+- Proper server cleanup between tests
+- Both UDP and HTTPS query validation
+
+## Common Patterns
+
+1. **DNS Record Types**: Internally mapped to numeric values (A=1, AAAA=28, etc.)
+2. **Error Handling**: Graceful fallback and retry mechanisms
+3. **DNSSEC Workflow**: Zone → Key Generation → Signing → Verification
+4. **Certificate Flow**: Domain validation → Challenge setup → Verification → Certificate retrieval
+
+## Performance Considerations
+
+- Client implements caching via DNS-over-HTTPS responses
+- Server can handle concurrent UDP and HTTPS requests
+- DNSSEC signing is performed on-demand for efficiency
+- Handler registration is O(n) lookup but uses pattern caching
+
+## Security Notes
+
+- DNSSEC provides authentication but not encryption
+- DoH (DNS-over-HTTPS) provides both privacy and integrity
+- Let's Encrypt integration requires proper domain authorization
+- Handler patterns should be carefully designed to avoid open resolvers
+
+## Recent Improvements (v7.4.3)
+
+1. **DNSSEC RRset Signing**: Fixed to properly sign entire RRsets together instead of individual records
+2. **SOA Record Serialization**: Implemented proper SOA record encoding for DNSSEC compatibility
+3. **Configurable Primary Nameserver**: Added `primaryNameserver` option to customize SOA mname field
+
+## Recent Improvements (v7.4.8)
+
+1. **MX Record DNSSEC Support**: Implemented MX record serialization for DNSSEC signing
+   - MX records consist of a 16-bit preference value followed by the exchange domain name
+   - Properly serializes both components for DNSSEC signature generation
+   - Enables mail exchange records to be authenticated with DNSSEC
+
+## Known Limitations
+
+1. **Handler Deduplication**: If the same handler is registered multiple times, it will contribute duplicate records (this may be desired behavior for some use cases)

readme.md

@@ -0,0 +1,862 @@
+# @push.rocks/smartdns
+
+A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.
+
+## Install
+
+To install `@push.rocks/smartdns`, use the following command with pnpm:
+
+```bash
+pnpm install @push.rocks/smartdns --save
+```
+
+Or with npm:
+
+```bash
+npm install @push.rocks/smartdns --save
+```
+
+Make sure you have a TypeScript environment set up to utilize the library effectively.
+
+## Usage
+
+`@push.rocks/smartdns` is a comprehensive library that provides both DNS client and server capabilities, leveraging TypeScript for enhanced development experience. The library is organized into three modules:
+
+- **Client Module** (`@push.rocks/smartdns/client`): DNS resolution and record queries
+- **Server Module** (`@push.rocks/smartdns/server`): Full DNS server implementation with DNSSEC
+- **Main Module** (`@push.rocks/smartdns`): Convenience exports for both client and server
+
+### Getting Started
+
+You can import the modules based on your needs:
+
+```typescript
+// For DNS client operations
+import { Smartdns } from '@push.rocks/smartdns/client';
+
+// For DNS server operations
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+// Or import from the main module (note the different syntax)
+import { dnsClientMod, dnsServerMod } from '@push.rocks/smartdns';
+const dnsClient = new dnsClientMod.Smartdns({});
+const dnsServer = new dnsServerMod.DnsServer({ /* options */ });
+```
+
+### DNS Client Operations
+
+The DNS client (`Smartdns` class) provides methods to query various DNS record types using DNS-over-HTTPS (DoH) with Cloudflare as the primary provider, with fallback to Node.js DNS resolver.
+
+#### Fetching A Records
+
+To fetch "A" records (IPv4 addresses) for a domain:
+
+```typescript
+import { Smartdns } from '@push.rocks/smartdns/client';
+
+const dnsClient = new Smartdns({});
+const aRecords = await dnsClient.getRecordsA('example.com');
+console.log(aRecords);
+// Output: [{ name: 'example.com', type: 'A', dnsSecEnabled: false, value: '93.184.215.14' }]
+```
+
+#### Fetching AAAA Records
+
+For resolving a domain to IPv6 addresses:
+
+```typescript
+const aaaaRecords = await dnsClient.getRecordsAAAA('example.com');
+console.log(aaaaRecords);
+// Output: [{ name: 'example.com', type: 'AAAA', dnsSecEnabled: false, value: '2606:2800:21f:cb07:6820:80da:af6b:8b2c' }]
+```
+
+#### Fetching TXT Records
+
+TXT records store text data, commonly used for domain verification, SPF records, and other metadata:
+
+```typescript
+const txtRecords = await dnsClient.getRecordsTxt('example.com');
+console.log(txtRecords);
+// Output: [{ name: 'example.com', type: 'TXT', dnsSecEnabled: false, value: 'v=spf1 -all' }]
+```
+
+#### Other Record Types
+
+The client supports various other DNS record types:
+
+```typescript
+// MX records for mail servers
+const mxRecords = await dnsClient.getRecords('example.com', 'MX');
+
+// NS records for nameservers
+const nsRecords = await dnsClient.getNameServers('example.com');
+
+// Generic query method with retry support
+const records = await dnsClient.getRecords('example.com', 'CNAME', { retryCount: 3 });
+```
+
+### Advanced DNS Features
+
+#### Checking DNS Propagation
+
+The client provides a powerful method to verify DNS propagation globally, essential when making DNS changes:
+
+```typescript
+// Check if a specific DNS record has propagated
+const recordType = 'TXT';
+const expectedValue = 'verification=abc123';
+
+const isAvailable = await dnsClient.checkUntilAvailable(
+  'example.com',
+  recordType,
+  expectedValue,
+  50,    // Number of check cycles (default: 50)
+  500    // Interval between checks in ms (default: 500)
+);
+
+if (isAvailable) {
+  console.log('DNS record has propagated successfully!');
+} else {
+  console.log('DNS propagation timeout - record not found.');
+}
+```
+
+#### Configuring System DNS Provider
+
+You can configure Node.js to use a specific DNS provider for all DNS queries:
+
+```typescript
+// Import the standalone function
+import { makeNodeProcessUseDnsProvider } from '@push.rocks/smartdns/client';
+
+// Use Cloudflare DNS for all Node.js DNS operations
+makeNodeProcessUseDnsProvider('cloudflare');
+
+// Or use Google DNS
+makeNodeProcessUseDnsProvider('google');
+```
+
+### Real-World Use Cases
+
+#### DNS-Based Feature Flagging
+
+Use TXT records for dynamic feature toggles without redeployment:
+
+```typescript
+const txtRecords = await dnsClient.getRecordsTxt('features.example.com');
+const featureFlags = {};
+
+txtRecords.forEach(record => {
+  // Parse TXT records like "feature-dark-mode=true"
+  const [feature, enabled] = record.value.split('=');
+  featureFlags[feature] = enabled === 'true';
+});
+
+if (featureFlags['feature-dark-mode']) {
+  console.log('Dark mode is enabled!');
+}
+```
+
+#### Service Discovery
+
+Use DNS for service endpoint discovery:
+
+```typescript
+// Discover API endpoints via TXT records
+const serviceRecords = await dnsClient.getRecordsTxt('_services.example.com');
+
+// Discover mail servers
+const mxRecords = await dnsClient.getRecords('example.com', 'MX');
+const primaryMailServer = mxRecords
+  .sort((a, b) => a.priority - b.priority)[0]?.exchange;
+```
+
+### DNS Server Implementation
+
+The `DnsServer` class provides a full-featured DNS server with support for UDP, DNS-over-HTTPS (DoH), DNSSEC, and automatic SSL certificate management via Let's Encrypt.
+
+#### Basic DNS Server Setup
+
+Create a simple DNS server that responds to queries:
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+const dnsServer = new DnsServer({
+  udpPort: 5333,      // UDP port for DNS queries
+  httpsPort: 8443,    // HTTPS port for DNS-over-HTTPS
+  httpsKey: 'path/to/key.pem',   // Required for HTTPS
+  httpsCert: 'path/to/cert.pem', // Required for HTTPS
+  dnssecZone: 'example.com'      // Optional: enable DNSSEC for this zone
+});
+
+// For enhanced security, bind to specific interfaces
+const secureServer = new DnsServer({
+  udpPort: 53,
+  httpsPort: 443,
+  httpsKey: 'path/to/key.pem',
+  httpsCert: 'path/to/cert.pem',
+  dnssecZone: 'example.com',
+  udpBindInterface: '127.0.0.1',    // Bind UDP to localhost only
+  httpsBindInterface: '127.0.0.1',  // Bind HTTPS to localhost only
+  primaryNameserver: 'ns1.example.com' // Optional: primary nameserver for SOA records (defaults to ns1.{dnssecZone})
+});
+
+// Register a handler for all subdomains of example.com
+dnsServer.registerHandler('*.example.com', ['A'], (question) => ({
+  name: question.name,
+  type: 'A',
+  class: 'IN',
+  ttl: 300,
+  data: '192.168.1.100',
+}));
+
+// Register a handler for TXT records
+dnsServer.registerHandler('example.com', ['TXT'], (question) => ({
+  name: question.name,
+  type: 'TXT',
+  class: 'IN',
+  ttl: 300,
+  data: 'v=spf1 include:_spf.example.com ~all',
+}));
+
+// Start the server
+await dnsServer.start();
+console.log('DNS Server started!');
+```
+
+### SOA Records and Primary Nameserver
+
+The DNS server automatically generates SOA (Start of Authority) records for zones when no specific handler matches a query. The SOA record contains important zone metadata including the primary nameserver.
+
+```typescript
+const dnsServer = new DnsServer({
+  udpPort: 53,
+  httpsPort: 443,
+  httpsKey: 'path/to/key.pem',
+  httpsCert: 'path/to/cert.pem',
+  dnssecZone: 'example.com',
+  primaryNameserver: 'ns1.example.com'  // Specify your actual primary nameserver
+});
+
+// Without primaryNameserver, the SOA mname defaults to 'ns1.{dnssecZone}'
+// In this case, it would be 'ns1.example.com'
+
+// The automatic SOA record includes:
+// - mname: Primary nameserver (from primaryNameserver option)
+// - rname: Responsible person email (hostmaster.{dnssecZone})
+// - serial: Unix timestamp
+// - refresh: 3600 (1 hour)
+// - retry: 600 (10 minutes)
+// - expire: 604800 (7 days)
+// - minimum: 86400 (1 day)
+```
+
+**Important**: Even if you have multiple nameservers (NS records), only one is designated as the primary in the SOA record. All authoritative nameservers should return the same SOA record.
+
+### DNSSEC Support
+
+The DNS server includes comprehensive DNSSEC support with automatic key generation and record signing:
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+const dnsServer = new DnsServer({
+  udpPort: 53,
+  httpsPort: 443,
+  dnssecZone: 'secure.example.com',  // Enable DNSSEC for this zone
+});
+
+// The server automatically:
+// 1. Generates DNSKEY records with ECDSA (algorithm 13)
+// 2. Creates DS records for parent zone delegation
+// 3. Signs all responses with RRSIG records
+// 4. Provides NSEC records for authenticated denial of existence
+
+// Register your handlers as normal - DNSSEC signing is automatic
+dnsServer.registerHandler('secure.example.com', ['A'], (question) => ({
+  name: question.name,
+  type: 'A',
+  class: 'IN',
+  ttl: 300,
+  data: '192.168.1.1',
+}));
+
+await dnsServer.start();
+
+// Query for DNSSEC records
+import { Smartdns } from '@push.rocks/smartdns/client';
+const client = new Smartdns({});
+const dnskeyRecords = await client.getRecords('secure.example.com', 'DNSKEY');
+const dsRecords = await client.getRecords('secure.example.com', 'DS');
+```
+
+#### Supported DNSSEC Algorithms
+
+The server supports multiple DNSSEC algorithms:
+- **ECDSAP256SHA256** (Algorithm 13) - Default, using P-256 curve
+- **ED25519** (Algorithm 15) - Modern elliptic curve algorithm
+- **RSASHA256** (Algorithm 8) - RSA-based signatures
+
+### Let's Encrypt Integration
+
+The DNS server includes built-in Let's Encrypt support for automatic SSL certificate management:
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+const dnsServer = new DnsServer({
+  udpPort: 53,
+  httpsPort: 443,
+  httpsKey: '/path/to/letsencrypt/key.pem',   // Will be auto-generated
+  httpsCert: '/path/to/letsencrypt/cert.pem', // Will be auto-generated
+});
+
+// Retrieve Let's Encrypt certificate for your domain
+const result = await dnsServer.retrieveSslCertificate(
+  ['secure.example.com', 'www.secure.example.com'],
+  {
+    email: 'admin@example.com',
+    staging: false,  // Use production Let's Encrypt
+    certDir: './certs'
+  }
+);
+
+if (result.success) {
+  console.log('Certificate retrieved successfully!');
+}
+
+// The server automatically:
+// 1. Handles ACME DNS-01 challenges
+// 2. Creates temporary TXT records for domain validation  
+// 3. Retrieves and installs the certificate
+// 4. Restarts the HTTPS server with the new certificate
+
+await dnsServer.start();
+console.log('DNS Server with Let\'s Encrypt SSL started!');
+```
+
+### Manual Socket Handling
+
+The DNS server supports manual socket handling for advanced use cases like clustering, load balancing, and custom transport implementations. You can control UDP and HTTPS socket handling independently.
+
+#### Configuration Options
+
+```typescript
+export interface IDnsServerOptions {
+  httpsKey: string;              // Path or content of HTTPS private key
+  httpsCert: string;             // Path or content of HTTPS certificate
+  httpsPort: number;             // Port for DNS-over-HTTPS
+  udpPort: number;               // Port for standard UDP DNS
+  dnssecZone: string;            // Zone name for DNSSEC signing
+  udpBindInterface?: string;     // IP address to bind UDP socket (default: '0.0.0.0')
+  httpsBindInterface?: string;   // IP address to bind HTTPS server (default: '0.0.0.0')
+  manualUdpMode?: boolean;       // Handle UDP sockets manually
+  manualHttpsMode?: boolean;     // Handle HTTPS sockets manually
+  primaryNameserver?: string;    // Primary nameserver for SOA records (default: 'ns1.{dnssecZone}')
+}
+```
+
+#### Basic Manual Socket Usage
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+import * as dgram from 'dgram';
+import * as net from 'net';
+
+// Create server with manual UDP mode
+const dnsServer = new DnsServer({
+  httpsKey: '...',
+  httpsCert: '...',
+  httpsPort: 853,
+  udpPort: 53,
+  dnssecZone: 'example.com',
+  manualUdpMode: true  // UDP manual, HTTPS automatic
+});
+
+await dnsServer.start(); // HTTPS binds, UDP doesn't
+
+// Create your own UDP socket
+const udpSocket = dgram.createSocket('udp4');
+
+// Handle incoming UDP messages
+udpSocket.on('message', (msg, rinfo) => {
+  dnsServer.handleUdpMessage(msg, rinfo, (response, responseRinfo) => {
+    // Send response using your socket
+    udpSocket.send(response, responseRinfo.port, responseRinfo.address);
+  });
+});
+
+// Bind to custom port or multiple interfaces
+udpSocket.bind(5353, '0.0.0.0');
+```
+
+#### Manual HTTPS Socket Handling
+
+```typescript
+// Create server with manual HTTPS mode
+const dnsServer = new DnsServer({
+  httpsKey: '...',
+  httpsCert: '...',
+  httpsPort: 853,
+  udpPort: 53,
+  dnssecZone: 'example.com',
+  manualHttpsMode: true  // HTTPS manual, UDP automatic
+});
+
+await dnsServer.start(); // UDP binds, HTTPS doesn't
+
+// Create your own TCP server
+const tcpServer = net.createServer((socket) => {
+  // Pass TCP sockets to DNS server
+  dnsServer.handleHttpsSocket(socket);
+});
+
+tcpServer.listen(8853, '0.0.0.0');
+```
+
+#### Full Manual Mode
+
+Control both protocols manually for complete flexibility:
+
+```typescript
+const dnsServer = new DnsServer({
+  httpsKey: '...',
+  httpsCert: '...',
+  httpsPort: 853,
+  udpPort: 53,
+  dnssecZone: 'example.com',
+  manualUdpMode: true,
+  manualHttpsMode: true
+});
+
+await dnsServer.start(); // Neither protocol binds
+
+// Set up your own socket handling for both protocols
+// Perfect for custom routing, load balancing, or clustering
+```
+
+#### Advanced Use Cases
+
+##### Load Balancing Across Multiple UDP Sockets
+
+```typescript
+// Create multiple UDP sockets for different CPU cores
+const sockets = [];
+const numCPUs = require('os').cpus().length;
+
+for (let i = 0; i < numCPUs; i++) {
+  const socket = dgram.createSocket({ 
+    type: 'udp4', 
+    reuseAddr: true  // Allow multiple sockets on same port
+  });
+  
+  socket.on('message', (msg, rinfo) => {
+    dnsServer.handleUdpMessage(msg, rinfo, (response, rinfo) => {
+      socket.send(response, rinfo.port, rinfo.address);
+    });
+  });
+  
+  socket.bind(53);
+  sockets.push(socket);
+}
+```
+
+##### Clustering with Worker Processes
+
+```typescript
+import cluster from 'cluster';
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+if (cluster.isPrimary) {
+  // Master process accepts connections
+  const server = net.createServer({ pauseOnConnect: true });
+  
+  // Distribute connections to workers
+  server.on('connection', (socket) => {
+    const worker = getNextWorker(); // Round-robin or custom logic
+    worker.send('socket', socket);
+  });
+  
+  server.listen(853);
+} else {
+  // Worker process handles DNS
+  const dnsServer = new DnsServer({
+    httpsKey: '...',
+    httpsCert: '...',
+    httpsPort: 853,
+    udpPort: 53,
+    dnssecZone: 'example.com',
+    manualHttpsMode: true
+  });
+  
+  process.on('message', (msg, socket) => {
+    if (msg === 'socket') {
+      dnsServer.handleHttpsSocket(socket);
+    }
+  });
+  
+  await dnsServer.start();
+}
+```
+
+##### Custom Transport Protocol
+
+```typescript
+// Use DNS server with custom transport (e.g., WebSocket)
+import WebSocket from 'ws';
+
+const wss = new WebSocket.Server({ port: 8080 });
+const dnsServer = new DnsServer({
+  httpsKey: '...',
+  httpsCert: '...',
+  httpsPort: 853,
+  udpPort: 53,
+  dnssecZone: 'example.com',
+  manualUdpMode: true,
+  manualHttpsMode: true
+});
+
+await dnsServer.start();
+
+wss.on('connection', (ws) => {
+  ws.on('message', (data) => {
+    // Process DNS query from WebSocket
+    const response = dnsServer.processRawDnsPacket(Buffer.from(data));
+    ws.send(response);
+  });
+});
+```
+
+##### Multi-Interface Binding
+
+```typescript
+// Bind to multiple network interfaces manually
+const interfaces = [
+  { address: '192.168.1.100', type: 'udp4' },
+  { address: '10.0.0.50', type: 'udp4' },
+  { address: '::1', type: 'udp6' }
+];
+
+interfaces.forEach(({ address, type }) => {
+  const socket = dgram.createSocket(type);
+  
+  socket.on('message', (msg, rinfo) => {
+    console.log(`Query received on ${address}`);
+    dnsServer.handleUdpMessage(msg, rinfo, (response, rinfo) => {
+      socket.send(response, rinfo.port, rinfo.address);
+    });
+  });
+  
+  socket.bind(53, address);
+});
+```
+
+### Handling Different Protocols
+
+#### UDP DNS Server
+
+Traditional DNS queries over UDP (port 53):
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+import * as plugins from '@push.rocks/smartdns/server/plugins';
+
+const dnsServer = new DnsServer({
+  udpPort: 5353,  // Using alternate port for testing
+  httpsPort: 8443,
+  httpsKey: fs.readFileSync('/path/to/key.pem', 'utf8'),
+  httpsCert: fs.readFileSync('/path/to/cert.pem', 'utf8'),
+  dnssecZone: 'test.local' // Optional
+});
+
+// The UDP server automatically handles DNS packet parsing and encoding
+dnsServer.registerHandler('test.local', ['A'], (question) => ({
+  name: question.name,
+  type: 'A', 
+  class: 'IN',
+  ttl: 60,
+  data: '127.0.0.1',
+}));
+
+await dnsServer.start();
+
+// Test with dig or nslookup:
+// dig @localhost -p 5353 test.local
+```
+
+#### DNS-over-HTTPS (DoH) Server
+
+Provide encrypted DNS queries over HTTPS:
+
+```typescript
+import { DnsServer } from '@push.rocks/smartdns/server';
+import * as fs from 'fs';
+
+const dnsServer = new DnsServer({
+  httpsPort: 8443,
+  httpsKey: fs.readFileSync('/path/to/key.pem', 'utf8'),
+  httpsCert: fs.readFileSync('/path/to/cert.pem', 'utf8'),
+});
+
+// The HTTPS server automatically handles:
+// - DNS wire format in POST body
+// - Proper Content-Type headers (application/dns-message)
+// - Base64url encoding for GET requests
+
+dnsServer.registerHandler('secure.local', ['A'], (question) => ({
+  name: question.name,
+  type: 'A',
+  class: 'IN', 
+  ttl: 300,
+  data: '10.0.0.1',
+}));
+
+await dnsServer.start();
+
+// Test with curl:
+// curl -H "Content-Type: application/dns-message" \
+//      --data-binary @query.bin \
+//      https://localhost:8443/dns-query
+```
+
+### Interface Binding
+
+For enhanced security and network isolation, you can bind the DNS server to specific network interfaces instead of all available interfaces.
+
+#### Localhost-Only Binding
+
+Bind to localhost for development or local-only DNS services:
+
+```typescript
+const localServer = new DnsServer({
+  udpPort: 5353,
+  httpsPort: 8443,
+  httpsKey: cert.key,
+  httpsCert: cert.cert,
+  dnssecZone: 'local.test',
+  udpBindInterface: '127.0.0.1',     // IPv4 localhost
+  httpsBindInterface: '127.0.0.1'
+});
+
+// Or use IPv6 localhost
+const ipv6LocalServer = new DnsServer({
+  // ... other options
+  udpBindInterface: '::1',           // IPv6 localhost
+  httpsBindInterface: '::1'
+});
+```
+
+#### Specific Interface Binding
+
+Bind to a specific network interface in multi-homed servers:
+
+```typescript
+const interfaceServer = new DnsServer({
+  udpPort: 53,
+  httpsPort: 443,
+  httpsKey: cert.key,
+  httpsCert: cert.cert,
+  dnssecZone: 'example.com',
+  udpBindInterface: '192.168.1.100',  // Specific internal interface
+  httpsBindInterface: '10.0.0.50'    // Different interface for HTTPS
+});
+```
+
+#### Security Considerations
+
+- **Default Behavior**: If not specified, servers bind to all interfaces (`0.0.0.0`)
+- **Localhost Binding**: Use `127.0.0.1` or `::1` for development and testing
+- **Production**: Consider binding to specific internal interfaces for security
+- **Validation**: Invalid IP addresses will throw an error during server startup
+
+### Advanced Handler Patterns
+
+#### Pattern-Based Routing
+
+Use glob patterns for flexible domain matching:
+
+```typescript
+// Match all subdomains
+dnsServer.registerHandler('*.example.com', ['A'], (question) => {
+  // Extract subdomain
+  const subdomain = question.name.replace('.example.com', '');
+  
+  // Dynamic response based on subdomain
+  return {
+    name: question.name,
+    type: 'A',
+    class: 'IN',
+    ttl: 300,
+    data: subdomain === 'api' ? '10.0.0.10' : '10.0.0.1',
+  };
+});
+
+// Match specific patterns
+dnsServer.registerHandler('db-*.service.local', ['A'], (question) => {
+  const instanceId = question.name.match(/db-(\d+)/)?.[1];
+  return {
+    name: question.name,
+    type: 'A',
+    class: 'IN',
+    ttl: 60,
+    data: `10.0.1.${instanceId}`,
+  };
+});
+
+// Catch-all handler
+dnsServer.registerHandler('*', ['A'], (question) => ({
+  name: question.name,
+  type: 'A', 
+  class: 'IN',
+  ttl: 300,
+  data: '127.0.0.1',
+}));
+```
+
+### Testing
+
+The library uses `@git.zone/tstest` for testing. Here's an example of comprehensive tests:
+
+```typescript
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { Smartdns } from '@push.rocks/smartdns/client';
+import { DnsServer } from '@push.rocks/smartdns/server';
+
+// Test DNS Client
+tap.test('DNS Client - Query Records', async () => {
+  const dnsClient = new Smartdns({});
+  
+  // Test A record query
+  const aRecords = await dnsClient.getRecordsA('google.com');
+  expect(aRecords).toBeArray();
+  expect(aRecords[0]).toHaveProperty('type', 'A');
+  expect(aRecords[0].data).toMatch(/^\d+\.\d+\.\d+\.\d+$/);
+  
+  // Test TXT record query
+  const txtRecords = await dnsClient.getRecordsTxt('google.com');
+  expect(txtRecords).toBeArray();
+  expect(txtRecords[0]).toHaveProperty('type', 'TXT');
+});
+
+// Test DNS Server
+let dnsServer: DnsServer;
+
+tap.test('DNS Server - Setup and Start', async () => {
+  dnsServer = new DnsServer({
+    udpPort: 5353,
+    httpsPort: 8443,
+    httpsKey: 'test-key',   // Use test certificates
+    httpsCert: 'test-cert',
+    dnssecZone: 'test.local'
+  });
+  
+  expect(dnsServer).toBeInstanceOf(DnsServer);
+  await dnsServer.start();
+});
+
+tap.test('DNS Server - Register Handlers', async () => {
+  // Register multiple handlers
+  dnsServer.registerHandler('test.local', ['A'], () => ({
+    name: 'test.local',
+    type: 'A',
+    class: 'IN',
+    ttl: 300,
+    data: '127.0.0.1',
+  }));
+  
+  dnsServer.registerHandler('*.test.local', ['A'], (question) => ({
+    name: question.name,
+    type: 'A', 
+    class: 'IN',
+    ttl: 60,
+    data: '127.0.0.2',
+  }));
+});
+
+tap.test('DNS Server - Query via UDP', async (tools) => {
+  const dnsPacket = (await import('dns-packet')).default;
+  const dgram = await import('dgram');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1234,
+    questions: [{
+      type: 'A',
+      class: 'IN', 
+      name: 'test.local',
+    }],
+  });
+  
+  const client = dgram.createSocket('udp4');
+  const done = tools.defer();
+  
+  client.on('message', (msg) => {
+    const response = dnsPacket.decode(msg);
+    expect(response.answers[0].data).toEqual('127.0.0.1');
+    client.close();
+    done.resolve();
+  });
+  
+  client.send(query, 5353, 'localhost'); // Use the port specified during server creation
+  await done.promise;
+});
+
+tap.test('DNS Server - Cleanup', async () => {
+  await dnsServer.stop();
+});
+
+// Run tests
+await tap.start();
+```
+
+### Best Practices
+
+1. **Port Selection**: Use non-privileged ports (>1024) during development
+2. **Handler Organization**: Group related handlers together
+3. **Error Handling**: Always handle DNS query errors gracefully
+4. **DNSSEC**: Enable DNSSEC for production deployments
+5. **Monitoring**: Log DNS queries for debugging and analytics
+6. **Rate Limiting**: Implement rate limiting for public DNS servers
+7. **Caching**: Respect TTL values and implement proper caching
+8. **Manual Sockets**: Use manual socket handling for clustering and load balancing
+
+### Performance Considerations
+
+- The DNS client uses HTTP keep-alive for connection reuse
+- The DNS server handles concurrent UDP and HTTPS requests efficiently
+- DNSSEC signatures are generated on-demand to reduce memory usage
+- Pattern matching uses caching for improved performance
+- Manual socket handling enables horizontal scaling across CPU cores
+
+### Security Considerations
+
+- Always use DNSSEC for authenticated responses
+- Enable DoH for encrypted DNS queries
+- Validate and sanitize all DNS inputs
+- Implement access controls for DNS server handlers
+- Use Let's Encrypt for automatic SSL certificate management
+- Never expose internal network information through DNS
+- Bind to specific interfaces in production environments
+- Use manual socket handling for custom security layers
+
+This comprehensive library provides everything needed for both DNS client operations and running production-grade DNS servers with modern security features in TypeScript.
+
+## License and Legal Information
+
+This repository contains open-source code that is licensed under the MIT License. A copy of the MIT License can be found in the [license](license.md) file within this repository. 
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH and are not included within the scope of the MIT license granted herein. Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines, and any usage must be approved in writing by Task Venture Capital GmbH.
+
+### Company Information
+
+Task Venture Capital GmbH  
+Registered at District court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or if you require further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

test/example.primaryns.ts

@@ -0,0 +1,123 @@
+import * as smartdns from '../ts_server/index.js';
+
+// Example: Using custom primary nameserver
+async function exampleCustomNameserver() {
+  const dnsServer = new smartdns.DnsServer({
+    httpsKey: 'your-https-key',
+    httpsCert: 'your-https-cert',
+    httpsPort: 8443,
+    udpPort: 8053,
+    dnssecZone: 'example.com',
+    // Custom primary nameserver for SOA records
+    primaryNameserver: 'ns-primary.example.com',
+  });
+
+  // Register some handlers
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns-primary.example.com',
+    };
+  });
+
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns-secondary.example.com',
+    };
+  });
+
+  await dnsServer.start();
+  console.log('DNS server started with custom primary nameserver');
+  
+  // SOA records will now use 'ns-primary.example.com' instead of 'ns1.example.com'
+}
+
+// Example: DNSSEC with multiple records (proper RRset signing)
+async function exampleDnssecMultipleRecords() {
+  const dnsServer = new smartdns.DnsServer({
+    httpsKey: 'your-https-key',
+    httpsCert: 'your-https-cert',
+    httpsPort: 8443,
+    udpPort: 8053,
+    dnssecZone: 'secure.example.com',
+  });
+
+  // Register multiple A records for round-robin
+  const ips = ['192.168.1.10', '192.168.1.11', '192.168.1.12'];
+  for (const ip of ips) {
+    dnsServer.registerHandler('www.secure.example.com', ['A'], (question) => {
+      return {
+        name: question.name,
+        type: 'A',
+        class: 'IN',
+        ttl: 300,
+        data: ip,
+      };
+    });
+  }
+
+  await dnsServer.start();
+  console.log('DNS server started with DNSSEC and multiple A records');
+  
+  // When queried with DNSSEC enabled, all 3 A records will be signed together
+  // as a single RRset with one RRSIG record (not 3 separate RRSIGs)
+}
+
+// Example: Multiple TXT records for various purposes
+async function exampleMultipleTxtRecords() {
+  const dnsServer = new smartdns.DnsServer({
+    httpsKey: 'your-https-key',
+    httpsCert: 'your-https-cert',
+    httpsPort: 8443,
+    udpPort: 8053,
+    dnssecZone: 'example.com',
+  });
+
+  // SPF record
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['v=spf1 include:_spf.google.com ~all'],
+    };
+  });
+
+  // DKIM record
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4...'],
+    };
+  });
+
+  // Domain verification
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['google-site-verification=1234567890abcdef'],
+    };
+  });
+
+  await dnsServer.start();
+  console.log('DNS server started with multiple TXT records');
+  
+  // All TXT records will be returned when queried
+}
+
+// Export examples for reference
+export { exampleCustomNameserver, exampleDnssecMultipleRecords, exampleMultipleTxtRecords };

test/test.client.ts

@@ -0,0 +1,78 @@
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+
+import * as smartdns from '../ts_client/index.js';
+
+let testDnsClient: smartdns.Smartdns;
+
+tap.test('should create an instance of Dnsly', async () => {
+  testDnsClient = new smartdns.Smartdns({});
+  expect(testDnsClient).toBeInstanceOf(smartdns.Smartdns);
+});
+
+tap.test('should get an A DNS Record', async () => {
+  const records = await testDnsClient.getRecordsA('google.com');
+  expect(records).toBeInstanceOf(Array);
+  expect(records.length).toBeGreaterThan(0);
+  expect(records[0]).toHaveProperty('name', 'google.com');
+  expect(records[0]).toHaveProperty('type', 'A');
+  expect(records[0]).toHaveProperty('value');
+  expect(records[0]).toHaveProperty('dnsSecEnabled');
+});
+
+tap.test('should get an AAAA Record', async () => {
+  const records = await testDnsClient.getRecordsAAAA('google.com');
+  expect(records).toBeInstanceOf(Array);
+  expect(records.length).toBeGreaterThan(0);
+  expect(records[0]).toHaveProperty('name', 'google.com');
+  expect(records[0]).toHaveProperty('type', 'AAAA');
+  expect(records[0]).toHaveProperty('value');
+  expect(records[0]).toHaveProperty('dnsSecEnabled');
+});
+
+tap.test('should get a txt record', async () => {
+  const records = await testDnsClient.getRecordsTxt('google.com');
+  expect(records).toBeInstanceOf(Array);
+  expect(records.length).toBeGreaterThan(0);
+  expect(records[0]).toHaveProperty('name', 'google.com');
+  expect(records[0]).toHaveProperty('type', 'TXT');
+  expect(records[0]).toHaveProperty('value');
+  expect(records[0]).toHaveProperty('dnsSecEnabled');
+});
+
+tap.test('should, get a mx record for a domain', async () => {
+  const res = await testDnsClient.getRecords('bleu.de', 'MX');
+  console.log(res);
+});
+
+tap.test('should check until DNS is available', async () => {
+  const records = await testDnsClient.getRecordsTxt('google.com');
+  if (records.length > 0) {
+    const result = await testDnsClient.checkUntilAvailable('google.com', 'TXT', records[0].value);
+    expect(result).toBeTrue();
+  }
+});
+
+tap.test('should check until DNS is available an return false if it fails', async () => {
+  return expect(
+    await testDnsClient.checkUntilAvailable('google.com', 'TXT', 'this-txt-record-does-not-exist')
+  ).toBeFalse();
+});
+
+tap.test('should check until DNS is available an return false if it fails', async () => {
+  return expect(
+    await testDnsClient.checkUntilAvailable('nonexistent.example.com', 'TXT', 'sometext_txt2')
+  ).toBeFalse();
+});
+
+tap.test('should get name server for hostname', async () => {
+  let result = await testDnsClient.getNameServers('bleu.de');
+  console.log(result);
+});
+
+tap.test('should detect dns sec', async () => {
+  const result = await testDnsClient.getRecordsA('lossless.com');
+  console.log(result[0]);
+  expect(result[0].dnsSecEnabled).toBeTrue();
+});
+
+export default tap.start();

test/test.d.ts

@@ -1 +0,0 @@
-import 'typings-test';

test/test.dnssec.rrset.ts

@@ -0,0 +1,373 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8500;
+let nextUdpPort = 8501;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('DNSSEC should sign entire RRset together, not individual records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple NS record handlers
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns1.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns2.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns3.example.com',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Create query with DNSSEC requested
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit set for DNSSEC
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  // Count NS and RRSIG records
+  const nsAnswers = dnsResponse.answers.filter(a => a.type === 'NS');
+  const rrsigAnswers = dnsResponse.answers.filter(a => a.type === 'RRSIG');
+  
+  console.log('NS records returned:', nsAnswers.length);
+  console.log('RRSIG records returned:', rrsigAnswers.length);
+  
+  // Should have 3 NS records and only 1 RRSIG for the entire RRset
+  expect(nsAnswers.length).toEqual(3);
+  expect(rrsigAnswers.length).toEqual(1);
+  
+  // Verify RRSIG covers NS type
+  const rrsigData = (rrsigAnswers[0] as any).data;
+  expect(rrsigData.typeCovered).toEqual('NS');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('SOA records should be properly serialized and returned', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Query for a non-existent subdomain to trigger SOA response
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  // Should have SOA record in response
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('SOA record:', soaData);
+  
+  expect(soaData.mname).toEqual('ns1.example.com');
+  expect(soaData.rname).toEqual('hostmaster.example.com');
+  expect(typeof soaData.serial).toEqual('number');
+  expect(soaData.refresh).toEqual(3600);
+  expect(soaData.retry).toEqual(600);
+  expect(soaData.expire).toEqual(604800);
+  expect(soaData.minimum).toEqual(86400);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Primary nameserver should be configurable', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+    primaryNameserver: 'custom-ns.example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Query for SOA record
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'SOA',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  // Should have SOA record with custom nameserver
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('SOA mname:', soaData.mname);
+  
+  // Should use the custom primary nameserver
+  expect(soaData.mname).toEqual('custom-ns.example.com');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Multiple A records should have single RRSIG when DNSSEC is enabled', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple A records for round-robin
+  const ips = ['10.0.0.1', '10.0.0.2', '10.0.0.3'];
+  for (const ip of ips) {
+    dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+      return {
+        name: question.name,
+        type: 'A',
+        class: 'IN',
+        ttl: 300,
+        data: ip,
+      };
+    });
+  }
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 4,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'www.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit set for DNSSEC
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  const aAnswers = dnsResponse.answers.filter(a => a.type === 'A');
+  const rrsigAnswers = dnsResponse.answers.filter(a => a.type === 'RRSIG');
+  
+  console.log('A records:', aAnswers.length);
+  console.log('RRSIG records:', rrsigAnswers.length);
+  
+  // Should have 3 A records and only 1 RRSIG
+  expect(aAnswers.length).toEqual(3);
+  expect(rrsigAnswers.length).toEqual(1);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.fixes.simple.ts

@@ -0,0 +1,228 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8600;
+let nextUdpPort = 8601;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('SOA records should be returned for non-existent domains', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('✅ SOA response received');
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('✅ SOA mname:', soaData.mname);
+  console.log('✅ SOA rname:', soaData.rname);
+  
+  expect(soaData.mname).toEqual('ns1.example.com');
+  expect(soaData.rname).toEqual('hostmaster.example.com');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Primary nameserver should be configurable', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+    primaryNameserver: 'custom-ns.example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('✅ Custom primary nameserver:', soaData.mname);
+  
+  expect(soaData.mname).toEqual('custom-ns.example.com');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Default primary nameserver with FQDN', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+    primaryNameserver: 'ns.example.com.',  // FQDN with trailing dot
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('✅ FQDN primary nameserver:', soaData.mname);
+  
+  expect(soaData.mname).toEqual('ns.example.com.');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.js

@@ -1,54 +0,0 @@
-"use strict";
-require("typings-test");
-const smartchai_1 = require("smartchai");
-const dnsly = require("../dist/index");
-let testDnsly;
-describe('dnsly', function () {
-    it('should create an instance of Dnsly', function () {
-        testDnsly = new dnsly.Dnsly('google');
-        smartchai_1.expect(testDnsly).to.be.instanceOf(dnsly.Dnsly);
-    });
-    it('should get an A DNS Record', function () {
-        return smartchai_1.expect(testDnsly.getRecordA('dnsly_a.bleu.de')).to.eventually.deep.equal([{
-                name: 'dnsly_a.bleu.de',
-                value: '127.0.0.1',
-                type: 'A'
-            }]);
-    });
-    it('should get an AAAA Record', function () {
-        return smartchai_1.expect(testDnsly.getRecordAAAA('dnsly_aaaa.bleu.de')).to.eventually.deep.equal([{
-                name: 'dnsly_aaaa.bleu.de',
-                value: '::1',
-                type: 'AAAA'
-            }]);
-    });
-    it('should get a txt record', function () {
-        return smartchai_1.expect(testDnsly.getRecordTxt('dnsly_txt.bleu.de')).to.eventually.deep.equal([{
-                chunked: ['sometext_txt'],
-                name: 'dnsly_txt.bleu.de',
-                value: 'sometext_txt',
-                type: 'TXT'
-            }]);
-    });
-    it('should, get a mx record for a domain', function (done) {
-        testDnsly.getRecord('google.com', 'MX').then(res => {
-            console.log(res);
-            done();
-        }).catch(err => {
-            console.log(err);
-            done(err);
-        });
-    });
-    it('should check until DNS is available', function () {
-        return smartchai_1.expect(testDnsly.checkUntilAvailable('dnsly_txt.bleu.de', 'TXT', 'sometext_txt')).to.eventually.be.true;
-    });
-    it('should check until DNS is available an return false if it fails', function () {
-        this.timeout(30000);
-        return smartchai_1.expect(testDnsly.checkUntilAvailable('dnsly_txt.bleu.de', 'TXT', 'sometext_txt2')).to.eventually.be.false;
-    });
-    it('should check until DNS is available an return false if it fails', function () {
-        this.timeout(30000);
-        return smartchai_1.expect(testDnsly.checkUntilAvailable('dnsly_txtNotThere.bleu.de', 'TXT', 'sometext_txt2')).to.eventually.be.false;
-    });
-});
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidGVzdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbInRlc3QudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IjtBQUFBLHdCQUFxQjtBQUNyQix5Q0FBa0M7QUFFbEMsdUNBQXNDO0FBRXRDLElBQUksU0FBc0IsQ0FBQTtBQUUxQixRQUFRLENBQUMsT0FBTyxFQUFFO0lBQ2QsRUFBRSxDQUFDLG9DQUFvQyxFQUFFO1FBQ3JDLFNBQVMsR0FBRyxJQUFJLEtBQUssQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLENBQUE7UUFDckMsa0JBQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxFQUFFLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUE7SUFDbkQsQ0FBQyxDQUFDLENBQUE7SUFFRixFQUFFLENBQUMsNEJBQTRCLEVBQUU7UUFDN0IsTUFBTSxDQUFDLGtCQUFNLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzdFLElBQUksRUFBRSxpQkFBaUI7Z0JBQ3ZCLEtBQUssRUFBRyxXQUFXO2dCQUNuQixJQUFJLEVBQUUsR0FBRzthQUNaLENBQUMsQ0FBQyxDQUFBO0lBQ1AsQ0FBQyxDQUFDLENBQUE7SUFFRixFQUFFLENBQUMsMkJBQTJCLEVBQUU7UUFDNUIsTUFBTSxDQUFDLGtCQUFNLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQ25GLElBQUksRUFBRSxvQkFBb0I7Z0JBQzFCLEtBQUssRUFBRyxLQUFLO2dCQUNiLElBQUksRUFBRSxNQUFNO2FBQ2YsQ0FBQyxDQUFDLENBQUE7SUFDUCxDQUFDLENBQUMsQ0FBQTtJQUVGLEVBQUUsQ0FBQyx5QkFBeUIsRUFBRTtRQUMxQixNQUFNLENBQUMsa0JBQU0sQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDakYsT0FBTyxFQUFFLENBQUMsY0FBYyxDQUFDO2dCQUN6QixJQUFJLEVBQUUsbUJBQW1CO2dCQUN6QixLQUFLLEVBQUUsY0FBYztnQkFDckIsSUFBSSxFQUFFLEtBQUs7YUFDZCxDQUFDLENBQUMsQ0FBQTtJQUNQLENBQUMsQ0FBQyxDQUFBO0lBRUYsRUFBRSxDQUFDLHNDQUFzQyxFQUFFLFVBQVUsSUFBSTtRQUNyRCxTQUFTLENBQUMsU0FBUyxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRztZQUM1QyxPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1lBQ2hCLElBQUksRUFBRSxDQUFBO1FBQ1YsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUc7WUFDUixPQUFPLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFBO1lBQ2hCLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQTtRQUNiLENBQUMsQ0FBQyxDQUFBO0lBRU4sQ0FBQyxDQUFDLENBQUE7SUFFRixFQUFFLENBQUMscUNBQXFDLEVBQUU7UUFDdEMsTUFBTSxDQUFDLGtCQUFNLENBQUMsU0FBUyxDQUFDLG1CQUFtQixDQUFDLG1CQUFtQixFQUFDLEtBQUssRUFBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQTtJQUNoSCxDQUFDLENBQUMsQ0FBQTtJQUVGLEVBQUUsQ0FBQyxpRUFBaUUsRUFBRTtRQUNsRSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFBO1FBQ25CLE1BQU0sQ0FBQyxrQkFBTSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxtQkFBbUIsRUFBQyxLQUFLLEVBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUE7SUFDbEgsQ0FBQyxDQUFDLENBQUE7SUFFRixFQUFFLENBQUMsaUVBQWlFLEVBQUU7UUFDbEUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQTtRQUNuQixNQUFNLENBQUMsa0JBQU0sQ0FDVCxTQUFTLENBQUMsbUJBQW1CLENBQUMsMkJBQTJCLEVBQUMsS0FBSyxFQUFDLGVBQWUsQ0FBQyxDQUNuRixDQUFDLEVBQUUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDLEtBQUssQ0FBQTtJQUM1QixDQUFDLENBQUMsQ0FBQTtBQUNOLENBQUMsQ0FBQyxDQUFBIn0=

test/test.multiplerecords.fixed.ts

@@ -0,0 +1,485 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8300;
+let nextUdpPort = 8301;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    const stopPromise = server.stop();
+    const timeoutPromise = new Promise((_, reject) => {
+      setTimeout(() => reject(new Error('Stop operation timed out')), 5000);
+    });
+    
+    await Promise.race([stopPromise, timeoutPromise]);
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+    
+    // Force close if normal stop fails
+    try {
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.httpsServer) {
+        (server as any).httpsServer.close();
+        (server as any).httpsServer = null;
+      }
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.udpServer) {
+        (server as any).udpServer.close();
+        (server as any).udpServer = null;
+      }
+    } catch (forceError) {
+      console.log('Force cleanup error:', forceError.message || forceError);
+    }
+  }
+}
+
+tap.test('should now return multiple NS records after fix', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple NS record handlers for the same domain
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    console.log('First NS handler called');
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns1.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    console.log('Second NS handler called');
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns2.example.com',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Fixed behavior - NS records returned:', dnsResponse.answers.length);
+  console.log('NS records:', dnsResponse.answers.filter(a => a.type === 'NS').map(a => a.data));
+  
+  // FIXED BEHAVIOR: Should now return both NS records
+  const nsAnswers = dnsResponse.answers.filter(a => a.type === 'NS');
+  expect(nsAnswers.length).toEqual(2);
+  expect(nsAnswers.map(a => a.data).sort()).toEqual(['ns1.example.com', 'ns2.example.com']);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should support round-robin DNS with multiple A records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple A record handlers for round-robin DNS
+  const ips = ['10.0.0.1', '10.0.0.2', '10.0.0.3'];
+  for (const ip of ips) {
+    dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+      console.log(`A handler for ${ip} called`);
+      return {
+        name: question.name,
+        type: 'A',
+        class: 'IN',
+        ttl: 300,
+        data: ip,
+      };
+    });
+  }
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'www.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Fixed behavior - A records returned:', dnsResponse.answers.length);
+  console.log('A records:', dnsResponse.answers.filter(a => a.type === 'A').map(a => a.data));
+  
+  // FIXED BEHAVIOR: Should return all A records for round-robin
+  const aAnswers = dnsResponse.answers.filter(a => a.type === 'A');
+  expect(aAnswers.length).toEqual(3);
+  expect(aAnswers.map(a => a.data).sort()).toEqual(['10.0.0.1', '10.0.0.2', '10.0.0.3']);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should return multiple TXT records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple TXT record handlers
+  const txtRecords = [
+    ['v=spf1 include:_spf.example.com ~all'],
+    ['v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNA...'],
+    ['google-site-verification=1234567890abcdef']
+  ];
+  
+  for (const data of txtRecords) {
+    dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+      console.log(`TXT handler for ${data[0].substring(0, 20)}... called`);
+      return {
+        name: question.name,
+        type: 'TXT',
+        class: 'IN',
+        ttl: 3600,
+        data: data,
+      };
+    });
+  }
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'TXT',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Fixed behavior - TXT records returned:', dnsResponse.answers.length);
+  const txtAnswers = dnsResponse.answers.filter(a => a.type === 'TXT');
+  console.log('TXT records count:', txtAnswers.length);
+  
+  // FIXED BEHAVIOR: Should return all TXT records
+  expect(txtAnswers.length).toEqual(3);
+  
+  // Check that all expected records are present
+  const txtData = txtAnswers.map(a => a.data[0].toString());
+  expect(txtData.some(d => d.includes('spf1'))).toEqual(true);
+  expect(txtData.some(d => d.includes('DKIM1'))).toEqual(true);
+  expect(txtData.some(d => d.includes('google-site-verification'))).toEqual(true);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should handle DNSSEC correctly with multiple records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple NS record handlers
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns1.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns2.example.com',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Create query with DNSSEC requested
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 4,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit set for DNSSEC
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('DNSSEC response - total answers:', dnsResponse.answers.length);
+  
+  const nsAnswers = dnsResponse.answers.filter(a => a.type === 'NS');
+  const rrsigAnswers = dnsResponse.answers.filter(a => a.type === 'RRSIG');
+  
+  console.log('NS records:', nsAnswers.length);
+  console.log('RRSIG records:', rrsigAnswers.length);
+  
+  // With DNSSEC RRset signing, all NS records share ONE RRSIG (entire RRset signed together)
+  expect(nsAnswers.length).toEqual(2);
+  expect(rrsigAnswers.length).toEqual(1);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should not return duplicate records when same handler registered multiple times', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register the same handler multiple times (edge case)
+  const sameHandler = (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '10.0.0.1',
+    };
+  };
+  
+  dnsServer.registerHandler('test.example.com', ['A'], sameHandler);
+  dnsServer.registerHandler('test.example.com', ['A'], sameHandler);
+  dnsServer.registerHandler('test.example.com', ['A'], sameHandler);
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 5,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'test.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  const aAnswers = dnsResponse.answers.filter(a => a.type === 'A');
+  console.log('Duplicate handler test - A records returned:', aAnswers.length);
+  
+  // Even though handler is registered 3 times, we get 3 identical records
+  // This is expected behavior - the DNS server doesn't deduplicate
+  expect(aAnswers.length).toEqual(3);
+  expect(aAnswers.every(a => a.data === '10.0.0.1')).toEqual(true);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.multiplerecords.simple.ts

@@ -0,0 +1,279 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8400;
+let nextUdpPort = 8401;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('Multiple NS records should work correctly', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple NS record handlers
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns1.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns2.example.com',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('✅ NS records returned:', dnsResponse.answers.length);
+  console.log('✅ NS records:', dnsResponse.answers.map(a => (a as any).data));
+  
+  // SUCCESS: Multiple NS records are now returned
+  expect(dnsResponse.answers.length).toEqual(2);
+  expect(dnsResponse.answers.map(a => (a as any).data).sort()).toEqual(['ns1.example.com', 'ns2.example.com']);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Multiple A records for round-robin DNS', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple A records
+  const ips = ['10.0.0.1', '10.0.0.2', '10.0.0.3'];
+  for (const ip of ips) {
+    dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+      return {
+        name: question.name,
+        type: 'A',
+        class: 'IN',
+        ttl: 300,
+        data: ip,
+      };
+    });
+  }
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'www.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('✅ A records returned:', dnsResponse.answers.length);
+  console.log('✅ A records:', dnsResponse.answers.map(a => (a as any).data));
+  
+  // SUCCESS: All A records for round-robin DNS
+  expect(dnsResponse.answers.length).toEqual(3);
+  expect(dnsResponse.answers.map(a => (a as any).data).sort()).toEqual(['10.0.0.1', '10.0.0.2', '10.0.0.3']);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Multiple TXT records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple TXT records
+  const txtRecords = [
+    ['v=spf1 include:_spf.example.com ~all'],
+    ['v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNA...'],
+    ['google-site-verification=1234567890abcdef']
+  ];
+  
+  for (const data of txtRecords) {
+    dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+      return {
+        name: question.name,
+        type: 'TXT',
+        class: 'IN',
+        ttl: 3600,
+        data: data,
+      };
+    });
+  }
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'TXT',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('✅ TXT records returned:', dnsResponse.answers.length);
+  
+  // SUCCESS: All TXT records are returned
+  expect(dnsResponse.answers.length).toEqual(3);
+  
+  const txtData = dnsResponse.answers.map(a => (a as any).data[0].toString());
+  expect(txtData.some(d => d.includes('spf1'))).toEqual(true);
+  expect(txtData.some(d => d.includes('DKIM1'))).toEqual(true);
+  expect(txtData.some(d => d.includes('google-site-verification'))).toEqual(true);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.multiplerecords.ts

@@ -0,0 +1,419 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8200;
+let nextUdpPort = 8201;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    const stopPromise = server.stop();
+    const timeoutPromise = new Promise((_, reject) => {
+      setTimeout(() => reject(new Error('Stop operation timed out')), 5000);
+    });
+    
+    await Promise.race([stopPromise, timeoutPromise]);
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+    
+    // Force close if normal stop fails
+    try {
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.httpsServer) {
+        (server as any).httpsServer.close();
+        (server as any).httpsServer = null;
+      }
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.udpServer) {
+        (server as any).udpServer.close();
+        (server as any).udpServer = null;
+      }
+    } catch (forceError) {
+      console.log('Force cleanup error:', forceError.message || forceError);
+    }
+  }
+}
+
+tap.test('should demonstrate the current limitation with multiple NS records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple NS record handlers for the same domain
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    console.log('First NS handler called');
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns1.example.com',
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    console.log('Second NS handler called');
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: 'ns2.example.com',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Current behavior - NS records returned:', dnsResponse.answers.length);
+  console.log('NS records:', dnsResponse.answers.map(a => (a as any).data));
+  
+  // CURRENT BEHAVIOR: Only returns 1 NS record due to the break statement
+  expect(dnsResponse.answers.length).toEqual(1);
+  expect((dnsResponse.answers[0] as any).data).toEqual('ns1.example.com');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should demonstrate the limitation with multiple A records (round-robin)', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple A record handlers for round-robin DNS
+  dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+    console.log('First A handler called');
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '10.0.0.1',
+    };
+  });
+  
+  dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+    console.log('Second A handler called');
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '10.0.0.2',
+    };
+  });
+  
+  dnsServer.registerHandler('www.example.com', ['A'], (question) => {
+    console.log('Third A handler called');
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '10.0.0.3',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'www.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Current behavior - A records returned:', dnsResponse.answers.length);
+  console.log('A records:', dnsResponse.answers.map(a => (a as any).data));
+  
+  // CURRENT BEHAVIOR: Only returns 1 A record, preventing round-robin DNS
+  expect(dnsResponse.answers.length).toEqual(1);
+  expect((dnsResponse.answers[0] as any).data).toEqual('10.0.0.1');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should demonstrate the limitation with multiple TXT records', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register multiple TXT record handlers
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    console.log('SPF handler called');
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['v=spf1 include:_spf.example.com ~all'],
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    console.log('DKIM handler called');
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNA...'],
+    };
+  });
+  
+  dnsServer.registerHandler('example.com', ['TXT'], (question) => {
+    console.log('Domain verification handler called');
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 3600,
+      data: ['google-site-verification=1234567890abcdef'],
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'TXT',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  
+  console.log('Current behavior - TXT records returned:', dnsResponse.answers.length);
+  console.log('TXT records:', dnsResponse.answers.map(a => (a as any).data));
+  
+  // CURRENT BEHAVIOR: Only returns 1 TXT record instead of all 3
+  expect(dnsResponse.answers.length).toEqual(1);
+  expect((dnsResponse.answers[0] as any).data[0]).toInclude('spf1');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should show the current workaround pattern', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // WORKAROUND: Create an array to store NS records and return them from a single handler
+  const nsRecords = ['ns1.example.com', 'ns2.example.com'];
+  let nsIndex = 0;
+  
+  // This workaround still doesn't solve the problem because only one handler executes
+  dnsServer.registerHandler('example.com', ['NS'], (question) => {
+    const record = nsRecords[nsIndex % nsRecords.length];
+    nsIndex++;
+    return {
+      name: question.name,
+      type: 'NS',
+      class: 'IN',
+      ttl: 3600,
+      data: record,
+    };
+  });
+  
+  await dnsServer.start();
+  
+  // Make two queries to show the workaround behavior
+  const client1 = dgram.createSocket('udp4');
+  const client2 = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 4,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'NS',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise1 = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client1.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client1.close();
+    });
+    
+    client1.send(query, udpPort, 'localhost');
+  });
+  
+  const responsePromise2 = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client2.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client2.close();
+    });
+    
+    setTimeout(() => {
+      client2.send(query, udpPort, 'localhost');
+    }, 100);
+  });
+  
+  const [response1, response2] = await Promise.all([responsePromise1, responsePromise2]);
+  
+  console.log('First query NS:', (response1.answers[0] as any).data);
+  console.log('Second query NS:', (response2.answers[0] as any).data);
+  
+  // This workaround rotates between records but still only returns one at a time
+  expect(response1.answers.length).toEqual(1);
+  expect(response2.answers.length).toEqual(1);
+  expect((response1.answers[0] as any).data).toEqual('ns1.example.com');
+  expect((response2.answers[0] as any).data).toEqual('ns2.example.com');
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.server.ts

@@ -0,0 +1,778 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import { execSync } from 'child_process';
+
+import * as dnsPacket from 'dns-packet';
+import * as https from 'https';
+import * as dgram from 'dgram';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+import * as smartdns from '../ts_server/index.js';
+
+// Generate a real self-signed certificate using OpenSSL
+function generateSelfSignedCert() {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'cert-'));
+  const keyPath = path.join(tmpDir, 'key.pem');
+  const certPath = path.join(tmpDir, 'cert.pem');
+  
+  try {
+    // Generate private key
+    execSync(`openssl genrsa -out "${keyPath}" 2048`);
+    
+    // Generate self-signed certificate
+    execSync(
+      `openssl req -new -x509 -key "${keyPath}" -out "${certPath}" -days 365 -subj "/C=US/ST=State/L=City/O=Organization/CN=test.example.com"`
+    );
+    
+    // Read the files
+    const privateKey = fs.readFileSync(keyPath, 'utf8');
+    const cert = fs.readFileSync(certPath, 'utf8');
+    
+    return { key: privateKey, cert };
+  } catch (error) {
+    console.error('Error generating certificate:', error);
+    throw error;
+  } finally {
+    // Clean up temporary files
+    try {
+      if (fs.existsSync(keyPath)) fs.unlinkSync(keyPath);
+      if (fs.existsSync(certPath)) fs.unlinkSync(certPath);
+      if (fs.existsSync(tmpDir)) fs.rmdirSync(tmpDir);
+    } catch (err) {
+      console.error('Error cleaning up temporary files:', err);
+    }
+  }
+}
+
+// Cache the generated certificate for performance
+let cachedCert = null;
+
+// Helper function to get certificate
+function getTestCertificate() {
+  if (!cachedCert) {
+    cachedCert = generateSelfSignedCert();
+  }
+  return cachedCert;
+}
+
+// Mock for acme-client directly imported as a module
+const acmeClientMock = {
+  Client: class {
+    constructor() {}
+    
+    createAccount() {
+      return Promise.resolve({});
+    }
+    
+    createOrder() {
+      return Promise.resolve({
+        authorizations: ['auth1', 'auth2']
+      });
+    }
+    
+    getAuthorizations() {
+      return Promise.resolve([
+        {
+          identifier: { value: 'test.bleu.de' },
+          challenges: [
+            { type: 'dns-01', url: 'https://example.com/challenge' }
+          ]
+        }
+      ]);
+    }
+    
+    getChallengeKeyAuthorization() {
+      return Promise.resolve('test_key_authorization');
+    }
+    
+    completeChallenge() {
+      return Promise.resolve({});
+    }
+    
+    waitForValidStatus() {
+      return Promise.resolve({});
+    }
+    
+    finalizeOrder() {
+      return Promise.resolve({});
+    }
+    
+    getCertificate() {
+      // Use a real certificate
+      const { cert } = getTestCertificate();
+      return Promise.resolve(cert);
+    }
+  },
+  
+  forge: {
+    createCsr({commonName, altNames}) {
+      return Promise.resolve({
+        csr: Buffer.from('mock-csr-data')
+      });
+    }
+  },
+  
+  directory: {
+    letsencrypt: {
+      staging: 'https://acme-staging-v02.api.letsencrypt.org/directory',
+      production: 'https://acme-v02.api.letsencrypt.org/directory'
+    }
+  }
+};
+
+// Override generateKeyPairSync to use our test key for certificate generation in tests
+const originalGenerateKeyPairSync = plugins.crypto.generateKeyPairSync;
+plugins.crypto.generateKeyPairSync = function(type, options) {
+  if (type === 'rsa' && 
+      options?.modulusLength === 2048 && 
+      options?.privateKeyEncoding?.type === 'pkcs8') {
+    
+    // Get the test certificate key if we're in the retrieveSslCertificate method
+    try {
+      const stack = new Error().stack || '';
+      if (stack.includes('retrieveSslCertificate')) {
+        const { key } = getTestCertificate();
+        return { privateKey: key, publicKey: 'TEST_PUBLIC_KEY' };
+      }
+    } catch (e) {
+      // Fall back to original function if error occurs
+    }
+  }
+  
+  // Use the original function for other cases
+  return originalGenerateKeyPairSync.apply(this, arguments);
+};
+
+let dnsServer: smartdns.DnsServer;
+const testCertDir = path.join(process.cwd(), 'test-certs');
+
+// Helper to clean up test certificate directory
+function cleanCertDir() {
+  if (fs.existsSync(testCertDir)) {
+    const files = fs.readdirSync(testCertDir);
+    for (const file of files) {
+      fs.unlinkSync(path.join(testCertDir, file));
+    }
+    fs.rmdirSync(testCertDir);
+  }
+}
+
+// Port management for tests
+let nextHttpsPort = 8080;
+let nextUdpPort = 8081;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers - more robust implementation
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return; // Nothing to do if server doesn't exist
+  }
+  
+  try {
+    // Set a timeout for stop operation
+    const stopPromise = server.stop();
+    const timeoutPromise = new Promise((_, reject) => {
+      setTimeout(() => reject(new Error('Stop operation timed out')), 5000);
+    });
+    
+    await Promise.race([stopPromise, timeoutPromise]);
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+    
+    // Force close if normal stop fails
+    try {
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.httpsServer) {
+        (server as any).httpsServer.close();
+        (server as any).httpsServer = null;
+      }
+      // @ts-ignore - accessing private properties for emergency cleanup
+      if (server.udpServer) {
+        (server as any).udpServer.close();
+        (server as any).udpServer = null;
+      }
+    } catch (forceError) {
+      console.log('Force cleanup error:', forceError.message || forceError);
+    }
+  }
+}
+
+// Setup and teardown
+tap.test('setup', async () => {
+  cleanCertDir();
+  // Reset dnsServer to null at the start
+  dnsServer = null;
+  // Reset certificate cache
+  cachedCert = null;
+});
+
+tap.test('teardown', async () => {
+  // Stop the server if it exists
+  await stopServer(dnsServer);
+  dnsServer = null;
+  
+  cleanCertDir();
+  // Reset certificate cache
+  cachedCert = null;
+});
+
+tap.test('should create an instance of DnsServer', async () => {
+  // Use valid options
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8080,
+    udpPort: 8081,
+    dnssecZone: 'example.com',
+  });
+  expect(dnsServer).toBeInstanceOf(smartdns.DnsServer);
+});
+
+tap.test('should start the server', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  // @ts-ignore - accessing private property for testing
+  expect(dnsServer.httpsServer).toBeDefined();
+  
+  // Stop the server at the end of this test
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('lets add a handler', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8080,
+    udpPort: 8081,
+    dnssecZone: 'example.com',
+  });
+
+  dnsServer.registerHandler('*.bleu.de', ['A'], (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '127.0.0.1',
+    };
+  });
+
+  // @ts-ignore - accessing private method for testing
+  const response = dnsServer.processDnsRequest({
+    type: 'query',
+    id: 1,
+    flags: 0,
+    questions: [
+      {
+        name: 'dnsly_a.bleu.de',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+    answers: [],
+  });
+  expect(response.answers[0]).toEqual({
+    name: 'dnsly_a.bleu.de',
+    type: 'A',
+    class: 'IN',
+    ttl: 300,
+    data: '127.0.0.1',
+  });
+});
+
+tap.test('should unregister a handler', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8080,
+    udpPort: 8081,
+    dnssecZone: 'example.com',
+  });
+
+  // Register handlers
+  dnsServer.registerHandler('*.bleu.de', ['A'], (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '127.0.0.1',
+    };
+  });
+  
+  dnsServer.registerHandler('test.com', ['TXT'], (question) => {
+    return {
+      name: question.name,
+      type: 'TXT',
+      class: 'IN',
+      ttl: 300,
+      data: ['test'],
+    };
+  });
+
+  // Test unregistering
+  const result = dnsServer.unregisterHandler('*.bleu.de', ['A']);
+  expect(result).toEqual(true);
+  
+  // Verify handler is removed
+  // @ts-ignore - accessing private method for testing
+  const response = dnsServer.processDnsRequest({
+    type: 'query',
+    id: 1,
+    flags: 0,
+    questions: [
+      {
+        name: 'dnsly_a.bleu.de',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+    answers: [],
+  });
+  
+  // Should get SOA record instead of A record
+  expect(response.answers[0].type).toEqual('SOA');
+});
+
+tap.test('lets query over https', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  const httpsPort = getUniqueHttpsPort();
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: httpsPort,
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  dnsServer.registerHandler('*.bleu.de', ['A'], (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '127.0.0.1',
+    };
+  });
+
+  // Skip SSL verification for self-signed cert in tests
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'dnsly_a.bleu.de',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+
+  const response = await fetch(`https://localhost:${httpsPort}/dns-query`, {
+    method: 'POST',
+    body: query,
+    headers: {
+      'Content-Type': 'application/dns-message',
+    }
+  });
+
+  expect(response.status).toEqual(200);
+
+  const responseData = await response.arrayBuffer();
+  const dnsResponse = dnsPacket.decode(Buffer.from(responseData));
+
+  console.log(dnsResponse.answers[0]);
+
+  expect(dnsResponse.answers[0]).toEqual({
+    name: 'dnsly_a.bleu.de',
+    type: 'A',
+    class: 'IN',
+    ttl: 300,
+    flush: false,
+    data: '127.0.0.1',
+  });
+  
+  // Reset TLS verification
+  process.env.NODE_TLS_REJECT_UNAUTHORIZED = '1';
+  
+  // Clean up server
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('lets query over udp', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  const udpPort = getUniqueUdpPort();
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  dnsServer.registerHandler('*.bleu.de', ['A'], (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '127.0.0.1',
+    };
+  });
+
+  const client = dgram.createSocket('udp4');
+
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'dnsly_a.bleu.de',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    client.on('message', (msg) => {
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.close();
+    });
+
+    client.on('error', (err) => {
+      reject(err);
+      client.close();
+    });
+
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        reject(err);
+        client.close();
+      }
+    });
+  });
+
+  const dnsResponse = await responsePromise;
+
+  console.log(dnsResponse.answers[0]);
+
+  expect(dnsResponse.answers[0]).toEqual({
+    name: 'dnsly_a.bleu.de',
+    type: 'A',
+    class: 'IN',
+    ttl: 300,
+    flush: false,
+    data: '127.0.0.1',
+  });
+  
+  // Clean up server
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should filter authorized domains correctly', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8080,
+    udpPort: 8081,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register handlers for specific domains
+  dnsServer.registerHandler('*.bleu.de', ['A'], () => null);
+  dnsServer.registerHandler('test.com', ['A'], () => null);
+  
+  // Test filtering authorized domains
+  const authorizedDomains = dnsServer.filterAuthorizedDomains([
+    'test.com',              // Should be authorized
+    'sub.test.com',          // Should not be authorized
+    '*.bleu.de',             // Pattern itself isn't a domain
+    'something.bleu.de',     // Should be authorized via wildcard pattern
+    'example.com',           // Should be authorized (dnssecZone)
+    'sub.example.com',       // Should be authorized (within dnssecZone)
+    'othersite.org'          // Should not be authorized
+  ]);
+  
+  // Using toContain with expect from tapbundle
+  expect(authorizedDomains.includes('test.com')).toEqual(true);
+  expect(authorizedDomains.includes('something.bleu.de')).toEqual(true);
+  expect(authorizedDomains.includes('example.com')).toEqual(true);
+  expect(authorizedDomains.includes('sub.example.com')).toEqual(true);
+  
+  expect(authorizedDomains.includes('sub.test.com')).toEqual(false);
+  expect(authorizedDomains.includes('*.bleu.de')).toEqual(false);
+  expect(authorizedDomains.includes('othersite.org')).toEqual(false);
+});
+
+tap.test('should retrieve SSL certificate successfully', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  // Create a temporary directory for the certificate test
+  const tempCertDir = path.join(process.cwd(), 'temp-certs');
+  if (!fs.existsSync(tempCertDir)) {
+    fs.mkdirSync(tempCertDir, { recursive: true });
+  }
+  
+  // Create a server with unique ports
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+  });
+  
+  // Register handlers for test domains
+  dnsServer.registerHandler('*.bleu.de', ['A'], () => null);
+  dnsServer.registerHandler('test.bleu.de', ['A'], () => null);
+  
+  await dnsServer.start();
+  
+  // Inject our mock for acme-client
+  (dnsServer as any).acmeClientOverride = acmeClientMock;
+  
+  try {
+    // Request certificate for domains
+    const result = await dnsServer.retrieveSslCertificate(
+      ['test.bleu.de', '*.bleu.de', 'unknown.org'],
+      {
+        email: 'test@example.com',
+        staging: true,
+        certDir: tempCertDir
+      }
+    );
+    
+    console.log('Certificate retrieval result:', {
+      success: result.success,
+      certLength: result.cert.length,
+      keyLength: result.key.length,
+    });
+    
+    expect(result.success).toEqual(true);
+    expect(result.cert.includes('BEGIN CERTIFICATE')).toEqual(true);
+    expect(typeof result.key === 'string').toEqual(true);
+    
+    // Check that certificate directory was created
+    expect(fs.existsSync(tempCertDir)).toEqual(true);
+    
+    // Verify TXT record handler was registered and then removed
+    // @ts-ignore - accessing private property for testing
+    const txtHandlerCount = dnsServer.handlers.filter(h => 
+      h.domainPattern.includes('_acme-challenge') && 
+      h.recordTypes.includes('TXT')
+    ).length;
+    
+    expect(txtHandlerCount).toEqual(0); // Should be removed after validation
+  } catch (err) {
+    console.error('Test error:', err);
+    throw err;
+  } finally {
+    // Clean up server and temporary cert directory
+    await stopServer(dnsServer);
+    dnsServer = null;
+    
+    if (fs.existsSync(tempCertDir)) {
+      const files = fs.readdirSync(tempCertDir);
+      for (const file of files) {
+        fs.unlinkSync(path.join(tempCertDir, file));
+      }
+      fs.rmdirSync(tempCertDir);
+    }
+  }
+});
+
+tap.test('should run for a while', async (toolsArg) => {
+  await toolsArg.delayFor(1000);
+});
+
+tap.test('should bind to localhost interface only', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+    udpBindInterface: '127.0.0.1',
+    httpsBindInterface: '127.0.0.1'
+  });
+  
+  // Add timeout to start operation
+  const startPromise = dnsServer.start();
+  const timeoutPromise = new Promise((_, reject) => {
+    setTimeout(() => reject(new Error('Start operation timed out')), 10000);
+  });
+  
+  await Promise.race([startPromise, timeoutPromise]);
+  
+  // @ts-ignore - accessing private property for testing
+  expect(dnsServer.httpsServer).toBeDefined();
+  // @ts-ignore - accessing private property for testing
+  expect(dnsServer.udpServer).toBeDefined();
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('should reject invalid IP addresses', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  // Test invalid UDP interface
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+    udpBindInterface: 'invalid-ip',
+  });
+  
+  let error1 = null;
+  try {
+    await dnsServer.start();
+  } catch (err) {
+    error1 = err;
+  }
+  
+  expect(error1).toBeDefined();
+  expect(error1.message).toContain('Invalid UDP bind interface');
+  
+  // Test invalid HTTPS interface
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+    httpsBindInterface: '999.999.999.999',
+  });
+  
+  let error2 = null;
+  try {
+    await dnsServer.start();
+  } catch (err) {
+    error2 = err;
+  }
+  
+  expect(error2).toBeDefined();
+  expect(error2.message).toContain('Invalid HTTPS bind interface');
+  
+  dnsServer = null;
+});
+
+tap.test('should work with IPv6 localhost if available', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  // Skip IPv6 test if not supported
+  try {
+    const testSocket = require('dgram').createSocket('udp6');
+    testSocket.bind(0, '::1');
+    testSocket.close();
+  } catch (err) {
+    console.log('IPv6 not supported in this environment, skipping test');
+    return;
+  }
+  
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+    udpBindInterface: '::1',
+    httpsBindInterface: '::1'
+  });
+  
+  try {
+    await dnsServer.start();
+    
+    // @ts-ignore - accessing private property for testing
+    expect(dnsServer.httpsServer).toBeDefined();
+    
+    await stopServer(dnsServer);
+  } catch (err) {
+    console.log('IPv6 binding failed:', err.message);
+    await stopServer(dnsServer);
+    throw err;
+  }
+  
+  dnsServer = null;
+});
+
+tap.test('should stop the server', async () => {
+  // Clean up any existing server
+  await stopServer(dnsServer);
+  
+  const httpsData = await tapNodeTools.createHttpsCert();
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  await dnsServer.stop();
+  
+  // @ts-ignore - accessing private property for testing
+  expect(dnsServer.httpsServer).toEqual(null);
+  
+  // Clear the reference
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.soa.debug.ts

@@ -0,0 +1,269 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8700;
+let nextUdpPort = 8701;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('Direct SOA query should work without timeout', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register a SOA handler directly
+  dnsServer.registerHandler('example.com', ['SOA'], (question) => {
+    console.log('Direct SOA handler called for:', question.name);
+    return {
+      name: question.name,
+      type: 'SOA',
+      class: 'IN',
+      ttl: 3600,
+      data: {
+        mname: 'ns1.example.com',
+        rname: 'hostmaster.example.com',
+        serial: 2024010101,
+        refresh: 3600,
+        retry: 600,
+        expire: 604800,
+        minimum: 86400,
+      },
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'SOA',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  console.log('Sending SOA query for example.com');
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out after 5 seconds'));
+    }, 5000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      try {
+        const dnsResponse = dnsPacket.decode(msg);
+        resolve(dnsResponse);
+      } catch (e) {
+        reject(new Error(`Failed to decode response: ${e.message}`));
+      }
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        clearTimeout(timeout);
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  try {
+    const dnsResponse = await responsePromise;
+    console.log('SOA response received:', dnsResponse.answers.length, 'answers');
+    
+    const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+    expect(soaAnswers.length).toEqual(1);
+    
+    const soaData = (soaAnswers[0] as any).data;
+    console.log('SOA data:', soaData);
+    
+    expect(soaData.mname).toEqual('ns1.example.com');
+    expect(soaData.serial).toEqual(2024010101);
+  } catch (error) {
+    console.error('SOA query failed:', error);
+    throw error;
+  }
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('SOA query with DNSSEC should work', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit set for DNSSEC
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  console.log('Sending query for nonexistent domain with DNSSEC');
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out after 5 seconds'));
+    }, 5000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      try {
+        const dnsResponse = dnsPacket.decode(msg);
+        resolve(dnsResponse);
+      } catch (e) {
+        reject(new Error(`Failed to decode response: ${e.message}`));
+      }
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        clearTimeout(timeout);
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  try {
+    const dnsResponse = await responsePromise;
+    console.log('Response received with', dnsResponse.answers.length, 'answers');
+    
+    const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+    console.log('SOA records found:', soaAnswers.length);
+    
+    if (soaAnswers.length > 0) {
+      const soaData = (soaAnswers[0] as any).data;
+      console.log('SOA data:', soaData);
+    }
+  } catch (error) {
+    console.error('SOA query with DNSSEC failed:', error);
+    throw error;
+  }
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Test raw SOA serialization', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: getUniqueUdpPort(),
+    dnssecZone: 'example.com',
+  });
+  
+  // Test the serializeRData method directly
+  const soaData = {
+    mname: 'ns1.example.com',
+    rname: 'hostmaster.example.com',
+    serial: 2024010101,
+    refresh: 3600,
+    retry: 600,
+    expire: 604800,
+    minimum: 86400,
+  };
+  
+  try {
+    // @ts-ignore - accessing private method for testing
+    const serialized = dnsServer.serializeRData('SOA', soaData);
+    console.log('SOA serialized successfully, buffer length:', serialized.length);
+    expect(serialized.length).toBeGreaterThan(0);
+    
+    // The buffer should contain the serialized domain names + 5 * 4 bytes for the numbers
+    // Domain names have variable length, but should be at least 20 bytes total
+    expect(serialized.length).toBeGreaterThan(20);
+  } catch (error) {
+    console.error('SOA serialization failed:', error);
+    throw error;
+  }
+});
+
+export default tap.start();

test/test.soa.final.ts

@@ -0,0 +1,271 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8900;
+let nextUdpPort = 8901;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('SOA records work for all scenarios', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+    primaryNameserver: 'ns.example.com',
+  });
+  
+  // Register SOA handler for the zone
+  dnsServer.registerHandler('example.com', ['SOA'], (question) => {
+    console.log('SOA handler called for:', question.name);
+    return {
+      name: question.name,
+      type: 'SOA',
+      class: 'IN',
+      ttl: 3600,
+      data: {
+        mname: 'ns.example.com',
+        rname: 'admin.example.com',
+        serial: 2024010101,
+        refresh: 3600,
+        retry: 600,
+        expire: 604800,
+        minimum: 86400,
+      },
+    };
+  });
+  
+  // Register some other records
+  dnsServer.registerHandler('example.com', ['A'], (question) => {
+    return {
+      name: question.name,
+      type: 'A',
+      class: 'IN',
+      ttl: 300,
+      data: '192.168.1.1',
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Test 1: Direct SOA query
+  console.log('\n--- Test 1: Direct SOA query ---');
+  const soaQuery = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'SOA',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  let response = await new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.removeAllListeners();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(soaQuery, udpPort, 'localhost');
+  });
+  
+  console.log('Direct SOA query response:', response.answers.length, 'answers');
+  expect(response.answers.length).toEqual(1);
+  expect(response.answers[0].type).toEqual('SOA');
+  
+  // Test 2: Non-existent domain query (should get SOA in authority)
+  console.log('\n--- Test 2: Non-existent domain query ---');
+  const nxQuery = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  response = await new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.removeAllListeners();
+    });
+    
+    client.send(nxQuery, udpPort, 'localhost');
+  });
+  
+  console.log('Non-existent query response:', response.answers.length, 'answers');
+  const soaAnswers = response.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  // Test 3: SOA with DNSSEC
+  console.log('\n--- Test 3: SOA query with DNSSEC ---');
+  const dnssecQuery = dnsPacket.encode({
+    type: 'query',
+    id: 3,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'SOA',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  response = await new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+      client.removeAllListeners();
+    });
+    
+    client.send(dnssecQuery, udpPort, 'localhost');
+  });
+  
+  console.log('DNSSEC SOA query response:', response.answers.length, 'answers');
+  console.log('Answer types:', response.answers.map(a => a.type));
+  expect(response.answers.length).toEqual(2); // SOA + RRSIG
+  expect(response.answers.some(a => a.type === 'SOA')).toEqual(true);
+  expect(response.answers.some(a => a.type === 'RRSIG')).toEqual(true);
+  
+  client.close();
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Configurable primary nameserver works correctly', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'test.com',
+    primaryNameserver: 'master.test.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.test.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const response = await new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      const dnsResponse = dnsPacket.decode(msg);
+      resolve(dnsResponse);
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost');
+  });
+  
+  const soaAnswers = response.answers.filter(a => a.type === 'SOA');
+  console.log('✅ Configured primary nameserver:', (soaAnswers[0] as any).data.mname);
+  expect((soaAnswers[0] as any).data.mname).toEqual('master.test.com');
+  
+  client.close();
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.soa.simple.ts

@@ -0,0 +1,201 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+let nextHttpsPort = 8800;
+let nextUdpPort = 8801;
+
+function getUniqueHttpsPort() {
+  return nextHttpsPort++;
+}
+
+function getUniqueUdpPort() {
+  return nextUdpPort++;
+}
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('Simple SOA query without DNSSEC', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Query for a non-existent domain WITHOUT DNSSEC
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      try {
+        const dnsResponse = dnsPacket.decode(msg);
+        resolve(dnsResponse);
+      } catch (e) {
+        reject(e);
+      }
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        clearTimeout(timeout);
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  console.log('✅ SOA response without DNSSEC received');
+  
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  const soaData = (soaAnswers[0] as any).data;
+  console.log('✅ SOA data:', soaData.mname);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Direct SOA query without DNSSEC', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = getUniqueUdpPort();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: getUniqueHttpsPort(),
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  // Register direct SOA handler
+  dnsServer.registerHandler('example.com', ['SOA'], (question) => {
+    return {
+      name: question.name,
+      type: 'SOA',
+      class: 'IN',
+      ttl: 3600,
+      data: {
+        mname: 'ns1.example.com',
+        rname: 'hostmaster.example.com',
+        serial: 2024010101,
+        refresh: 3600,
+        retry: 600,
+        expire: 604800,
+        minimum: 86400,
+      },
+    };
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 2,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'example.com',
+        type: 'SOA',
+        class: 'IN',
+      },
+    ],
+  });
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      reject(new Error('Query timed out'));
+    }, 2000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      try {
+        const dnsResponse = dnsPacket.decode(msg);
+        resolve(dnsResponse);
+      } catch (e) {
+        reject(e);
+      }
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        clearTimeout(timeout);
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  const dnsResponse = await responsePromise;
+  console.log('✅ Direct SOA query succeeded');
+  
+  const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+  expect(soaAnswers.length).toEqual(1);
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+export default tap.start();

test/test.soa.timeout.ts

@@ -0,0 +1,224 @@
+import * as plugins from '../ts_server/plugins.js';
+import { expect, tap } from '@git.zone/tstest/tapbundle';
+import { tapNodeTools } from '@git.zone/tstest/tapbundle_node';
+import * as dnsPacket from 'dns-packet';
+import * as dgram from 'dgram';
+import { execSync } from 'child_process';
+
+import * as smartdns from '../ts_server/index.js';
+
+let dnsServer: smartdns.DnsServer;
+
+// Port management for tests
+const testPort = 8753;
+
+// Cleanup function for servers
+async function stopServer(server: smartdns.DnsServer | null | undefined) {
+  if (!server) {
+    return;
+  }
+  
+  try {
+    await server.stop();
+  } catch (e) {
+    console.log('Handled error when stopping server:', e.message || e);
+  }
+}
+
+tap.test('Test SOA timeout with real dig command', async (tools) => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8752,
+    udpPort: testPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  console.log(`DNS server started on port ${testPort}`);
+  
+  // Test with dig command
+  try {
+    console.log('Testing SOA query with dig...');
+    const result = execSync(`dig @localhost -p ${testPort} example.com SOA +timeout=3`, { encoding: 'utf8' });
+    console.log('Dig SOA query result:', result);
+    
+    // Check if we got an answer section
+    expect(result).toInclude('ANSWER SECTION');
+    expect(result).toInclude('SOA');
+  } catch (error) {
+    console.error('Dig command failed:', error.message);
+    throw error;
+  }
+  
+  // Test nonexistent domain SOA
+  try {
+    console.log('Testing nonexistent domain SOA query with dig...');
+    const result = execSync(`dig @localhost -p ${testPort} nonexistent.example.com A +timeout=3`, { encoding: 'utf8' });
+    console.log('Dig nonexistent query result:', result);
+    
+    // Should get AUTHORITY section with SOA
+    expect(result).toInclude('AUTHORITY SECTION');
+  } catch (error) {
+    console.error('Dig nonexistent query failed:', error.message);
+    throw error;
+  }
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Test SOA with DNSSEC timing', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  const udpPort = 8754;
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8755,
+    udpPort: udpPort,
+    dnssecZone: 'example.com',
+  });
+  
+  await dnsServer.start();
+  
+  const client = dgram.createSocket('udp4');
+  
+  // Test with DNSSEC enabled
+  const query = dnsPacket.encode({
+    type: 'query',
+    id: 1,
+    flags: dnsPacket.RECURSION_DESIRED,
+    questions: [
+      {
+        name: 'nonexistent.example.com',
+        type: 'A',
+        class: 'IN',
+      },
+    ],
+    additionals: [
+      {
+        name: '.',
+        type: 'OPT',
+        ttl: 0,
+        flags: 0x8000, // DO bit set for DNSSEC
+        data: Buffer.alloc(0),
+      } as any,
+    ],
+  });
+  
+  const startTime = Date.now();
+  console.log('Sending DNSSEC query for nonexistent domain...');
+  
+  const responsePromise = new Promise<dnsPacket.Packet>((resolve, reject) => {
+    const timeout = setTimeout(() => {
+      client.close();
+      const elapsed = Date.now() - startTime;
+      reject(new Error(`Query timed out after ${elapsed}ms`));
+    }, 3000);
+    
+    client.on('message', (msg) => {
+      clearTimeout(timeout);
+      const elapsed = Date.now() - startTime;
+      console.log(`Response received in ${elapsed}ms`);
+      
+      try {
+        const dnsResponse = dnsPacket.decode(msg);
+        resolve(dnsResponse);
+      } catch (e) {
+        reject(new Error(`Failed to decode response: ${e.message}`));
+      }
+      client.close();
+    });
+    
+    client.on('error', (err) => {
+      clearTimeout(timeout);
+      const elapsed = Date.now() - startTime;
+      console.error(`Error after ${elapsed}ms:`, err);
+      reject(err);
+      client.close();
+    });
+    
+    client.send(query, udpPort, 'localhost', (err) => {
+      if (err) {
+        clearTimeout(timeout);
+        reject(err);
+        client.close();
+      }
+    });
+  });
+  
+  try {
+    const dnsResponse = await responsePromise;
+    console.log('Response details:');
+    console.log('- Answers:', dnsResponse.answers.length);
+    console.log('- Answer types:', dnsResponse.answers.map(a => a.type));
+    
+    const soaAnswers = dnsResponse.answers.filter(a => a.type === 'SOA');
+    const rrsigAnswers = dnsResponse.answers.filter(a => a.type === 'RRSIG');
+    
+    console.log('- SOA records:', soaAnswers.length);
+    console.log('- RRSIG records:', rrsigAnswers.length);
+    
+    // With the fix, SOA should have its RRSIG
+    if (soaAnswers.length > 0) {
+      expect(rrsigAnswers.length).toBeGreaterThan(0);
+    }
+  } catch (error) {
+    console.error('DNSSEC SOA query failed:', error);
+    throw error;
+  }
+  
+  await stopServer(dnsServer);
+  dnsServer = null;
+});
+
+tap.test('Check DNSSEC signing performance for SOA', async () => {
+  const httpsData = await tapNodeTools.createHttpsCert();
+  
+  dnsServer = new smartdns.DnsServer({
+    httpsKey: httpsData.key,
+    httpsCert: httpsData.cert,
+    httpsPort: 8756,
+    udpPort: 8757,
+    dnssecZone: 'example.com',
+  });
+  
+  // Time SOA serialization
+  const soaData = {
+    mname: 'ns1.example.com',
+    rname: 'hostmaster.example.com',
+    serial: 2024010101,
+    refresh: 3600,
+    retry: 600,
+    expire: 604800,
+    minimum: 86400,
+  };
+  
+  console.log('Testing SOA serialization performance...');
+  const serializeStart = Date.now();
+  
+  try {
+    // @ts-ignore - accessing private method for testing
+    const serialized = dnsServer.serializeRData('SOA', soaData);
+    const serializeTime = Date.now() - serializeStart;
+    console.log(`SOA serialization took ${serializeTime}ms`);
+    
+    // Test DNSSEC signing
+    const signStart = Date.now();
+    // @ts-ignore - accessing private property
+    const signature = dnsServer.dnsSec.signData(serialized);
+    const signTime = Date.now() - signStart;
+    console.log(`DNSSEC signing took ${signTime}ms`);
+    
+    expect(serializeTime).toBeLessThan(100); // Should be fast
+    expect(signTime).toBeLessThan(500); // Signing can take longer but shouldn't timeout
+  } catch (error) {
+    console.error('Performance test failed:', error);
+    throw error;
+  }
+});
+
+export default tap.start();

test/test.ts

@@ -1,65 +0,0 @@
-import 'typings-test'
-import { expect } from 'smartchai'
-
-import * as dnsly from '../dist/index'
-
-let testDnsly: dnsly.Dnsly
-
-describe('dnsly', function () {
-    it('should create an instance of Dnsly', function () {
-        testDnsly = new dnsly.Dnsly('google')
-        expect(testDnsly).to.be.instanceOf(dnsly.Dnsly)
-    })
-
-    it('should get an A DNS Record', function () {
-        return expect(testDnsly.getRecordA('dnsly_a.bleu.de')).to.eventually.deep.equal([{
-            name: 'dnsly_a.bleu.de',
-            value:  '127.0.0.1',
-            type: 'A'
-        }])
-    })
-
-    it('should get an AAAA Record', function () {
-        return expect(testDnsly.getRecordAAAA('dnsly_aaaa.bleu.de')).to.eventually.deep.equal([{
-            name: 'dnsly_aaaa.bleu.de',
-            value:  '::1',
-            type: 'AAAA'
-        }])
-    })
-
-    it('should get a txt record', function() {
-        return expect(testDnsly.getRecordTxt('dnsly_txt.bleu.de')).to.eventually.deep.equal([{
-            chunked: ['sometext_txt'],
-            name: 'dnsly_txt.bleu.de',
-            value: 'sometext_txt',
-            type: 'TXT'
-        }])
-    })
-
-    it('should, get a mx record for a domain', function (done) {
-        testDnsly.getRecord('google.com', 'MX').then(res => {
-            console.log(res)
-            done()
-        }).catch(err => {
-            console.log(err)
-            done(err)
-        })
-
-    })
-
-    it('should check until DNS is available', function() {
-        return expect(testDnsly.checkUntilAvailable('dnsly_txt.bleu.de','TXT','sometext_txt')).to.eventually.be.true
-    })
-
-    it('should check until DNS is available an return false if it fails', function() {
-        this.timeout(30000)
-        return expect(testDnsly.checkUntilAvailable('dnsly_txt.bleu.de','TXT','sometext_txt2')).to.eventually.be.false
-    })
-
-    it('should check until DNS is available an return false if it fails', function() {
-        this.timeout(30000)
-        return expect(
-            testDnsly.checkUntilAvailable('dnsly_txtNotThere.bleu.de','TXT','sometext_txt2')
-        ).to.eventually.be.false
-    })
-})

ts/00_commitinfo_data.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+  name: '@push.rocks/smartdns',
+  version: '7.5.0',
+  description: 'A robust TypeScript library providing advanced DNS management and resolution capabilities including support for DNSSEC, custom DNS servers, and integration with various DNS providers.'
+}

ts/dnsly.plugins.ts

@@ -1,10 +0,0 @@
-import 'typings-global'
-import * as beautylog from 'beautylog'
-import * as dns from 'dns'
-import * as smartdelay from 'smartdelay'
-
-export {
-    beautylog,
-    dns,
-    smartdelay
-}

ts/index.ts

@@ -1,150 +1,4 @@
-import * as q from 'smartq'
+import * as dnsClientMod from '../dist_ts_client/index.js';
-import * as plugins from './dnsly.plugins'
+import * as dnsServerMod from '../dist_ts_server/index.js';
 
-export type TDnsProvider = 'google'
+export { dnsClientMod, dnsServerMod };
-export type TDnsRecordType = 'A'
-    | 'AAAA'
-    | 'CNAME'
-    | 'PTR'
-    | 'MX'
-    | 'NAPTR'
-    | 'NS'
-    | 'SOA'
-    | 'SRV'
-    | 'TXT'
-
-export interface IDnsRecord {
-    chunked?: string[]
-    name: string
-    type: TDnsRecordType
-    value: string
-}
-
-/**
- * class dnsly offers methods for working with dns from a dns provider like Google DNS
- */
-export class Dnsly {
-    dnsServerIp: string
-    dnsServerPort: number
-    /**
-     * constructor for class dnsly
-     */
-    constructor(dnsProviderArg: TDnsProvider = 'google') {
-        this._setDnsProvider(dnsProviderArg)
-    }
-
-    /**
-     * gets a record
-     */
-    async getRecord(recordNameArg: string, recordTypeArg: TDnsRecordType): Promise<IDnsRecord[]> {
-        switch (recordTypeArg) {
-            case 'TXT':
-                return await this.getRecordTxt(recordNameArg)
-            case 'A':
-                return await this.getRecordA(recordNameArg)
-            case 'AAAA':
-                return await this.getRecordAAAA(recordNameArg)
-        }
-    }
-
-    async checkUntilAvailable(recordNameArg: string, recordTypeArg: TDnsRecordType, expectedValue: string) {
-        let cycleArg = 0
-        let doCheck = async () => {
-            if (cycleArg < 30) {
-                cycleArg++
-                try {
-                    let myRecordArray = await this.getRecord(recordNameArg, recordTypeArg)
-                    let myRecord = myRecordArray[0].value
-                    if (myRecord === expectedValue) {
-                        return true
-                    } else {
-                        await plugins.smartdelay.delayFor(500)
-                        return await doCheck()
-                    }
-                } catch (err) {
-                    await plugins.smartdelay.delayFor(500)
-                    return await doCheck()
-                }
-            } else {
-                console.log('failed permanently...')
-                return false
-            }
-        }
-        return await doCheck()
-    }
-
-    /**
-     * get A Dns Record
-     */
-    async getRecordA(recordNameArg: string): Promise<IDnsRecord[]> {
-        return await this.getOrdinaryRecord(recordNameArg, 'A')
-    }
-
-    /**
-     * get AAAA Record
-     */
-    async getRecordAAAA(recordNameArg: string) {
-        return await this.getOrdinaryRecord(recordNameArg, 'AAAA')
-    }
-
-    /**
-     * gets a txt record
-     */
-    getRecordTxt(recordNameArg: string): Promise<IDnsRecord[]> {
-        let done = q.defer<IDnsRecord[]>()
-        plugins.dns.resolveTxt(recordNameArg, (err, recordsArg) => {
-            if (err) {
-                done.reject(err)
-                return
-            }
-            let responseArray: IDnsRecord[] = []
-            for (let record of recordsArg) {
-                let recordAny: any = record // fix wrong typings
-                responseArray.push({
-                    chunked: recordAny,
-                    name: recordNameArg,
-                    value: recordAny.join(' '),
-                    type: 'TXT'
-                })
-            }
-            done.resolve(responseArray)
-        })
-        return done.promise
-    }
-
-    /**
-     * get oridinary record
-     */
-    private getOrdinaryRecord(recordNameArg: string, recordTypeArg: TDnsRecordType): Promise<IDnsRecord[]> {
-        let done = q.defer<IDnsRecord[]>()
-        plugins.dns.resolve(recordNameArg, recordTypeArg, (err, recordsArg) => {
-            if (err) {
-                done.reject(err)
-                return
-            }
-            let responseArray: IDnsRecord[] = []
-            for (let record of recordsArg) {
-                responseArray.push({
-                    name: recordNameArg,
-                    value: record,
-                    type: recordTypeArg
-                })
-            }
-            done.resolve(responseArray)
-        })
-        return done.promise
-    }
-
-    /**
-     * set the DNS provider
-     */
-    private _setDnsProvider(dnsProvider: TDnsProvider) {
-        if (dnsProvider === 'google') {
-            this.dnsServerIp = '8.8.8.8'
-            this.dnsServerPort = 53
-            plugins.dns.setServers(['8.8.8.8', '8.8.4.4'])
-        } else {
-            throw new Error('unknown dns provider')
-        }
-    }
-}

ts/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 3
+}

ts_client/00_commitinfo_data.ts

@@ -0,0 +1,8 @@
+/**
+ * autocreated commitinfo by @push.rocks/commitinfo
+ */
+export const commitinfo = {
+  name: '@push.rocks/smartdns',
+  version: '5.0.4',
+  description: 'smart dns methods written in TypeScript'
+}

ts_client/classes.dnsclient.ts

@@ -0,0 +1,229 @@
+import * as plugins from './plugins.js';
+
+export type TDnsProvider = 'google' | 'cloudflare';
+
+export const makeNodeProcessUseDnsProvider = (providerArg: TDnsProvider) => {
+  switch (providerArg) {
+    case 'cloudflare':
+      plugins.dns.setServers([
+        '1.1.1.1',
+        '1.0.0.1',
+        '[2606:4700:4700::1111]',
+        '[2606:4700:4700::1001]',
+      ]);
+      break;
+    case 'google':
+      plugins.dns.setServers([
+        '8.8.8.8',
+        '8.8.4.4',
+        '[2001:4860:4860::8888]',
+        '[2606:4700:4700::1001]',
+      ]);
+  }
+};
+
+export interface ISmartDnsConstructorOptions {}
+
+export interface IDnsJsonResponse {
+  Status: number;
+  TC: boolean;
+  RD: boolean;
+  RA: boolean;
+  AD: boolean;
+  CD: boolean;
+  Question: Array<{ name: string; type: number }>;
+  Answer: Array<{ name: string; type: number; TTL: number; data: string }>;
+  Additional: [];
+  Comment: string;
+}
+
+/**
+ * class dnsly offers methods for working with dns from a dns provider like Google DNS
+ */
+export class Smartdns {
+  public dnsServerIp: string;
+  public dnsServerPort: number;
+
+  public dnsTypeMap: { [key: string]: number } = {
+    A: 1,
+    AAAA: 28,
+    CNAME: 5,
+    MX: 15,
+    TXT: 16,
+  };
+
+  /**
+   * constructor for class dnsly
+   */
+  constructor(optionsArg: ISmartDnsConstructorOptions) {}
+
+  /**
+   * check a dns record until it has propagated to Google DNS
+   * should be considerably fast
+   * @param recordNameArg
+   * @param recordTypeArg
+   * @param expectedValue
+   */
+  public async checkUntilAvailable(
+    recordNameArg: string,
+    recordTypeArg: plugins.tsclass.network.TDnsRecordType,
+    expectedValue: string,
+    cyclesArg: number = 50,
+    intervalArg: number = 500
+  ) {
+    let runCycles = 0;
+    const doCheck = async () => {
+      if (runCycles < cyclesArg) {
+        runCycles++;
+        try {
+          let myRecordArray: plugins.tsclass.network.IDnsRecord[];
+          if (runCycles % 2 === 0 || !plugins.dns) {
+            myRecordArray = await this.getRecords(recordNameArg, recordTypeArg, 0);
+          } else {
+            myRecordArray = await this.getRecordWithNodeDNS(recordNameArg, recordTypeArg);
+          }
+          const myRecord = myRecordArray[0].value;
+          if (myRecord === expectedValue) {
+            console.log(
+              `smartdns: .checkUntilAvailable() verified that wanted >>>${recordTypeArg}<<< record exists for >>>${recordNameArg}<<< with value >>>${expectedValue}<<<`
+            );
+            return true;
+          } else {
+            await plugins.smartdelay.delayFor(intervalArg);
+            return await doCheck();
+          }
+        } catch (err) {
+          // console.log(err);
+          await plugins.smartdelay.delayFor(intervalArg);
+          return await doCheck();
+        }
+      } else {
+        console.log(
+          `smartdns: .checkUntilAvailable() failed permanently for ${recordNameArg} with value ${recordTypeArg} - ${expectedValue}...`
+        );
+        return false;
+      }
+    };
+    return await doCheck();
+  }
+
+  /**
+   * get A Dns Record
+   */
+  public async getRecordsA(recordNameArg: string): Promise<plugins.tsclass.network.IDnsRecord[]> {
+    return await this.getRecords(recordNameArg, 'A');
+  }
+
+  /**
+   * get AAAA Record
+   */
+  public async getRecordsAAAA(recordNameArg: string) {
+    return await this.getRecords(recordNameArg, 'AAAA');
+  }
+
+  /**
+   * gets a txt record
+   */
+  public async getRecordsTxt(recordNameArg: string): Promise<plugins.tsclass.network.IDnsRecord[]> {
+    return await this.getRecords(recordNameArg, 'TXT');
+  }
+
+  public async getRecords(
+    recordNameArg: string,
+    recordTypeArg: plugins.tsclass.network.TDnsRecordType,
+    retriesCounterArg = 20
+  ): Promise<plugins.tsclass.network.IDnsRecord[]> {
+    const requestUrl = `https://cloudflare-dns.com/dns-query?name=${recordNameArg}&type=${recordTypeArg}&do=1`;
+    const returnArray: plugins.tsclass.network.IDnsRecord[] = [];
+    const getResponseBody = async (counterArg = 0): Promise<IDnsJsonResponse> => {
+      const response = await plugins.smartrequest.request(requestUrl, {
+        method: 'GET',
+        headers: {
+          accept: 'application/dns-json',
+        },
+      });
+      const responseBody: IDnsJsonResponse = response.body;
+      if (responseBody?.Status !== 0 && counterArg < retriesCounterArg) {
+        await plugins.smartdelay.delayFor(500);
+        return getResponseBody(counterArg + 1);
+      } else {
+        return responseBody;
+      }
+    };
+    const responseBody = await getResponseBody();
+    if (!responseBody.Answer || !typeof responseBody.Answer[Symbol.iterator]) {
+      return returnArray;
+    }
+    for (const dnsEntry of responseBody.Answer) {
+      if (dnsEntry.data.startsWith('"') && dnsEntry.data.endsWith('"')) {
+        dnsEntry.data = dnsEntry.data.replace(/^"(.*)"$/, '$1');
+      }
+      if (dnsEntry.name.endsWith('.')) {
+        dnsEntry.name = dnsEntry.name.substring(0, dnsEntry.name.length - 1);
+      }
+      returnArray.push({
+        name: dnsEntry.name,
+        type: this.convertDnsTypeNumberToTypeName(dnsEntry.type),
+        dnsSecEnabled: responseBody.AD,
+        value: dnsEntry.data,
+      });
+    }
+    // console.log(responseBody);
+    return returnArray;
+  }
+
+  /**
+   * gets a record using nodejs dns resolver
+   */
+  public async getRecordWithNodeDNS(
+    recordNameArg: string,
+    recordTypeArg: plugins.tsclass.network.TDnsRecordType
+  ): Promise<plugins.tsclass.network.IDnsRecord[]> {
+    const done = plugins.smartpromise.defer<plugins.tsclass.network.IDnsRecord[]>();
+    plugins.dns.resolve(recordNameArg, recordTypeArg, (err, recordsArg) => {
+      if (err) {
+        done.reject(err);
+        return;
+      }
+      const returnArray: plugins.tsclass.network.IDnsRecord[] = [];
+      for (const recordKey in recordsArg) {
+        returnArray.push({
+          name: recordNameArg,
+          value: recordsArg[recordKey][0],
+          type: recordTypeArg,
+          dnsSecEnabled: false,
+        });
+      }
+      done.resolve(returnArray);
+    });
+    return done.promise;
+  }
+
+  public async getNameServers(domainNameArg: string): Promise<string[]> {
+    const done = plugins.smartpromise.defer<string[]>();
+    plugins.dns.resolveNs(domainNameArg, (err, result) => {
+      if (!err) {
+        done.resolve(result);
+      } else {
+        console.log(err);
+        done.reject(err);
+      }
+    });
+    return await done.promise;
+  }
+
+  public convertDnsTypeNameToTypeNumber(dnsTypeNameArg: string): number {
+    return this.dnsTypeMap[dnsTypeNameArg];
+  }
+
+  public convertDnsTypeNumberToTypeName(
+    dnsTypeNumberArg: number
+  ): plugins.tsclass.network.TDnsRecordType {
+    for (const key in this.dnsTypeMap) {
+      if (this.dnsTypeMap[key] === dnsTypeNumberArg) {
+        return key as plugins.tsclass.network.TDnsRecordType;
+      }
+    }
+    return null;
+  }
+}

ts_client/index.ts

@@ -0,0 +1 @@
+export * from './classes.dnsclient.js';

ts_client/plugins.ts

@@ -0,0 +1,18 @@
+import * as smartenv from '@push.rocks/smartenv';
+const smartenvInstance = new smartenv.Smartenv();
+// node native scope
+import type dnsType from 'dns';
+const dns: typeof dnsType = await smartenvInstance.getSafeNodeModule('dns');
+
+export { dns };
+
+// pushrocks scope
+import * as smartdelay from '@push.rocks/smartdelay';
+import * as smartpromise from '@push.rocks/smartpromise';
+import * as smartrequest from '@push.rocks/smartrequest';
+
+export { smartdelay, smartenv, smartpromise, smartrequest };
+
+import * as tsclass from '@tsclass/tsclass';
+
+export { tsclass };

ts_client/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 2
+}

ts_server/classes.dnssec.ts

@@ -0,0 +1,189 @@
+// Import necessary plugins from plugins.ts
+import * as plugins from './plugins.js';
+
+interface DnssecZone {
+  zone: string;
+  algorithm: 'ECDSA' | 'ED25519' | 'RSA';
+  keySize: number;
+  days: number;
+}
+
+interface DnssecKeyPair {
+  privateKey: string;
+  publicKey: string;
+}
+
+export class DnsSec {
+  private zone: DnssecZone;
+  private keyPair: DnssecKeyPair;
+  private ec?: plugins.elliptic.ec; // For ECDSA algorithms
+  private eddsa?: plugins.elliptic.eddsa; // For EdDSA algorithms
+
+  constructor(zone: DnssecZone) {
+    this.zone = zone;
+
+    // Initialize the appropriate cryptographic instance based on the algorithm
+    switch (this.zone.algorithm) {
+      case 'ECDSA':
+        this.ec = new plugins.elliptic.ec('p256'); // Use P-256 curve for ECDSA
+        break;
+      case 'ED25519':
+        this.eddsa = new plugins.elliptic.eddsa('ed25519');
+        break;
+      case 'RSA':
+        // RSA implementation would go here
+        throw new Error('RSA algorithm is not yet implemented.');
+      default:
+        throw new Error(`Unsupported algorithm: ${this.zone.algorithm}`);
+    }
+
+    // Generate the key pair
+    this.keyPair = this.generateKeyPair();
+  }
+
+  private generateKeyPair(): DnssecKeyPair {
+    let privateKey: string;
+    let publicKey: string;
+
+    switch (this.zone.algorithm) {
+      case 'ECDSA':
+        if (!this.ec) throw new Error('EC instance is not initialized.');
+        const ecKeyPair = this.ec.genKeyPair();
+        privateKey = ecKeyPair.getPrivate('hex');
+        publicKey = ecKeyPair.getPublic(false, 'hex'); // Uncompressed format
+        break;
+      case 'ED25519':
+        if (!this.eddsa) throw new Error('EdDSA instance is not initialized.');
+        const secret = plugins.crypto.randomBytes(32);
+        const edKeyPair = this.eddsa.keyFromSecret(secret);
+        privateKey = edKeyPair.getSecret('hex');
+        publicKey = edKeyPair.getPublic('hex');
+        break;
+      case 'RSA':
+        // RSA key generation would be implemented here
+        throw new Error('RSA key generation is not yet implemented.');
+      default:
+        throw new Error(`Unsupported algorithm: ${this.zone.algorithm}`);
+    }
+
+    return { privateKey, publicKey };
+  }
+
+  public getAlgorithmNumber(): number {
+    switch (this.zone.algorithm) {
+      case 'ECDSA':
+        return 13; // ECDSAP256SHA256
+      case 'ED25519':
+        return 15;
+      case 'RSA':
+        return 8; // RSASHA256
+      default:
+        throw new Error(`Unsupported algorithm: ${this.zone.algorithm}`);
+    }
+  }
+
+  public signData(data: Buffer): Buffer {
+    switch (this.zone.algorithm) {
+      case 'ECDSA':
+        if (!this.ec) throw new Error('EC instance is not initialized.');
+        const ecKeyPair = this.ec.keyFromPrivate(this.keyPair.privateKey, 'hex');
+        const ecSignature = ecKeyPair.sign(plugins.crypto.createHash('sha256').update(data).digest());
+        return Buffer.from(ecSignature.toDER());
+      
+      case 'ED25519':
+        if (!this.eddsa) throw new Error('EdDSA instance is not initialized.');
+        const edKeyPair = this.eddsa.keyFromSecret(Buffer.from(this.keyPair.privateKey, 'hex'));
+        // ED25519 doesn't need a separate hash function as it includes the hashing internally
+        const edSignature = edKeyPair.sign(data);
+        // Convert the signature to the correct format for Buffer.from
+        return Buffer.from(edSignature.toBytes());
+      
+      case 'RSA':
+        throw new Error('RSA signing is not yet implemented.');
+      
+      default:
+        throw new Error(`Unsupported algorithm: ${this.zone.algorithm}`);
+    }
+  }
+
+  private generateDNSKEY(): Buffer {
+    const flags = 256; // 256 indicates a Zone Signing Key (ZSK)
+    const protocol = 3; // Must be 3 according to RFC
+    const algorithm = this.getAlgorithmNumber();
+
+    let publicKeyData: Buffer;
+
+    switch (this.zone.algorithm) {
+      case 'ECDSA':
+        if (!this.ec) throw new Error('EC instance is not initialized.');
+        const ecPublicKey = this.ec.keyFromPublic(this.keyPair.publicKey, 'hex').getPublic();
+        const x = ecPublicKey.getX().toArrayLike(Buffer, 'be', 32);
+        const y = ecPublicKey.getY().toArrayLike(Buffer, 'be', 32);
+        publicKeyData = Buffer.concat([x, y]);
+        break;
+      case 'ED25519':
+        publicKeyData = Buffer.from(this.keyPair.publicKey, 'hex');
+        break;
+      case 'RSA':
+        // RSA public key extraction would go here
+        throw new Error('RSA public key extraction is not yet implemented.');
+      default:
+        throw new Error(`Unsupported algorithm: ${this.zone.algorithm}`);
+    }
+
+    // Construct the DNSKEY RDATA
+    const dnskeyRdata = Buffer.concat([
+      Buffer.from([flags >> 8, flags & 0xff]), // Flags (2 bytes)
+      Buffer.from([protocol]), // Protocol (1 byte)
+      Buffer.from([algorithm]), // Algorithm (1 byte)
+      publicKeyData, // Public Key
+    ]);
+
+    return dnskeyRdata;
+  }
+
+  private computeKeyTag(dnskeyRdata: Buffer): number {
+    // Key Tag calculation as per RFC 4034, Appendix B
+    let acc = 0;
+    for (let i = 0; i < dnskeyRdata.length; i++) {
+      acc += i & 1 ? dnskeyRdata[i] : dnskeyRdata[i] << 8;
+    }
+    acc += (acc >> 16) & 0xffff;
+    return acc & 0xffff;
+  }
+
+  private getDNSKEYRecord(): string {
+    const dnskeyRdata = this.generateDNSKEY();
+    const flags = 256;
+    const protocol = 3;
+    const algorithm = this.getAlgorithmNumber();
+    const publicKeyData = dnskeyRdata.slice(4); // Skip flags, protocol, algorithm bytes
+    const publicKeyBase64 = publicKeyData.toString('base64');
+
+    return `${this.zone.zone}. IN DNSKEY ${flags} ${protocol} ${algorithm} ${publicKeyBase64}`;
+  }
+
+  public getDSRecord(): string {
+    const dnskeyRdata = this.generateDNSKEY();
+    const keyTag = this.computeKeyTag(dnskeyRdata);
+    const algorithm = this.getAlgorithmNumber();
+    const digestType = 2; // SHA-256
+    const digest = plugins.crypto
+      .createHash('sha256')
+      .update(dnskeyRdata)
+      .digest('hex')
+      .toUpperCase();
+
+    return `${this.zone.zone}. IN DS ${keyTag} ${algorithm} ${digestType} ${digest}`;
+  }
+
+  public getKeyPair(): DnssecKeyPair {
+    return this.keyPair;
+  }
+
+  public getDsAndKeyPair(): { keyPair: DnssecKeyPair; dsRecord: string; dnskeyRecord: string } {
+    const dsRecord = this.getDSRecord();
+    const dnskeyRecord = this.getDNSKEYRecord();
+    return { keyPair: this.keyPair, dsRecord, dnskeyRecord };
+  }
+}

ts_server/index.ts

@@ -0,0 +1 @@
+export * from './classes.dnsserver.js';

ts_server/plugins.ts

@@ -0,0 +1,36 @@
+// node native
+import crypto from 'crypto';
+import dgram from 'dgram';
+import fs from 'fs';
+import http from 'http';
+import https from 'https';
+import * as net from 'net';
+import * as path from 'path';
+
+export {
+  crypto,
+  dgram,
+  fs,
+  http,
+  https,
+  net,
+  path,
+}
+
+// @push.rocks scope
+import * as smartpromise from '@push.rocks/smartpromise';
+
+export {
+  smartpromise,
+}
+
+// third party
+import elliptic from 'elliptic';
+import * as dnsPacket from 'dns-packet';
+import * as minimatch from 'minimatch';
+
+export {
+  dnsPacket,
+  elliptic,
+  minimatch,
+}

ts_server/tspublish.json

@@ -0,0 +1,3 @@
+{
+  "order": 1
+}

tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "experimentalDecorators": true,
+    "useDefineForClassFields": false,
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "esModuleInterop": true,
+    "verbatimModuleSyntax": true
+  },
+  "exclude": [
+    "dist_*/**/*.d.ts"
+  ]
+}

tslint.json

@@ -1,3 +0,0 @@
-{
-    "extends": "tslint-config-standard"
-}