@nictool/dns-resource-record 1.3.1 → 1.5.0

package/CHANGELOG.md

@@ -4,6 +4,32 @@ Notable changes to this project are documented in this file.
 
 #### Unreleased
 
+### [1.5.0] - 2026-03-22
+
+- feat(RRSIG, SIG, TSIG): added toBind, toTinydns, fromTinydns
+- feat(TSIG): added missing setters
+- feat(fromTinydns): added to APL, DHCID, HIP, KX, RRSIG, RP, WKS
+- feat(CERT): validate mnemonic values
+- fix: hardened polynomial regexes #56
+- fix(NAPTR): replace polynomial regexp
+- test: coverage is at 98% 🎉
+- test(NSEC3PARAM): added test cases, better binary parser, better salt
+- test(AAAA, APL, CERT, KEY, NAPTR, NSEC3, NSEC3PARAM, RRSIG, SIG, SSHFP, TSIG, URL): added test coverage
+- doc(README): updated RR table completion status
+- style(es6): use ?. and ?? operators (nullish coalescing) #57
+- style(es6): use argument expansion / destructured parameters
+- style(es6): substring -> slice #55
+- style(es6): use more trim() #55
+
+### [1.4.0] - 2026-03-21
+
+- feat(toBind): added to nsec3param, rrsig
+- feat(toTinydns): added to key, nsec3param, nxt, openpgpkey
+- feat(fromTinydns): added to cert, https, key, nsec, nsec3param, nxt, openpgpkey, smimea, svcb
+- fix(naptr): fixed flags calc in fromTinydns
+- fix(tinydns): more robust unpackDomainName
+- test: switch test runner to node --test
+
 ### [1.3.1] - 2026-03-13
 
 - ci: update workflow triggers
@@ -338,3 +364,5 @@ Notable changes to this project are documented in this file.
 [1.2.4]: https://github.com/NicTool/dns-resource-record/releases/tag/1.2.4
 [1.3.0]: https://github.com/NicTool/dns-resource-record/releases/tag/v1.3.0
 [1.3.1]: https://github.com/NicTool/dns-resource-record/releases/tag/v1.3.1
+[1.4.0]: https://github.com/NicTool/dns-resource-record/releases/tag/v1.4.0
+[1.5.0]: https://github.com/NicTool/dns-resource-record/releases/tag/v1.5.0

package/README.md

@@ -19,6 +19,7 @@ This module is used to:
 | **[Tinydns](https://cr.yp.to/djbdns/tinydns-data.html)** | :white_check_mark: | :white_check_mark: |
 |                       **MaraDNS**                        |                    | :white_check_mark: |
 |                          **JS**                          | :white_check_mark: | :white_check_mark: |
+|                       **PowerDNS**                       |                    |                    |
 
 This package intends to import and export RFC compliant DNS resource records. Please [raise an issue](https://github.com/NicTool/dns-resource-record/issues) if a valid resource record fails to pass or an invalid resource record passes.
 
@@ -189,44 +190,44 @@ PRs are welcome, especially PRs with tests.
 | :------------: | :----------------: | :----------------: | :----------------: | :----------------: |
 |     **A**      | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **AAAA**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **APL**     | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **APL**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **CAA**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **CERT**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **CERT**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **CNAME**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|   **DHCID**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|   **DHCID**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **DNAME**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **DNSKEY**   | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |     **DS**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **HINFO**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **HIP**     | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
-|   **HTTPS**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **HIP**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|   **HTTPS**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |  **IPSECKEY**  | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **KEY**     |                    |                    |                    |                    |
-|     **KX**     | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **KEY**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|     **KX**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **LOC**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |     **MX**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **NAPTR**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |     **NS**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **NSEC**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
-|   **NSEC3**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
-| **NSEC3PARAM** |                    |                    |                    |                    |
-|    **NXT**     |                    |                    |                    |                    |
-| **OPENPGPKEY** |                    |                    |                    |                    |
+|    **NSEC**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|   **NSEC3**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+| **NSEC3PARAM** | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|    **NXT**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+| **OPENPGPKEY** | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **PTR**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|     **RP**     | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
-|   **RRSIG**    |                    |                    |                    |                    |
-|    **SIG**     |                    |                    |                    |                    |
-|   **SMIMEA**   | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|     **RP**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|   **RRSIG**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|    **SIG**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
+|   **SMIMEA**   | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **SOA**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **SPF**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **SRV**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |   **SSHFP**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **SVCB**    | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **SVCB**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **TLSA**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **TSIG**    |                    |                    |                    |                    |
+|    **TSIG**    | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **TXT**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 |    **URI**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
-|    **WKS**     | :white_check_mark: | :white_check_mark: | :white_check_mark: |                    |
+|    **WKS**     | :white_check_mark: | :white_check_mark: | :white_check_mark: | :white_check_mark: |
 
 ## TIPS
 

package/lib/tinydns.js

@@ -27,9 +27,13 @@ export function escapeOctal(re, str) {
   return escaped
 }
 
+export function unescapeOctal(str) {
+  return this.octalToChar(str)
+}
+
 export function octalToChar(str) {
   // relace instances of \NNN with ASCII
-  return str.replace(octalRe, (o) => String.fromCharCode(parseInt(o.substring(1), 8)))
+  return str.replace(octalRe, (o) => String.fromCharCode(parseInt(o.slice(1), 8)))
 }
 
 export function octalToHex(str) {
@@ -37,29 +41,29 @@ export function octalToHex(str) {
   return str.replace(octalRe, (o) => {
     // parseInt(n, 8) -> from octal to decimal
     //  .toString(16) -> decimal to hex
-    return parseInt(o.substring(1), 8).toString(16).padStart(2, 0)
+    return parseInt(o.slice(1), 8).toString(16).padStart(2, 0)
   })
 }
 
 export function octalToUInt8(str) {
   const b = Buffer.alloc(1)
-  b.writeUInt8(parseInt(str.substring(1, 4), 8), 0)
+  b.writeUInt8(parseInt(str.slice(1, 4), 8), 0)
   return b.readUInt8()
 }
 
 export function octalToUInt16(str) {
   const b = Buffer.alloc(2)
-  b.writeUInt8(parseInt(str.substring(1, 4), 8), 0)
-  b.writeUInt8(parseInt(str.substring(5, 8), 8), 1)
+  b.writeUInt8(parseInt(str.slice(1, 4), 8), 0)
+  b.writeUInt8(parseInt(str.slice(5, 8), 8), 1)
   return b.readUInt16BE()
 }
 
 export function octalToUInt32(str) {
   const b = Buffer.alloc(4)
-  b.writeUInt8(parseInt(str.substring(1, 4), 8), 0)
-  b.writeUInt8(parseInt(str.substring(5, 8), 8), 1)
-  b.writeUInt8(parseInt(str.substring(9, 12), 8), 2)
-  b.writeUInt8(parseInt(str.substring(13, 16), 8), 3)
+  b.writeUInt8(parseInt(str.slice(1, 4), 8), 0)
+  b.writeUInt8(parseInt(str.slice(5, 8), 8), 1)
+  b.writeUInt8(parseInt(str.slice(9, 12), 8), 2)
+  b.writeUInt8(parseInt(str.slice(13, 16), 8), 3)
   return b.readUInt32BE()
 }
 
@@ -95,7 +99,7 @@ export function packDomainName(fqdn) {
   // RFC 1035, 3.3 Standard RRs
   // The standard wire format for DNS names. (1 octet length + octets)
   let packed = ''
-  fqdn.split('.').map((label) => {
+  fqdn.split('.').forEach((label) => {
     if (label === undefined || !label.length) return
 
     const len = Buffer.alloc(1)
@@ -108,22 +112,39 @@ export function packDomainName(fqdn) {
   return packed
 }
 
-export function unpackDomainName(fqdn) {
-  fqdn = Buffer.from(octalToChar(fqdn.toString()))
-
-  const labels = []
+export function unpackDomainName(escaped) {
   let pos = 0
-  let len
-  while ((len = fqdn.readUInt8(pos))) {
-    // encoded length byte
-    pos++
-    labels.push(fqdn.slice(pos, pos + len).toString())
-    pos = +(pos + len)
+  let binaryLen = 0
+  const labels = []
+
+  // consume the next logical "byte" (char or octal escape)
+  const getNextByte = () => {
+    if (pos >= escaped.length) return null
+
+    let value
+    if (escaped[pos] === '\\') {
+      value = parseInt(escaped.slice(pos + 1, pos + 4), 8)
+      pos += 4
+    } else {
+      value = escaped.charCodeAt(pos++)
+    }
+
+    binaryLen++
+    return value
   }
-  const r = `${labels.join('.')}.`
-  // char position + length of last label + label length chars + null byte
-  const strLen = pos + len + labels.length * 4 + 1
-  return [r, strLen]
+
+  let lengthByte
+  while ((lengthByte = getNextByte()) && lengthByte !== 0) {
+    let label = ''
+    for (let i = 0; i < lengthByte; i++) {
+      const char = getNextByte()
+      if (char === null) break
+      label += String.fromCharCode(char)
+    }
+    labels.push(label)
+  }
+
+  return [`${labels.join('.')}.`, pos, binaryLen]
 }
 
 export function packHex(str) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nictool/dns-resource-record",
-  "version": "1.3.1",
+  "version": "1.5.0",
   "description": "DNS Resource Records",
   "main": "index.js",
   "files": [
@@ -12,15 +12,16 @@
   "type": "module",
   "scripts": {
     "format:check": "npm run prettier; npm run lint",
-    "format": "npm run prettier -- --write && npm run lint --fix",
+    "format": "npm run prettier -- --write && npm run lint:fix",
     "lint": "npx eslint **/*.js",
     "lint:fix": "npm run lint -- --fix",
     "prettier": "npx prettier --ignore-path .gitignore --check .",
     "prettier:fix": "npx prettier --ignore-path .gitignore --write .",
-    "test": "npx mocha",
-    "versions": "npx dependency-version-checker check",
-    "watch": "npm run test -- --watch",
-    "versions:fix": "npx dependency-version-checker update"
+    "test": "node --test test/*.js",
+    "test:coverage": "npx c8 --reporter=text --reporter=text-summary npm test",
+    "versions": "npx npm-dep-mgr check",
+    "versions:fix": "npx npm-dep-mgr update",
+    "watch": "node --test --watch test/*.js"
   },
   "repository": {
     "type": "git",
@@ -47,9 +48,8 @@
   "homepage": "https://github.com/NicTool/dns-resource-record#readme",
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "eslint": "^10.0.3",
-    "globals": "^17.4.0",
-    "mocha": "^11.7.5"
+    "eslint": "^10.1.0",
+    "globals": "^17.4.0"
   },
   "prettier": {
     "printWidth": 110,

package/rr/a.js

@@ -39,9 +39,9 @@ export default class A extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // +fqdn:ip:ttl:timestamp:lo
-    const [owner, ip, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [owner, ip, ttl, ts, loc] = tinyline.slice(1).split(':')
 
     return new A({
       owner: this.fullyQualify(owner),
@@ -49,13 +49,13 @@ export default class A extends RR {
       address: ip,
       ttl: parseInt(ttl, 10),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  A  192.0.2.127
-    const [owner, ttl, c, type, address] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, address] = bindline.split(/\s+/)
     return new A({
       owner,
       ttl: parseInt(ttl, 10),

package/rr/aaaa.js

@@ -15,7 +15,7 @@ export default class AAAA extends RR {
   }
 
   getCompressed(val) {
-    return this.compress(val || this.get('address'))
+    return this.compress(val ?? this.get('address'))
   }
 
   getDescription() {
@@ -45,14 +45,14 @@ export default class AAAA extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
-    const str = opts.tinyline
+  fromTinydns({ tinyline }) {
+    const str = tinyline
     let fqdn, ip, n, rdata, ttl, ts, loc
 
     switch (str[0]) {
       case ':':
         // GENERIC  =>  :fqdn:28:rdata:ttl:timestamp:lo
-        ;[fqdn, n, rdata, ttl, ts, loc] = str.substring(1).split(':')
+        ;[fqdn, n, rdata, ttl, ts, loc] = str.slice(1).split(':')
         if (n != 28) this.throwHelp('AAAA fromTinydns, invalid n')
         ip = TINYDNS.octalToHex(rdata)
           .match(/([0-9a-fA-F]{4})/g)
@@ -62,7 +62,7 @@ export default class AAAA extends RR {
       case '6':
         // AAAA     =>  3fqdn:ip:x:ttl:timestamp:lo
         // AAAA,PTR =>  6fqdn:ip:x:ttl:timestamp:lo
-        ;[fqdn, rdata, ttl, ts, loc] = str.substring(1).split(':')
+        ;[fqdn, rdata, ttl, ts, loc] = str.slice(1).split(':')
         ip = rdata.match(/(.{4})/g).join(':')
         break
     }
@@ -73,13 +73,13 @@ export default class AAAA extends RR {
       type: 'AAAA',
       address: ip,
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  AAAA  ...
-    const [owner, ttl, c, type, ip] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, ip] = bindline.split(/\s+/)
     return new AAAA({
       owner,
       ttl: parseInt(ttl, 10),
@@ -124,7 +124,7 @@ export default class AAAA extends RR {
     if (delimiter === undefined) delimiter = ':'
 
     const colons = val.match(/:/g)
-    if (colons && colons.length < 7) {
+    if (colons?.length < 7) {
       // console.log(`AAAA: restoring compressed colons`)
       val = val.replace(/::/, ':'.repeat(9 - colons.length))
     }

package/rr/apl.js

@@ -42,9 +42,56 @@ export default class APL extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromBind(opts) {
+  fromTinydns({ tinyline }) {
+    // APL via generic, :fqdn:42:rdata:ttl:timestamp:lo
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
+    if (n != 42) this.throwHelp('APL fromTinydns, invalid n')
+
+    const bytes = Buffer.from(TINYDNS.octalToChar(rdata), 'binary')
+    const items = []
+    let pos = 0
+
+    while (pos < bytes.length) {
+      const afi = bytes.readUInt16BE(pos)
+      pos += 2
+      const prefix = bytes.readUInt8(pos)
+      pos++
+      const adfLenByte = bytes.readUInt8(pos)
+      pos++
+      const neg = (adfLenByte & 0x80) !== 0
+      const addrLen = adfLenByte & 0x7f
+      const addrBytes = bytes.slice(pos, pos + addrLen)
+      pos += addrLen
+
+      let addr
+      if (afi === 1) {
+        const padded = Buffer.alloc(4)
+        addrBytes.copy(padded)
+        addr = [...padded].join('.')
+      } else {
+        const padded = Buffer.alloc(16)
+        addrBytes.copy(padded)
+        const groups = []
+        for (let i = 0; i < 16; i += 2) groups.push(padded.readUInt16BE(i).toString(16).padStart(4, '0'))
+        addr = this.compressIPv6(groups.join(':'))
+      }
+
+      items.push(`${neg ? '!' : ''}${afi}:${addr}/${prefix}`)
+    }
+
+    return new APL({
+      owner: this.fullyQualify(fqdn),
+      ttl: parseInt(ttl, 10),
+      type: 'APL',
+      'apl rdata': items.join(' '),
+      timestamp: ts,
+      location: loc?.trim() ?? '',
+    })
+  }
+
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  APL  {[!]afi:address/prefix}*
-    const parts = opts.bindline.split(/\s+/)
+    const parts = bindline.split(/\s+/)
     const [owner, ttl, c, type] = parts
     return new APL({
       owner,

package/rr/caa.js

@@ -91,17 +91,17 @@ export default class CAA extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // CAA via generic, :fqdn:n:rdata:ttl:timestamp:lo
-    const [fqdn, n, rdata, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
     if (n != 257) this.throwHelp('CAA fromTinydns, invalid n')
 
-    const flags = TINYDNS.octalToUInt8(rdata.substring(0, 4))
-    const taglen = TINYDNS.octalToUInt8(rdata.substring(4, 8))
+    const flags = TINYDNS.octalToUInt8(rdata.slice(0, 4))
+    const taglen = TINYDNS.octalToUInt8(rdata.slice(4, 8))
 
-    const unescaped = TINYDNS.octalToChar(rdata.substring(8))
-    const tag = unescaped.substring(0, taglen)
-    const fingerprint = unescaped.substring(taglen)
+    const unescaped = TINYDNS.octalToChar(rdata.slice(8))
+    const tag = unescaped.slice(0, taglen)
+    const fingerprint = unescaped.slice(taglen)
 
     return new CAA({
       owner: this.fullyQualify(fqdn),
@@ -111,17 +111,23 @@ export default class CAA extends RR {
       tag,
       value: fingerprint,
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  CAA flags, tags, value
-    const regex = /^([\S]+)\s+([0-9]{1,10})\s+(IN)\s+(CAA)\s+([0-9]+)\s+(\w+)\s+("[^"]+"|[\S]+?)$/i
-    const fields = opts.bindline.trim().match(regex)
-    if (!fields) this.throwHelp(`unable to parse: ${opts.bindline}`)
+    const regex =
+      /^(?<owner>\S+)\s+(?<ttl>\d{1,10})\s+(?<class>IN)\s+(?<type>CAA)\s+(?<flags>\d+)\s+(?<tag>\w+)\s+(?:"(?<quotedValue>[^"]+)"|(?<unquotedValue>\S+))$/i
+
+    const match = bindline.trim().match(regex)
+
+    if (!match) {
+      this.throwHelp(`unable to parse CAA: ${bindline}`)
+    }
+
+    const { owner, ttl, class: c, type, flags, tag, quotedValue, unquotedValue } = match.groups
 
-    const [owner, ttl, c, type, flags, tag, value] = fields.slice(1)
     return new CAA({
       owner,
       ttl: parseInt(ttl, 10),
@@ -129,21 +135,18 @@ export default class CAA extends RR {
       type,
       flags: parseInt(flags, 10),
       tag,
-      value,
+      value: quotedValue ?? unquotedValue,
     })
   }
 
   /******  EXPORTERS   *******/
 
   toTinydns() {
-    let rdata = ''
-    rdata += TINYDNS.UInt8toOctal(this.get('flags'))
-
-    rdata += TINYDNS.UInt8toOctal(this.get('tag').length)
-    rdata += TINYDNS.escapeOctal(/[\r\n\t:\\/]/, this.get('tag'))
-
-    rdata += TINYDNS.escapeOctal(/[\r\n\t:\\/]/, this.getQuoted('value'))
-
-    return this.getTinydnsGeneric(rdata)
+    return this.getTinydnsGeneric(
+      TINYDNS.UInt8toOctal(this.get('flags')) +
+        TINYDNS.UInt8toOctal(this.get('tag').length) +
+        TINYDNS.escapeOctal(/[\r\n\t:\\/]/, this.get('tag')) +
+        TINYDNS.escapeOctal(/[\r\n\t:\\/]/, this.getQuoted('value')),
+    )
   }
 }

package/rr/cert.js

@@ -11,8 +11,29 @@ export default class CERT extends RR {
   setCertType(val) {
     // The type field is the certificate type
     // the type field as an unsigned decimal integer or as a mnemonic symbol
-    // this.is16bitInt('CERT', 'type', val)
-
+    if (val === undefined || val === null || val === '') {
+      this.throwHelp('cert type is required')
+    }
+    // Accept both mnemonic and numeric, but validate mnemonic
+    if (typeof val === 'string') {
+      const types = {
+        PKIX: 1,
+        SPKI: 2,
+        PGP: 3,
+        IPKIX: 4,
+        ISPKI: 5,
+        IPGP: 6,
+        ACPKIX: 7,
+        IACPKIX: 8,
+        URI: 253,
+        OID: 254,
+      }
+      if (!Object.hasOwn(types, val)) {
+        this.throwHelp(`CERT: unknown cert type mnemonic: ${val}`)
+      }
+    } else {
+      this.is16bitInt('CERT', 'cert type', val)
+    }
     this.set('cert type', val)
   }
 
@@ -54,6 +75,9 @@ export default class CERT extends RR {
   setCertificate(val) {
     // certificate/CRL portion is represented in base 64 [16] and may be
     // divided into any number of white-space-separated substrings
+    if (val === undefined || val === null || val === '') {
+      this.throwHelp('certificate is required and cannot be empty')
+    }
     this.set('certificate', val)
   }
 
@@ -75,9 +99,44 @@ export default class CERT extends RR {
 
   /******  IMPORTERS   *******/
 
-  fromBind(opts) {
+  fromTinydns({ tinyline }) {
+    const [owner, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
+    if (n != 37) this.throwHelp('CERT fromTinydns, invalid n')
+
+    const bytes = Buffer.from(TINYDNS.octalToChar(rdata), 'binary')
+    const typeNum = bytes.readUInt16BE(0)
+    let certType = typeNum
+
+    const types = {
+      1: 'PKIX',
+      2: 'SPKI',
+      3: 'PGP',
+      4: 'IPKIX',
+      5: 'ISPKI',
+      6: 'IPGP',
+      7: 'ACPKIX',
+      8: 'IACPKIX',
+      253: 'URI',
+      254: 'OID',
+    }
+    if (types[typeNum]) certType = types[typeNum]
+
+    return new CERT({
+      owner: this.fullyQualify(owner),
+      ttl: parseInt(ttl, 10),
+      type: 'CERT',
+      'cert type': certType,
+      'key tag': bytes.readUInt16BE(2),
+      algorithm: bytes.readUInt8(4),
+      certificate: bytes.slice(5).toString(),
+      timestamp: ts,
+      location: loc?.trim() ?? '',
+    })
+  }
+
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  CERT  certtype, keytag, algo, cert
-    const [owner, ttl, c, type, certtype, keytag, algo, certificate] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, certtype, keytag, algo, certificate] = bindline.split(/\s+/)
     return new CERT({
       owner,
       ttl: parseInt(ttl, 10),

package/rr/cname.js

@@ -38,9 +38,9 @@ export default class CNAME extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromTinydns(opts) {
+  fromTinydns({ tinyline }) {
     // Cfqdn:p:ttl:timestamp:lo
-    const [fqdn, p, ttl, ts, loc] = opts.tinyline.substring(1).split(':')
+    const [fqdn, p, ttl, ts, loc] = tinyline.slice(1).split(':')
 
     return new CNAME({
       owner: this.fullyQualify(fqdn),
@@ -48,13 +48,13 @@ export default class CNAME extends RR {
       type: 'CNAME',
       cname: this.fullyQualify(p),
       timestamp: ts,
-      location: loc !== '' && loc !== '\n' ? loc : '',
+      location: loc?.trim() ?? '',
     })
   }
 
-  fromBind(opts) {
+  fromBind({ bindline }) {
     // test.example.com  3600  IN  CNAME  ...
-    const [owner, ttl, c, type, cname] = opts.bindline.split(/\s+/)
+    const [owner, ttl, c, type, cname] = bindline.split(/\s+/)
     return new CNAME({
       owner,
       ttl: parseInt(ttl, 10),

package/rr/dhcid.js

@@ -40,9 +40,24 @@ export default class DHCID extends RR {
   }
 
   /******  IMPORTERS   *******/
-  fromBind(opts) {
+  fromTinydns({ tinyline }) {
+    // DHCID via generic, :fqdn:49:rdata:ttl:timestamp:lo
+    const [fqdn, n, rdata, ttl, ts, loc] = tinyline.slice(1).split(':')
+    if (n != 49) this.throwHelp('DHCID fromTinydns, invalid n')
+
+    return new DHCID({
+      owner: this.fullyQualify(fqdn),
+      ttl: parseInt(ttl, 10),
+      type: 'DHCID',
+      data: TINYDNS.octalToBase64(rdata),
+      timestamp: ts,
+      location: loc?.trim() ?? '',
+    })
+  }
+
+  fromBind({ bindline }) {
     // host.example.com  3600  IN  DHCID  <base64data>
-    const parts = opts.bindline.split(/\s+/)
+    const parts = bindline.split(/\s+/)
     const [owner, ttl, c, type] = parts
     return new DHCID({
       owner,