@push.rocks/smartmta 6.4.1 → 6.5.1

package/ts/mail/routing/classes.dns.manager.ts

@@ -30,6 +30,20 @@ interface IDnsRecords {
   ns?: string[];
 }
 
+interface IDnsResolver {
+  setServers(servers: string[]): void;
+  resolveMx(domain: string): Promise<Array<{ exchange: string; priority: number }>>;
+  resolveTxt(domain: string): Promise<string[][]>;
+  resolveNs(domain: string): Promise<string[]>;
+  cancel(): void;
+}
+
+interface IDnsValidationRun {
+  id: number;
+  abortController: AbortController;
+  cancel: () => void;
+}
+
 /**
  * Manages DNS configuration for email domains
  * Handles both validation and creation of DNS records
@@ -37,37 +51,54 @@ interface IDnsRecords {
 export class DnsManager {
   private dcRouter: IDcRouterLike;
   private storageManager: IStorageManagerLike;
+  private resolverFactory: () => IDnsResolver;
+  private activeResolvers = new Set<IDnsResolver>();
+  private activeValidation?: IDnsValidationRun;
+  private validationRunId = 0;
   
-  constructor(dcRouter: IDcRouterLike) {
+  constructor(
+    dcRouter: IDcRouterLike,
+    resolverFactory: () => IDnsResolver = () => new plugins.dns.promises.Resolver()
+  ) {
     this.dcRouter = dcRouter;
     this.storageManager = dcRouter.storageManager;
+    this.resolverFactory = resolverFactory;
   }
   
   /**
    * Validate all domain configurations
    */
-  async validateAllDomains(domainConfigs: IEmailDomainConfig[]): Promise<Map<string, IDnsValidationResult>> {
-    const results = new Map<string, IDnsValidationResult>();
-    
-    for (const config of domainConfigs) {
-      const result = await this.validateDomain(config);
-      results.set(config.domain, result);
+  async validateAllDomains(
+    domainConfigs: IEmailDomainConfig[],
+    abortSignal?: AbortSignal
+  ): Promise<Map<string, IDnsValidationResult>> {
+    if (abortSignal?.aborted) {
+      return new Map();
     }
-    
-    return results;
+    const results = await Promise.all(domainConfigs.map(async (config) => {
+      return [config.domain, await this.validateDomain(config, abortSignal)] as const;
+    }));
+
+    if (abortSignal?.aborted) {
+      return new Map();
+    }
+    return new Map(results);
   }
   
   /**
    * Validate a single domain configuration
    */
-  async validateDomain(config: IEmailDomainConfig): Promise<IDnsValidationResult> {
+  async validateDomain(
+    config: IEmailDomainConfig,
+    abortSignal?: AbortSignal
+  ): Promise<IDnsValidationResult> {
     switch (config.dnsMode) {
       case 'forward':
         return this.validateForwardMode(config);
       case 'internal-dns':
-        return this.validateInternalDnsMode(config);
+        return this.validateInternalDnsMode(config, abortSignal);
       case 'external-dns':
-        return this.validateExternalDnsMode(config);
+        return this.validateExternalDnsMode(config, abortSignal);
       default:
         return {
           valid: false,
@@ -105,7 +136,10 @@ export class DnsManager {
   /**
    * Validate internal DNS mode configuration
    */
-  private async validateInternalDnsMode(config: IEmailDomainConfig): Promise<IDnsValidationResult> {
+  private async validateInternalDnsMode(
+    config: IEmailDomainConfig,
+    abortSignal?: AbortSignal
+  ): Promise<IDnsValidationResult> {
     const result: IDnsValidationResult = {
       valid: true,
       errors: [],
@@ -164,7 +198,10 @@ export class DnsManager {
     
     // Check NS delegation
     try {
-      const nsRecords = await this.resolveNs(config.domain);
+      const nsRecords = await this.resolveNs(config.domain, abortSignal);
+      if (abortSignal?.aborted) {
+        return result;
+      }
       const delegatedNameservers = dnsNsDomains.filter(ns => nsRecords.includes(ns));
       const isDelegated = delegatedNameservers.length > 0;
       
@@ -192,6 +229,9 @@ export class DnsManager {
         );
       }
     } catch (error) {
+      if (abortSignal?.aborted) {
+        return result;
+      }
       result.warnings.push(
         `Could not verify NS delegation for ${config.domain}: ${error.message}`
       );
@@ -203,7 +243,10 @@ export class DnsManager {
   /**
    * Validate external DNS mode configuration
    */
-  private async validateExternalDnsMode(config: IEmailDomainConfig): Promise<IDnsValidationResult> {
+  private async validateExternalDnsMode(
+    config: IEmailDomainConfig,
+    abortSignal?: AbortSignal
+  ): Promise<IDnsValidationResult> {
     const result: IDnsValidationResult = {
       valid: true,
       errors: [],
@@ -213,7 +256,10 @@ export class DnsManager {
     
     try {
       // Get current DNS records
-      const records = await this.checkDnsRecords(config);
+      const records = await this.checkDnsRecords(config, abortSignal);
+      if (abortSignal?.aborted) {
+        return result;
+      }
       const requiredRecords = config.dns?.external?.requiredRecords || ['MX', 'SPF', 'DKIM', 'DMARC'];
       
       // Check MX record
@@ -233,22 +279,9 @@ export class DnsManager {
       // Check DKIM record
       if (requiredRecords.includes('DKIM') && !records.dkim) {
         const selector = config.dkim?.selector || 'default';
-        const dkimPublicKey = await this.storageManager.get(`/email/dkim/${config.domain}/public.key`);
-        
-        if (dkimPublicKey) {
-          const publicKeyBase64 = dkimPublicKey
-            .replace(/-----BEGIN PUBLIC KEY-----/g, '')
-            .replace(/-----END PUBLIC KEY-----/g, '')
-            .replace(/\s/g, '');
-            
-          result.requiredChanges.push(
-            `Add TXT record: ${selector}._domainkey.${config.domain} -> "v=DKIM1; k=rsa; p=${publicKeyBase64}"`
-          );
-        } else {
-          result.warnings.push(
-            `DKIM public key not found for ${config.domain}. It will be generated on first use.`
-          );
-        }
+        result.requiredChanges.push(
+          `Add TXT record: ${selector}._domainkey.${config.domain} -> "v=DKIM1; k=rsa; p=<generated-public-key>"`
+        );
       }
       
       // Check DMARC record
@@ -269,6 +302,9 @@ export class DnsManager {
       }
       
     } catch (error) {
+      if (abortSignal?.aborted) {
+        return result;
+      }
       result.errors.push(`DNS validation failed: ${error.message}`);
       result.valid = false;
     }
@@ -279,62 +315,80 @@ export class DnsManager {
   /**
    * Check DNS records for a domain
    */
-  private async checkDnsRecords(config: IEmailDomainConfig): Promise<IDnsRecords> {
+  private async checkDnsRecords(
+    config: IEmailDomainConfig,
+    abortSignal?: AbortSignal
+  ): Promise<IDnsRecords> {
     const records: IDnsRecords = {};
     const baseDomain = this.getBaseDomain(config.domain);
     const selector = config.dkim?.selector || 'default';
     
     // Use custom DNS servers if specified
-    const resolver = new plugins.dns.promises.Resolver();
+    const resolver = this.createTrackedResolver();
     if (config.dns?.external?.servers?.length) {
       resolver.setServers(config.dns.external.servers);
     }
-    
-    // Check MX records
-    try {
-      const mxRecords = await resolver.resolveMx(baseDomain);
-      records.mx = mxRecords.map(mx => mx.exchange);
-    } catch (error) {
-      logger.log('debug', `No MX records found for ${baseDomain}`);
-    }
-    
-    // Check SPF record
-    try {
-      const txtRecords = await resolver.resolveTxt(baseDomain);
-      const spfRecord = txtRecords.find(records => 
-        records.some(record => record.startsWith('v=spf1'))
-      );
-      if (spfRecord) {
-        records.spf = spfRecord.join('');
-      }
-    } catch (error) {
-      logger.log('debug', `No SPF record found for ${baseDomain}`);
-    }
-    
-    // Check DKIM record
-    try {
-      const dkimRecords = await resolver.resolveTxt(`${selector}._domainkey.${config.domain}`);
-      const dkimRecord = dkimRecords.find(records => 
-        records.some(record => record.includes('v=DKIM1'))
-      );
-      if (dkimRecord) {
-        records.dkim = dkimRecord.join('');
-      }
-    } catch (error) {
-      logger.log('debug', `No DKIM record found for ${selector}._domainkey.${config.domain}`);
-    }
-    
-    // Check DMARC record
+
     try {
-      const dmarcRecords = await resolver.resolveTxt(`_dmarc.${baseDomain}`);
-      const dmarcRecord = dmarcRecords.find(records => 
-        records.some(record => record.startsWith('v=DMARC1'))
-      );
-      if (dmarcRecord) {
-        records.dmarc = dmarcRecord.join('');
-      }
-    } catch (error) {
-      logger.log('debug', `No DMARC record found for _dmarc.${baseDomain}`);
+      await Promise.all([
+        (async () => {
+          try {
+            const mxRecords = await resolver.resolveMx(baseDomain);
+            records.mx = mxRecords.map(mx => mx.exchange);
+          } catch {
+            if (!abortSignal?.aborted) {
+              logger.log('debug', `No MX records found for ${baseDomain}`);
+            }
+          }
+        })(),
+        (async () => {
+          try {
+            const txtRecords = await resolver.resolveTxt(baseDomain);
+            const spfRecord = txtRecords.find(txtParts =>
+              txtParts.some(record => record.startsWith('v=spf1'))
+            );
+            if (spfRecord) {
+              records.spf = spfRecord.join('');
+            }
+          } catch {
+            if (!abortSignal?.aborted) {
+              logger.log('debug', `No SPF record found for ${baseDomain}`);
+            }
+          }
+        })(),
+        (async () => {
+          try {
+            const dkimRecords = await resolver.resolveTxt(`${selector}._domainkey.${config.domain}`);
+            const dkimRecord = dkimRecords.find(txtParts =>
+              txtParts.some(record => record.includes('v=DKIM1'))
+            );
+            if (dkimRecord) {
+              records.dkim = dkimRecord.join('');
+            }
+          } catch {
+            if (!abortSignal?.aborted) {
+              logger.log('debug', `No DKIM record found for ${selector}._domainkey.${config.domain}`);
+            }
+          }
+        })(),
+        (async () => {
+          try {
+            const dmarcRecords = await resolver.resolveTxt(`_dmarc.${baseDomain}`);
+            const dmarcRecord = dmarcRecords.find(txtParts =>
+              txtParts.some(record => record.startsWith('v=DMARC1'))
+            );
+            if (dmarcRecord) {
+              records.dmarc = dmarcRecord.join('');
+            }
+          } catch {
+            if (!abortSignal?.aborted) {
+              logger.log('debug', `No DMARC record found for _dmarc.${baseDomain}`);
+            }
+          }
+        })(),
+      ]);
+    } finally {
+      this.activeResolvers.delete(resolver);
     }
     
     return records;
@@ -343,16 +397,37 @@ export class DnsManager {
   /**
    * Resolve NS records for a domain
    */
-  private async resolveNs(domain: string): Promise<string[]> {
+  private async resolveNs(domain: string, abortSignal?: AbortSignal): Promise<string[]> {
+    const resolver = this.createTrackedResolver();
     try {
-      const resolver = new plugins.dns.promises.Resolver();
       const nsRecords = await resolver.resolveNs(domain);
       return nsRecords;
     } catch (error) {
-      logger.log('warn', `Failed to resolve NS records for ${domain}: ${error.message}`);
+      if (!abortSignal?.aborted) {
+        logger.log('warn', `Failed to resolve NS records for ${domain}: ${error.message}`);
+      }
       return [];
+    } finally {
+      this.activeResolvers.delete(resolver);
     }
   }
+
+  private createTrackedResolver(): IDnsResolver {
+    const resolver = this.resolverFactory();
+    this.activeResolvers.add(resolver);
+    return resolver;
+  }
+
+  private cancelActiveResolvers(): void {
+    for (const resolver of this.activeResolvers) {
+      try {
+        resolver.cancel();
+      } catch {
+        // Resolver may already have completed or been cancelled.
+      }
+    }
+    this.activeResolvers.clear();
+  }
   
   /**
    * Get base domain from email domain (e.g., mail.example.com -> example.com)
@@ -373,17 +448,10 @@ export class DnsManager {
     return parts.slice(-2).join('.');
   }
   
-  /**
-   * Ensure all DNS records are created for configured domains
-   * This is the main entry point for DNS record management
-   */
-  async ensureDnsRecords(domainConfigs: IEmailDomainConfig[], dkimCreator?: any): Promise<void> {
-    logger.log('info', `Ensuring DNS records for ${domainConfigs.length} domains`);
-    
-    // First, validate all domains
-    const validationResults = await this.validateAllDomains(domainConfigs);
-    
-    // Then create records for internal-dns domains
+  /** Provision deterministic local DNS records without performing network lookups. */
+  async provisionLocalDnsRecords(domainConfigs: IEmailDomainConfig[], dkimCreator?: any): Promise<void> {
+    logger.log('info', `Provisioning local DNS records for ${domainConfigs.length} domains`);
+
     const internalDnsDomains = domainConfigs.filter(config => config.dnsMode === 'internal-dns');
     if (internalDnsDomains.length > 0) {
       await this.createInternalDnsRecords(internalDnsDomains);
@@ -393,8 +461,81 @@ export class DnsManager {
         await this.createDkimRecords(domainConfigs, dkimCreator);
       }
     }
-    
-    // Log validation results for external-dns domains
+  }
+
+  /** Validate public DNS state with a single bounded, cancellable validation run. */
+  async validateAndReportDnsRecords(
+    domainConfigs: IEmailDomainConfig[],
+    timeoutMs = 30_000
+  ): Promise<void> {
+    this.cancelValidation();
+
+    const runId = ++this.validationRunId;
+    const abortController = new AbortController();
+    let cancelRun!: () => void;
+    const cancellationPromise = new Promise<{ kind: 'cancelled' }>((resolve) => {
+      cancelRun = () => resolve({ kind: 'cancelled' });
+    });
+    this.activeValidation = { id: runId, abortController, cancel: cancelRun };
+
+    let timeout: NodeJS.Timeout | undefined;
+    const timeoutPromise = new Promise<{ kind: 'timeout' }>((resolve) => {
+      timeout = setTimeout(() => {
+        abortController.abort();
+        this.cancelActiveResolvers();
+        resolve({ kind: 'timeout' });
+      }, timeoutMs);
+    });
+    const validationPromise = this.validateAllDomains(
+      domainConfigs,
+      abortController.signal
+    ).then((results) => ({
+      kind: 'completed' as const,
+      results,
+    }));
+
+    try {
+      const outcome = await Promise.race([
+        validationPromise,
+        timeoutPromise,
+        cancellationPromise,
+      ]);
+
+      if (outcome.kind === 'cancelled') {
+        return;
+      }
+      if (outcome.kind === 'timeout') {
+        throw new Error(`DNS validation timed out after ${timeoutMs} ms`);
+      }
+      if (this.activeValidation?.id !== runId) {
+        return;
+      }
+
+      this.reportValidationResults(domainConfigs, outcome.results);
+    } finally {
+      if (timeout) {
+        clearTimeout(timeout);
+      }
+      if (this.activeValidation?.id === runId) {
+        this.activeValidation = undefined;
+        this.cancelActiveResolvers();
+      }
+    }
+  }
+
+  /** Cancel the current validation run and all DNS requests owned by it. */
+  cancelValidation(): void {
+    const activeValidation = this.activeValidation;
+    this.activeValidation = undefined;
+    activeValidation?.abortController.abort();
+    activeValidation?.cancel();
+    this.cancelActiveResolvers();
+  }
+
+  private reportValidationResults(
+    domainConfigs: IEmailDomainConfig[],
+    validationResults: Map<string, IDnsValidationResult>
+  ): void {
     for (const [domain, result] of validationResults) {
       const config = domainConfigs.find(c => c.domain === domain);
       if (config?.dnsMode === 'external-dns' && result.requiredChanges.length > 0) {
@@ -402,6 +543,15 @@ export class DnsManager {
       }
     }
   }
+
+  /**
+   * Ensure DNS records and validate public DNS state.
+   * Prefer the split lifecycle methods when validation must not block readiness.
+   */
+  async ensureDnsRecords(domainConfigs: IEmailDomainConfig[], dkimCreator?: any): Promise<void> {
+    await this.provisionLocalDnsRecords(domainConfigs, dkimCreator);
+    await this.validateAndReportDnsRecords(domainConfigs);
+  }
   
   /**
    * Create DNS records for internal-dns mode domains

package/ts/mail/routing/classes.unified.email.server.ts

@@ -254,6 +254,10 @@ export class UnifiedEmailServer extends EventEmitter {
   // Extracted subsystems
   private actionExecutor: EmailActionExecutor;
   private dkimManager: DkimManager;
+  private dnsManager: DnsManager;
+  private dnsValidationTask?: Promise<void>;
+  private dnsValidationGeneration = 0;
+  private localDnsProvisioned = false;
   private bridgeStateChangeHandler?: (event: { oldState: string; newState: string }) => void;
   private bridgeRcptToRequestHandler?: (data: IRcptToRequestEvent) => void;
   private bridgeEmailReceivedHandler?: (data: IEmailReceivedEvent) => void;
@@ -343,6 +347,7 @@ export class UnifiedEmailServer extends EventEmitter {
 
     // Initialize DKIM manager
     this.dkimManager = new DkimManager(this.dkimCreator, this.domainRegistry, dcRouter, this.rustBridge);
+    this.dnsManager = new DnsManager(this.dcRouter);
 
     // Initialize statistics
     this.stats = {
@@ -374,6 +379,22 @@ export class UnifiedEmailServer extends EventEmitter {
     return this.options.outbound?.hostname || this.options.hostname;
   }
 
+  /**
+   * Whether a hostname refers to this server's own SMTP identity.
+   * Used by MTA delivery to refuse self-addressed relaying: a domain whose
+   * MX resolves back to this server would otherwise mail-loop through the
+   * full outbound/inbound pipeline forever.
+   */
+  public isSelfHostname(hostname: string): boolean {
+    const normalize = (name: string) => name.toLowerCase().replace(/\.$/, '');
+    const candidate = normalize(hostname);
+    if (!candidate) return false;
+    return (
+      candidate === normalize(this.options.hostname) ||
+      candidate === normalize(this.options.outbound?.hostname || '')
+    );
+  }
+
   /**
    * Send an outbound email via the Rust SMTP client.
    * Uses connection pooling in the Rust binary for efficiency.
@@ -453,6 +474,7 @@ export class UnifiedEmailServer extends EventEmitter {
       await this.initializeDkimAndDns();
       this.registerBridgeEventHandlers();
       await this.startSmtpServer();
+      this.startDnsValidation();
       logger.log('info', 'UnifiedEmailServer started successfully');
       this.emit('started');
     } catch (error) {
@@ -494,9 +516,14 @@ export class UnifiedEmailServer extends EventEmitter {
     await this.dkimManager.setupDkimForDomains();
     logger.log('info', 'DKIM configuration completed for all domains');
 
-    const dnsManager = new DnsManager(this.dcRouter);
-    await dnsManager.ensureDnsRecords(this.domainRegistry.getAllConfigs(), this.dkimCreator);
-    logger.log('info', 'DNS records ensured for all configured domains');
+    if (!this.localDnsProvisioned) {
+      await this.dnsManager.provisionLocalDnsRecords(
+        this.domainRegistry.getAllConfigs(),
+        this.dkimCreator
+      );
+      this.localDnsProvisioned = true;
+      logger.log('info', 'Local DNS records provisioned for all configured domains');
+    }
 
     this.applyDomainRateLimits();
     logger.log('info', 'Per-domain rate limits configured');
@@ -505,6 +532,34 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', 'DKIM key rotation check completed');
   }
 
+  private startDnsValidation(): void {
+    const generation = ++this.dnsValidationGeneration;
+    let task: Promise<void>;
+    task = this.dnsManager
+      .validateAndReportDnsRecords(this.domainRegistry.getAllConfigs())
+      .catch((error) => {
+        if (this.dnsValidationGeneration === generation) {
+          logger.log('warn', `Background DNS validation did not complete: ${(error as Error).message}`);
+        }
+      })
+      .finally(() => {
+        if (this.dnsValidationGeneration === generation && this.dnsValidationTask === task) {
+          this.dnsValidationTask = undefined;
+        }
+      });
+    this.dnsValidationTask = task;
+  }
+
+  private async stopDnsValidation(): Promise<void> {
+    this.dnsValidationGeneration++;
+    const task = this.dnsValidationTask;
+    this.dnsValidationTask = undefined;
+    this.dnsManager.cancelValidation();
+    if (task) {
+      await task;
+    }
+  }
+
   private registerBridgeEventHandlers(): void {
     this.unregisterBridgeEventHandlers();
 
@@ -676,6 +731,8 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', 'Stopping UnifiedEmailServer');
 
     try {
+      await this.stopDnsValidation();
+
       // Stop the Rust SMTP server first
       try {
         await this.rustBridge.stopSmtpServer();
@@ -1457,6 +1514,16 @@ export class UnifiedEmailServer extends EventEmitter {
     return this.deliveryQueue.listItems();
   }
 
+  /**
+   * Current lifecycle state of the Rust mailer bridge
+   * ('idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped').
+   * Embedders surface this in health/ops endpoints — a bridge in 'failed'
+   * or 'restarting' means mail processing is degraded.
+   */
+  public getBridgeState(): string {
+    return this.rustBridge.state;
+  }
+
   public getQueueItem(id: string): IQueueItem | undefined {
     return this.deliveryQueue.getItem(id);
   }