@serve.zone/dcrouter 13.18.0 → 13.19.1

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '13.18.0',
+  version: '13.19.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -30,7 +30,8 @@ import { SecurityLogger, ContentScanner, IPReputationChecker } from './security/
 import { type IHttp3Config, augmentRoutesWithHttp3 } from './http3/index.js';
 import { DnsManager } from './dns/manager.dns.js';
 import { AcmeConfigManager } from './acme/manager.acme-config.js';
-import { EmailDomainManager, SmartMtaStorageManager } from './email/index.js';
+import { EmailDomainManager, SmartMtaStorageManager, buildEmailDnsRecords } from './email/index.js';
+import type { IRoute } from '../ts_interfaces/data/route-management.js';
 
 export interface IDcRouterOptions {
   /** Base directory for all dcrouter data. Defaults to ~/.serve.zone/dcrouter */
@@ -314,7 +315,8 @@ export class DcRouter {
   // Seed routes assembled during setupSmartProxy, passed to RouteConfigManager for DB seeding
   private seedConfigRoutes: plugins.smartproxy.IRouteConfig[] = [];
   private seedEmailRoutes: plugins.smartproxy.IRouteConfig[] = [];
-  // Runtime-only DoH routes. These carry live socket handlers and must never be persisted.
+  private seedDnsRoutes: plugins.smartproxy.IRouteConfig[] = [];
+  // Live DoH routes used during SmartProxy bootstrap before RouteConfigManager re-applies stored routes.
   private runtimeDnsRoutes: plugins.smartproxy.IRouteConfig[] = [];
 
   // Environment access
@@ -588,13 +590,15 @@ export class DcRouter {
                   this.tunnelManager.syncAllowedEdges();
                 }
               },
-              () => this.runtimeDnsRoutes,
+              undefined,
+              (storedRoute: IRoute) => this.hydrateStoredRouteForRuntime(storedRoute),
             );
             this.apiTokenManager = new ApiTokenManager();
             await this.apiTokenManager.initialize();
             await this.routeConfigManager.initialize(
               this.seedConfigRoutes as import('../ts_interfaces/data/remoteingress.js').IDcRouterRouteConfig[],
               this.seedEmailRoutes as import('../ts_interfaces/data/remoteingress.js').IDcRouterRouteConfig[],
+              this.seedDnsRoutes as import('../ts_interfaces/data/remoteingress.js').IDcRouterRouteConfig[],
             );
             await this.targetProfileManager.normalizeAllRouteRefs();
 
@@ -912,10 +916,12 @@ export class DcRouter {
       logger.log('debug', 'Email routes generated', { routes: JSON.stringify(this.seedEmailRoutes) });
     }
 
+    this.seedDnsRoutes = [];
     this.runtimeDnsRoutes = [];
     if (this.options.dnsNsDomains && this.options.dnsNsDomains.length > 0) {
-      this.runtimeDnsRoutes = this.generateDnsRoutes();
-      logger.log('debug', `DNS routes for nameservers ${this.options.dnsNsDomains.join(', ')}`, { routes: JSON.stringify(this.runtimeDnsRoutes) });
+      this.seedDnsRoutes = this.generateDnsRoutes({ includeSocketHandler: false });
+      this.runtimeDnsRoutes = this.generateDnsRoutes({ includeSocketHandler: true });
+      logger.log('debug', `DNS routes for nameservers ${this.options.dnsNsDomains.join(', ')}`, { routes: JSON.stringify(this.seedDnsRoutes) });
     }
 
     // Combined routes for SmartProxy bootstrap (before DB routes are loaded)
@@ -1338,19 +1344,20 @@ export class DcRouter {
   /**
    * Generate SmartProxy routes for DNS configuration
    */
-  private generateDnsRoutes(): plugins.smartproxy.IRouteConfig[] {
+  private generateDnsRoutes(options?: { includeSocketHandler?: boolean }): plugins.smartproxy.IRouteConfig[] {
     if (!this.options.dnsNsDomains || this.options.dnsNsDomains.length === 0) {
       return [];
     }
-    
+
+    const includeSocketHandler = options?.includeSocketHandler !== false;
     const dnsRoutes: plugins.smartproxy.IRouteConfig[] = [];
-    
+
     // Create routes for DNS-over-HTTPS paths
     const dohPaths = ['/dns-query', '/resolve'];
-    
+
     // Use the first nameserver domain for DoH routes
     const primaryNameserver = this.options.dnsNsDomains[0];
-    
+
     for (const path of dohPaths) {
       const dohRoute: plugins.smartproxy.IRouteConfig = {
         name: `dns-over-https-${path.replace('/', '')}`,
@@ -1359,18 +1366,42 @@ export class DcRouter {
           domains: [primaryNameserver],
           path: path
         },
-        action: {
-          type: 'socket-handler' as any,
-          socketHandler: this.createDnsSocketHandler()
-        } as any
+        action: includeSocketHandler
+          ? {
+              type: 'socket-handler' as any,
+              socketHandler: this.createDnsSocketHandler()
+            } as any
+          : {
+              type: 'socket-handler' as any,
+            } as any
       };
-      
+
       dnsRoutes.push(dohRoute);
     }
-    
+
     return dnsRoutes;
   }
 
+  private hydrateStoredRouteForRuntime(storedRoute: IRoute): plugins.smartproxy.IRouteConfig | undefined {
+    const routeName = storedRoute.route.name || '';
+    const isDohRoute = storedRoute.origin === 'dns'
+      && storedRoute.route.action?.type === 'socket-handler'
+      && routeName.startsWith('dns-over-https-');
+
+    if (!isDohRoute) {
+      return undefined;
+    }
+
+    return {
+      ...storedRoute.route,
+      action: {
+        ...storedRoute.route.action,
+        type: 'socket-handler' as any,
+        socketHandler: this.createDnsSocketHandler(),
+      } as any,
+    };
+  }
+
   /**
    * Check if a domain matches a pattern (including wildcard support)
    * @param domain The domain to check
@@ -1939,37 +1970,20 @@ export class DcRouter {
     for (const domainConfig of internalDnsDomains) {
       const domain = domainConfig.domain;
       const ttl = domainConfig.dns?.internal?.ttl || 3600;
-      const mxPriority = domainConfig.dns?.internal?.mxPriority || 10;
-      
-      // MX record - points to the domain itself for email handling
-      records.push({
-        name: domain,
-        type: 'MX',
-        value: `${mxPriority} ${domain}`,
-        ttl
-      });
-      
-      // SPF record - using sensible defaults
-      const spfRecord = 'v=spf1 a mx ~all';
-      records.push({
-        name: domain,
-        type: 'TXT',
-        value: spfRecord,
-        ttl
-      });
-      
-      // DMARC record - using sensible defaults
-      const dmarcPolicy = 'none'; // Start with 'none' policy for monitoring
-      const dmarcEmail = `dmarc@${domain}`;
-      records.push({
-        name: `_dmarc.${domain}`,
-        type: 'TXT',
-        value: `v=DMARC1; p=${dmarcPolicy}; rua=mailto:${dmarcEmail}`,
-        ttl
-      });
-      
-      // Note: DKIM records will be generated later when DKIM keys are available
-      // They require the DKIMCreator which is part of the email server
+      const requiredRecords = buildEmailDnsRecords({
+        domain,
+        hostname: this.options.emailConfig.hostname,
+        mxPriority: domainConfig.dns?.internal?.mxPriority,
+      }).filter((record) => !record.name.includes('._domainkey.'));
+
+      for (const record of requiredRecords) {
+        records.push({
+          name: record.name,
+          type: record.type,
+          value: record.value,
+          ttl,
+        });
+      }
     }
     
     logger.log('info', `Generated ${records.length} email DNS records for ${internalDnsDomains.length} internal-dns domains`);

package/ts/config/classes.route-config-manager.ts

@@ -14,6 +14,11 @@ import type { ReferenceResolver } from './classes.reference-resolver.js';
 /** An IP allow entry: plain IP/CIDR or domain-scoped. */
 export type TIpAllowEntry = string | { ip: string; domains: string[] };
 
+export interface IRouteMutationResult {
+  success: boolean;
+  message?: string;
+}
+
 /**
  * Simple async mutex — serializes concurrent applyRoutes() calls so the Rust engine
  * never receives rapid overlapping route updates that can churn UDP/QUIC listeners.
@@ -56,6 +61,7 @@ export class RouteConfigManager {
     private referenceResolver?: ReferenceResolver,
     private onRoutesApplied?: (routes: plugins.smartproxy.IRouteConfig[]) => void,
     private getRuntimeRoutes?: () => plugins.smartproxy.IRouteConfig[],
+    private hydrateStoredRoute?: (storedRoute: IRoute) => plugins.smartproxy.IRouteConfig | undefined,
   ) {}
 
   /** Expose routes map for reference resolution lookups. */
@@ -63,6 +69,10 @@ export class RouteConfigManager {
     return this.routes;
   }
 
+  public getRoute(id: string): IRoute | undefined {
+    return this.routes.get(id);
+  }
+
   /**
    * Load persisted routes, seed serializable config/email/dns routes,
    * compute warnings, and apply the combined DB-backed + runtime route set to SmartProxy.
@@ -94,6 +104,7 @@ export class RouteConfigManager {
         id: route.id,
         enabled: route.enabled,
         origin: route.origin,
+        systemKey: route.systemKey,
         createdAt: route.createdAt,
         updatedAt: route.updatedAt,
         metadata: route.metadata,
@@ -122,11 +133,11 @@ export class RouteConfigManager {
     }
 
     // Resolve references if metadata has refs and resolver is available
-    let resolvedMetadata = metadata;
-    if (metadata && this.referenceResolver) {
-      const resolved = this.referenceResolver.resolveRoute(route, metadata);
+    let resolvedMetadata = this.normalizeRouteMetadata(metadata);
+    if (resolvedMetadata && this.referenceResolver) {
+      const resolved = this.referenceResolver.resolveRoute(route, resolvedMetadata);
       route = resolved.route;
-      resolvedMetadata = resolved.metadata;
+      resolvedMetadata = this.normalizeRouteMetadata(resolved.metadata);
     }
 
     const stored: IRoute = {
@@ -153,9 +164,21 @@ export class RouteConfigManager {
       enabled?: boolean;
       metadata?: Partial<IRouteMetadata>;
     },
-  ): Promise<boolean> {
+  ): Promise<IRouteMutationResult> {
     const stored = this.routes.get(id);
-    if (!stored) return false;
+    if (!stored) {
+      return { success: false, message: 'Route not found' };
+    }
+
+    const isToggleOnlyPatch = patch.enabled !== undefined
+      && patch.route === undefined
+      && patch.metadata === undefined;
+    if (stored.origin !== 'api' && !isToggleOnlyPatch) {
+      return {
+        success: false,
+        message: 'System routes are managed by the system and can only be toggled',
+      };
+    }
 
     if (patch.route) {
       const mergedAction = patch.route.action
@@ -175,33 +198,46 @@ export class RouteConfigManager {
       stored.enabled = patch.enabled;
     }
     if (patch.metadata !== undefined) {
-      stored.metadata = { ...stored.metadata, ...patch.metadata };
+      stored.metadata = this.normalizeRouteMetadata({
+        ...stored.metadata,
+        ...patch.metadata,
+      });
     }
 
     // Re-resolve if metadata refs exist and resolver is available
     if (stored.metadata && this.referenceResolver) {
       const resolved = this.referenceResolver.resolveRoute(stored.route, stored.metadata);
       stored.route = resolved.route;
-      stored.metadata = resolved.metadata;
+      stored.metadata = this.normalizeRouteMetadata(resolved.metadata);
     }
 
     stored.updatedAt = Date.now();
 
     await this.persistRoute(stored);
     await this.applyRoutes();
-    return true;
+    return { success: true };
   }
 
-  public async deleteRoute(id: string): Promise<boolean> {
-    if (!this.routes.has(id)) return false;
+  public async deleteRoute(id: string): Promise<IRouteMutationResult> {
+    const stored = this.routes.get(id);
+    if (!stored) {
+      return { success: false, message: 'Route not found' };
+    }
+    if (stored.origin !== 'api') {
+      return {
+        success: false,
+        message: 'System routes are managed by the system and cannot be deleted',
+      };
+    }
+
     this.routes.delete(id);
     const doc = await RouteDoc.findById(id);
     if (doc) await doc.delete();
     await this.applyRoutes();
-    return true;
+    return { success: true };
   }
 
-  public async toggleRoute(id: string, enabled: boolean): Promise<boolean> {
+  public async toggleRoute(id: string, enabled: boolean): Promise<IRouteMutationResult> {
     return this.updateRoute(id, { enabled });
   }
 
@@ -217,29 +253,28 @@ export class RouteConfigManager {
     seedRoutes: IDcRouterRouteConfig[],
     origin: 'config' | 'email' | 'dns',
   ): Promise<void> {
-    if (seedRoutes.length === 0) return;
-
+    const seedSystemKeys = new Set<string>();
     const seedNames = new Set<string>();
     let seeded = 0;
     let updated = 0;
 
     for (const route of seedRoutes) {
       const name = route.name || '';
-      seedNames.add(name);
-
-      // Check if a route with this name+origin already exists in memory
-      let existingId: string | undefined;
-      for (const [id, r] of this.routes) {
-        if (r.origin === origin && r.route.name === name) {
-          existingId = id;
-          break;
-        }
+      if (name) {
+        seedNames.add(name);
+      }
+      const systemKey = this.buildSystemRouteKey(origin, route);
+      if (systemKey) {
+        seedSystemKeys.add(systemKey);
       }
 
+      const existingId = this.findExistingSeedRouteId(origin, route, systemKey);
+
       if (existingId) {
         // Update route config but preserve enabled state
         const existing = this.routes.get(existingId)!;
         existing.route = route;
+        existing.systemKey = systemKey;
         existing.updatedAt = Date.now();
         await this.persistRoute(existing);
         updated++;
@@ -255,6 +290,7 @@ export class RouteConfigManager {
           updatedAt: now,
           createdBy: 'system',
           origin,
+          systemKey,
         };
         this.routes.set(id, newRoute);
         await this.persistRoute(newRoute);
@@ -265,7 +301,12 @@ export class RouteConfigManager {
     // Delete stale routes: same origin but name not in current seed set
     const staleIds: string[] = [];
     for (const [id, r] of this.routes) {
-      if (r.origin === origin && !seedNames.has(r.route.name || '')) {
+      if (r.origin !== origin) continue;
+
+      const routeName = r.route.name || '';
+      const matchesSeedSystemKey = r.systemKey ? seedSystemKeys.has(r.systemKey) : false;
+      const matchesSeedName = routeName ? seedNames.has(routeName) : false;
+      if (!matchesSeedSystemKey && !matchesSeedName) {
         staleIds.push(id);
       }
     }
@@ -284,9 +325,39 @@ export class RouteConfigManager {
   // Private: persistence
   // =========================================================================
 
+  private buildSystemRouteKey(
+    origin: 'config' | 'email' | 'dns',
+    route: IDcRouterRouteConfig,
+  ): string | undefined {
+    const name = route.name?.trim();
+    if (!name) return undefined;
+    return `${origin}:${name}`;
+  }
+
+  private findExistingSeedRouteId(
+    origin: 'config' | 'email' | 'dns',
+    route: IDcRouterRouteConfig,
+    systemKey?: string,
+  ): string | undefined {
+    const routeName = route.name || '';
+
+    for (const [id, storedRoute] of this.routes) {
+      if (storedRoute.origin !== origin) continue;
+
+      if (systemKey && storedRoute.systemKey === systemKey) {
+        return id;
+      }
+
+      if (storedRoute.route.name === routeName) {
+        return id;
+      }
+    }
+
+    return undefined;
+  }
+
   private async loadRoutes(): Promise<void> {
     const docs = await RouteDoc.findAll();
-    let prunedRuntimeRoutes = 0;
 
     for (const doc of docs) {
       if (!doc.id) continue;
@@ -299,27 +370,15 @@ export class RouteConfigManager {
         updatedAt: doc.updatedAt,
         createdBy: doc.createdBy,
         origin: doc.origin || 'api',
-        metadata: doc.metadata,
+        systemKey: doc.systemKey,
+        metadata: this.normalizeRouteMetadata(doc.metadata),
       };
 
-      if (this.isPersistedRuntimeRoute(storedRoute)) {
-        await doc.delete();
-        prunedRuntimeRoutes++;
-        logger.log(
-          'warn',
-          `Removed persisted runtime-only route '${storedRoute.route.name || storedRoute.id}' (${storedRoute.id}) from RouteDoc`,
-        );
-        continue;
-      }
-
       this.routes.set(doc.id, storedRoute);
     }
     if (this.routes.size > 0) {
       logger.log('info', `Loaded ${this.routes.size} route(s) from database`);
     }
-    if (prunedRuntimeRoutes > 0) {
-      logger.log('info', `Pruned ${prunedRuntimeRoutes} persisted runtime-only route(s) from RouteDoc`);
-    }
   }
 
   private async persistRoute(stored: IRoute): Promise<void> {
@@ -330,6 +389,7 @@ export class RouteConfigManager {
       existingDoc.updatedAt = stored.updatedAt;
       existingDoc.createdBy = stored.createdBy;
       existingDoc.origin = stored.origin;
+      existingDoc.systemKey = stored.systemKey;
       existingDoc.metadata = stored.metadata;
       await existingDoc.save();
     } else {
@@ -341,11 +401,52 @@ export class RouteConfigManager {
       doc.updatedAt = stored.updatedAt;
       doc.createdBy = stored.createdBy;
       doc.origin = stored.origin;
+      doc.systemKey = stored.systemKey;
       doc.metadata = stored.metadata;
       await doc.save();
     }
   }
 
+  private normalizeRouteMetadata(metadata?: Partial<IRouteMetadata>): IRouteMetadata | undefined {
+    if (!metadata) {
+      return undefined;
+    }
+
+    const normalizeString = (value?: string): string | undefined => {
+      if (typeof value !== 'string') {
+        return undefined;
+      }
+      const trimmed = value.trim();
+      return trimmed.length > 0 ? trimmed : undefined;
+    };
+
+    const normalized: IRouteMetadata = {
+      sourceProfileRef: normalizeString(metadata.sourceProfileRef),
+      networkTargetRef: normalizeString(metadata.networkTargetRef),
+      sourceProfileName: normalizeString(metadata.sourceProfileName),
+      networkTargetName: normalizeString(metadata.networkTargetName),
+      lastResolvedAt: typeof metadata.lastResolvedAt === 'number' && Number.isFinite(metadata.lastResolvedAt)
+        ? metadata.lastResolvedAt
+        : undefined,
+    };
+
+    if (!normalized.sourceProfileRef) {
+      normalized.sourceProfileName = undefined;
+    }
+    if (!normalized.networkTargetRef) {
+      normalized.networkTargetName = undefined;
+    }
+    if (!normalized.sourceProfileRef && !normalized.networkTargetRef) {
+      normalized.lastResolvedAt = undefined;
+    }
+
+    if (Object.values(normalized).every((value) => value === undefined)) {
+      return undefined;
+    }
+
+    return normalized;
+  }
+
   // =========================================================================
   // Private: warnings
   // =========================================================================
@@ -388,7 +489,7 @@ export class RouteConfigManager {
 
       const resolved = this.referenceResolver.resolveRoute(stored.route, stored.metadata);
       stored.route = resolved.route;
-      stored.metadata = resolved.metadata;
+      stored.metadata = this.normalizeRouteMetadata(resolved.metadata);
       stored.updatedAt = Date.now();
       await this.persistRoute(stored);
     }
@@ -411,7 +512,7 @@ export class RouteConfigManager {
       // Add all enabled routes with HTTP/3 and VPN augmentation
       for (const route of this.routes.values()) {
         if (route.enabled) {
-          enabledRoutes.push(this.prepareRouteForApply(route.route, route.id));
+          enabledRoutes.push(this.prepareStoredRouteForApply(route));
         }
       }
 
@@ -431,6 +532,11 @@ export class RouteConfigManager {
     });
   }
 
+  private prepareStoredRouteForApply(storedRoute: IRoute): plugins.smartproxy.IRouteConfig {
+    const hydratedRoute = this.hydrateStoredRoute?.(storedRoute);
+    return this.prepareRouteForApply(hydratedRoute || storedRoute.route, storedRoute.id);
+  }
+
   private prepareRouteForApply(
     route: plugins.smartproxy.IRouteConfig,
     routeId?: string,
@@ -465,12 +571,4 @@ export class RouteConfigManager {
       },
     };
   }
-
-  private isPersistedRuntimeRoute(storedRoute: IRoute): boolean {
-    const routeName = storedRoute.route.name || '';
-    const actionType = storedRoute.route.action?.type;
-
-    return (routeName.startsWith('dns-over-https-') && actionType === 'socket-handler')
-      || (storedRoute.origin === 'dns' && actionType === 'socket-handler');
-  }
 }

package/ts/db/documents/classes.route.doc.ts

@@ -29,6 +29,9 @@ export class RouteDoc extends plugins.smartdata.SmartDataDbDoc<RouteDoc, RouteDo
   @plugins.smartdata.svDb()
   public origin!: 'config' | 'email' | 'dns' | 'api';
 
+  @plugins.smartdata.svDb()
+  public systemKey?: string;
+
   @plugins.smartdata.svDb()
   public metadata?: IRouteMetadata;
 
@@ -51,4 +54,8 @@ export class RouteDoc extends plugins.smartdata.SmartDataDbDoc<RouteDoc, RouteDo
   public static async findByOrigin(origin: 'config' | 'email' | 'dns' | 'api'): Promise<RouteDoc[]> {
     return await RouteDoc.getInstances({ origin });
   }
+
+  public static async findBySystemKey(systemKey: string): Promise<RouteDoc | null> {
+    return await RouteDoc.getInstance({ systemKey });
+  }
 }

package/ts/email/classes.email-domain.manager.ts

@@ -6,6 +6,7 @@ import { DomainDoc } from '../db/documents/classes.domain.doc.js';
 import { DnsRecordDoc } from '../db/documents/classes.dns-record.doc.js';
 import type { DnsManager } from '../dns/manager.dns.js';
 import type { IEmailDomain, IEmailDnsRecord, TDnsRecordStatus } from '../../ts_interfaces/data/email-domain.js';
+import { buildEmailDnsRecords } from './email-dns-records.js';
 
 /**
  * EmailDomainManager — orchestrates email domain setup.
@@ -181,34 +182,13 @@ export class EmailDomainManager {
       }
     }
 
-    const records: IEmailDnsRecord[] = [
-      {
-        type: 'MX',
-        name: domain,
-        value: `10 ${hostname}`,
-        status: doc.dnsStatus.mx,
-      },
-      {
-        type: 'TXT',
-        name: domain,
-        value: 'v=spf1 a mx ~all',
-        status: doc.dnsStatus.spf,
-      },
-      {
-        type: 'TXT',
-        name: `${selector}._domainkey.${domain}`,
-        value: dkimValue,
-        status: doc.dnsStatus.dkim,
-      },
-      {
-        type: 'TXT',
-        name: `_dmarc.${domain}`,
-        value: `v=DMARC1; p=none; rua=mailto:dmarc@${domain}`,
-        status: doc.dnsStatus.dmarc,
-      },
-    ];
-
-    return records;
+    return buildEmailDnsRecords({
+      domain,
+      hostname,
+      selector,
+      dkimValue,
+      statuses: doc.dnsStatus,
+    });
   }
 
   // ---------------------------------------------------------------------------

package/ts/email/email-dns-records.ts

@@ -0,0 +1,53 @@
+import type {
+  IEmailDnsRecord,
+  TDnsRecordStatus,
+} from '../../ts_interfaces/data/email-domain.js';
+
+type TEmailDnsStatusKey = 'mx' | 'spf' | 'dkim' | 'dmarc';
+
+export interface IBuildEmailDnsRecordsOptions {
+  domain: string;
+  hostname: string;
+  selector?: string;
+  dkimValue?: string;
+  mxPriority?: number;
+  dmarcPolicy?: string;
+  dmarcRua?: string;
+  statuses?: Partial<Record<TEmailDnsStatusKey, TDnsRecordStatus>>;
+}
+
+export function buildEmailDnsRecords(options: IBuildEmailDnsRecordsOptions): IEmailDnsRecord[] {
+  const statusFor = (key: TEmailDnsStatusKey): TDnsRecordStatus => options.statuses?.[key] ?? 'unchecked';
+  const selector = options.selector || 'default';
+  const records: IEmailDnsRecord[] = [
+    {
+      type: 'MX',
+      name: options.domain,
+      value: `${options.mxPriority ?? 10} ${options.hostname}`,
+      status: statusFor('mx'),
+    },
+    {
+      type: 'TXT',
+      name: options.domain,
+      value: 'v=spf1 a mx ~all',
+      status: statusFor('spf'),
+    },
+    {
+      type: 'TXT',
+      name: `_dmarc.${options.domain}`,
+      value: `v=DMARC1; p=${options.dmarcPolicy ?? 'none'}; rua=mailto:${options.dmarcRua ?? `dmarc@${options.domain}`}`,
+      status: statusFor('dmarc'),
+    },
+  ];
+
+  if (options.dkimValue) {
+    records.splice(2, 0, {
+      type: 'TXT',
+      name: `${selector}._domainkey.${options.domain}`,
+      value: options.dkimValue,
+      status: statusFor('dkim'),
+    });
+  }
+
+  return records;
+}

package/ts/email/index.ts

@@ -1,2 +1,3 @@
 export * from './classes.email-domain.manager.js';
 export * from './classes.smartmta-storage-manager.js';
+export * from './email-dns-records.js';