@serve.zone/dcrouter 15.10.0 → 16.0.0

package/ts/db/documents/classes.cached.email.ts

@@ -8,6 +8,12 @@ const TTL = plugins.smartdata.smartdataTtlValues;
  */
 export type TCachedEmailStatus = 'pending' | 'processing' | 'queued' | 'delivered' | 'failed' | 'deferred';
 
+/**
+ * Direction of an accepted email: 'inbound' = received from a remote peer,
+ * 'outbound' = locally submitted for delivery.
+ */
+export type TCachedEmailDirection = 'inbound' | 'outbound';
+
 /**
  * Helper to get the smartdata database instance
  */
@@ -112,6 +118,24 @@ export class CachedEmail extends plugins.smartdata.SmartdataCachedDocument<Cache
   @plugins.smartdata.svDb()
   public senderDomain!: string;
 
+  /**
+   * Direction of the accepted message (inbound receipt vs local submission)
+   */
+  @plugins.smartdata.svDb()
+  public direction: TCachedEmailDirection = 'outbound';
+
+  /**
+   * Lowercased recipient domains (for querying/filtering)
+   */
+  @plugins.smartdata.svDb()
+  public recipientDomains: string[] = [];
+
+  /**
+   * Epoch ms when the message was accepted (for newest-first listings)
+   */
+  @plugins.smartdata.svDb()
+  public acceptedAt: number = 0;
+
   /**
    * Priority level (higher = more important)
    */
@@ -183,7 +207,11 @@ export class CachedEmail extends plugins.smartdata.SmartdataCachedDocument<Cache
     }, limit);
   }
 
-  private static async findLimited(filter: Record<string, any>, limit: number): Promise<CachedEmail[]> {
+  private static async findLimited(
+    filter: Record<string, any>,
+    limit: number,
+    sort?: Record<string, 1 | -1>,
+  ): Promise<CachedEmail[]> {
     const safeLimit = Number.isFinite(limit) ? Math.max(0, Math.floor(limit)) : 25;
     if (safeLimit === 0) {
       return [];
@@ -195,6 +223,9 @@ export class CachedEmail extends plugins.smartdata.SmartdataCachedDocument<Cache
       filter,
       CachedEmail as unknown as typeof plugins.smartdata.SmartDataDbDoc,
     );
+    if (sort) {
+      cursor.mongodbCursor.sort(sort);
+    }
     cursor.mongodbCursor.limit(safeLimit);
     try {
       return await cursor.toArray();
@@ -203,6 +234,32 @@ export class CachedEmail extends plugins.smartdata.SmartdataCachedDocument<Cache
     }
   }
 
+  /**
+   * Find the most recently accepted emails, newest first.
+   */
+  public static async findRecent(
+    limit = 200,
+    filter: { direction?: TCachedEmailDirection; recipientDomain?: string } = {},
+  ): Promise<CachedEmail[]> {
+    const query: Record<string, any> = {};
+    if (filter.direction) {
+      query.direction = filter.direction;
+    }
+    if (filter.recipientDomain) {
+      query.recipientDomains = filter.recipientDomain.toLowerCase();
+    }
+    return await CachedEmail.findLimited(query, limit, { acceptedAt: -1 });
+  }
+
+  /**
+   * Find emails addressed to a recipient domain
+   */
+  public static async findByRecipientDomain(domain: string): Promise<CachedEmail[]> {
+    return await CachedEmail.getInstances({
+      recipientDomains: { $all: [domain.toLowerCase()] },
+    });
+  }
+
   /**
    * Find emails by sender domain
    */
@@ -254,4 +311,18 @@ export class CachedEmail extends plugins.smartdata.SmartdataCachedDocument<Cache
       }
     }
   }
+
+  /**
+   * Derive recipient domains from the recipient address list
+   */
+  public updateRecipientDomains(): void {
+    const domains = new Set<string>();
+    for (const address of this.to || []) {
+      const match = address.match(/@([^>]+)>?$/);
+      if (match) {
+        domains.add(match[1].toLowerCase());
+      }
+    }
+    this.recipientDomains = [...domains];
+  }
 }

package/ts/db/documents/classes.email-domain.doc.ts

@@ -4,6 +4,7 @@ import type {
   IEmailDomainDkim,
   IEmailDomainRateLimits,
   IEmailDomainDnsStatus,
+  IEmailDomainRemoteIngress,
 } from '../../../ts_interfaces/data/email-domain.js';
 
 const getDb = () => DcRouterDb.getInstance().getDb();
@@ -29,6 +30,9 @@ export class EmailDomainDoc extends plugins.smartdata.SmartDataDbDoc<EmailDomain
   @plugins.smartdata.svDb()
   public rateLimits?: IEmailDomainRateLimits;
 
+  @plugins.smartdata.svDb()
+  public remoteIngress?: IEmailDomainRemoteIngress;
+
   @plugins.smartdata.svDb()
   public dnsStatus!: IEmailDomainDnsStatus;
 

package/ts/db/documents/classes.email-server-settings.doc.ts

@@ -18,7 +18,7 @@ export class EmailServerSettingsDoc extends plugins.smartdata.SmartDataDbDoc<Ema
   public emailConfig?: IUnifiedEmailServerOptions;
 
   @plugins.smartdata.svDb()
-  public outboundMode: TEmailOutboundMode = 'direct';
+  public outboundMode: TEmailOutboundMode = 'remoteIngress';
 
   @plugins.smartdata.svDb()
   public emailPortConfig?: IEmailPortConfig;

package/ts/db/documents/classes.remote-ingress-edge.doc.ts

@@ -37,6 +37,15 @@ export class RemoteIngressEdgeDoc extends plugins.smartdata.SmartDataDbDoc<Remot
   @plugins.smartdata.svDb()
   public tags!: string[];
 
+  @plugins.smartdata.svDb()
+  public publicIp?: string;
+
+  @plugins.smartdata.svDb()
+  public publicIpV6?: string;
+
+  @plugins.smartdata.svDb()
+  public mailHostname?: string;
+
   @plugins.smartdata.svDb()
   public createdAt!: number;
 

package/ts/dns/classes.dns-server-runtime.ts

@@ -446,6 +446,7 @@ export class DnsServerRuntime {
       // Use explicitly configured public IP
       publicIp = options.publicIp;
       this.dcRouterRef.detectedPublicIp = publicIp;
+      this.dcRouterRef.remoteIngressManager?.setHubPublicIps([options.publicIp, publicIp]);
       logger.log('info', `Using configured public IP for nameserver A records: ${publicIp}`);
     } else {
       // Auto-discover public IP using smartnetwork
@@ -457,6 +458,7 @@ export class DnsServerRuntime {
         if (publicIps.v4) {
           publicIp = publicIps.v4;
           this.dcRouterRef.detectedPublicIp = publicIp;
+          this.dcRouterRef.remoteIngressManager?.setHubPublicIps([options.publicIp, publicIp]);
           logger.log('info', `Auto-discovered public IPv4: ${publicIp}`);
         } else {
           logger.log('warn', 'Could not auto-discover public IPv4 address');

package/ts/email/classes.accepted-email-spool.ts

@@ -1,6 +1,7 @@
 import * as plugins from '../plugins.js';
 import { logger } from '../logger.js';
 import { CachedEmail } from '../db/index.js';
+import type { TCachedEmailDirection } from '../db/documents/classes.cached.email.js';
 import type {
   Email,
   IExtendedSmtpSession,
@@ -28,6 +29,10 @@ export type TSmartMtaQueueItemLike = {
   lastError?: string;
 };
 
+type TSmartMtaQueueReader = UnifiedEmailServer & {
+  getQueueItems?: () => TSmartMtaQueueItemLike[];
+};
+
 type TStoredCachedEmailEnvelopeAddress = {
   address: string;
   args?: Record<string, string>;
@@ -48,6 +53,12 @@ type TStoredCachedEmailSession = {
 
 type TStoredCachedEmailRouteData = {
   session?: TStoredCachedEmailSession;
+  smartMta?: {
+    status?: 'queued' | 'deferred' | 'delivered' | 'failed';
+    nextAttempt?: string;
+    lastError?: string;
+    updatedAt?: string;
+  };
 };
 
 export interface IAcceptRawEmailOptions {
@@ -60,6 +71,8 @@ export interface IAcceptRawEmailOptions {
   messageId?: string;
   subject?: string;
   processAfterAccept?: boolean;
+  /** Explicit direction override for programmatic submitters. Defaults to the session-authenticated rule. */
+  direction?: TCachedEmailDirection;
 }
 
 /**
@@ -108,6 +121,8 @@ export class AcceptedEmailSpool {
     cachedEmail.rawContent = this.setDcRouterCacheIdHeader(rawMessage.toString('utf8'), cachedEmail.id);
     cachedEmail.status = 'pending';
     cachedEmail.nextAttempt = new Date();
+    cachedEmail.direction = session.authenticated ? 'outbound' : 'inbound';
+    cachedEmail.acceptedAt = Date.now();
     cachedEmail.routeData = JSON.stringify({
       acceptedAt: new Date().toISOString(),
       session: {
@@ -121,6 +136,7 @@ export class AcceptedEmailSpool {
       },
     });
     cachedEmail.updateSenderDomain();
+    cachedEmail.updateRecipientDomains();
     await cachedEmail.save();
     if (context.abortSignal?.aborted) {
       cachedEmail.markFailed('Message acceptance aborted before SMTP success');
@@ -161,6 +177,9 @@ export class AcceptedEmailSpool {
     cachedEmail.rawContent = this.setDcRouterCacheIdHeader(rawMessage, cachedEmail.id);
     cachedEmail.status = 'pending';
     cachedEmail.nextAttempt = new Date();
+    cachedEmail.direction = optionsArg.direction
+      ?? (optionsArg.session.authenticated ? 'outbound' : 'inbound');
+    cachedEmail.acceptedAt = Date.now();
     cachedEmail.routeData = JSON.stringify({
       acceptedAt: new Date().toISOString(),
       session: {
@@ -174,6 +193,7 @@ export class AcceptedEmailSpool {
       },
     });
     cachedEmail.updateSenderDomain();
+    cachedEmail.updateRecipientDomains();
     await cachedEmail.save();
 
     if (optionsArg.processAfterAccept !== false) {
@@ -246,7 +266,7 @@ export class AcceptedEmailSpool {
 
   public trackQueueUpdate(
     item: TSmartMtaQueueItemLike,
-    status: 'queued' | 'delivered' | 'failed',
+    status: 'queued' | 'deferred' | 'delivered' | 'failed',
     failureMessage: string,
   ): void {
     const updatePromise = this.updateAcceptedEmailFromQueueItem(item, status).catch((error) => {
@@ -308,6 +328,9 @@ export class AcceptedEmailSpool {
         if (this.stopping || this.dcRouterRef.emailServer !== emailServer) {
           break;
         }
+        if (await this.postponeLiveSmartMtaOwnedEmail(cachedEmail, emailServer)) {
+          continue;
+        }
         const session = this.buildCachedEmailSession(cachedEmail);
         const rawMessage = plugins.buffer.Buffer.from(cachedEmail.rawContent || '', 'utf8');
         await this.processAcceptedCachedEmail(cachedEmail, rawMessage, session, emailServer);
@@ -346,7 +369,7 @@ export class AcceptedEmailSpool {
         cachedEmail.markDelivered();
       } else {
         const currentCachedEmail = await CachedEmail.findById(cachedEmail.id) || cachedEmail;
-        if (this.isCachedEmailTerminal(currentCachedEmail)) {
+        if (this.isCachedEmailTerminal(currentCachedEmail) || currentCachedEmail.status === 'deferred') {
           return;
         }
         currentCachedEmail.status = 'queued';
@@ -419,7 +442,7 @@ export class AcceptedEmailSpool {
 
   private async updateAcceptedEmailFromQueueItem(
     item: TSmartMtaQueueItemLike,
-    status: 'queued' | 'delivered' | 'failed',
+    status: 'queued' | 'deferred' | 'delivered' | 'failed',
   ): Promise<void> {
     const cachedEmailId = this.getCachedEmailIdFromQueueItem(item);
     if (!cachedEmailId || !this.dcRouterRef.dcRouterDb?.isReady()) {
@@ -433,10 +456,16 @@ export class AcceptedEmailSpool {
       return;
     }
     cachedEmail.attempts = Math.max(cachedEmail.attempts || 0, item.attempts || 0);
+    this.updateSmartMtaRouteData(cachedEmail, item, status);
     if (status === 'delivered') {
       cachedEmail.markDelivered();
     } else if (status === 'failed') {
       cachedEmail.markFailed(item.lastError || 'SmartMTA delivery failed');
+    } else if (status === 'deferred') {
+      cachedEmail.status = 'deferred';
+      cachedEmail.lastError = item.lastError || 'SmartMTA delivery deferred';
+      const smartMtaNextAttempt = item.nextAttempt || new Date(Date.now() + ACCEPTED_EMAIL_RETRY_DELAY_MS);
+      cachedEmail.nextAttempt = new Date(smartMtaNextAttempt.getTime() + ACCEPTED_EMAIL_QUEUE_LEASE_MS);
     } else {
       cachedEmail.status = 'queued';
       cachedEmail.nextAttempt = new Date(Date.now() + ACCEPTED_EMAIL_QUEUE_LEASE_MS);
@@ -487,11 +516,43 @@ export class AcceptedEmailSpool {
     return cachedEmail.status === 'delivered' || cachedEmail.status === 'failed';
   }
 
-  private getCachedEmailIdFromQueueItem(item: TSmartMtaQueueItemLike): string | undefined {
+  /** The CachedEmail row a live queue item was spooled from (via the cache-id header). */
+  public getCachedEmailIdFromQueueItem(item: TSmartMtaQueueItemLike): string | undefined {
     return this.getHeaderValue(item.processingResult?.headers, DCROUTER_CACHE_ID_HEADER)
       || this.getHeaderValue(item.processingResult?.email?.headers, DCROUTER_CACHE_ID_HEADER);
   }
 
+  private async postponeLiveSmartMtaOwnedEmail(
+    cachedEmail: CachedEmail,
+    emailServer: UnifiedEmailServer,
+  ): Promise<boolean> {
+    if (cachedEmail.status !== 'deferred') {
+      return false;
+    }
+    const queueItem = this.getLiveQueueItemForCachedEmail(cachedEmail.id, emailServer);
+    if (!queueItem) {
+      return false;
+    }
+    const status = queueItem.status === 'deferred' ? 'deferred' : 'queued';
+    cachedEmail.attempts = Math.max(cachedEmail.attempts || 0, queueItem.attempts || 0);
+    if (queueItem.lastError) {
+      cachedEmail.lastError = queueItem.lastError;
+    }
+    this.updateSmartMtaRouteData(cachedEmail, queueItem, status);
+    const smartMtaNextAttempt = queueItem.nextAttempt || new Date(Date.now() + ACCEPTED_EMAIL_RETRY_DELAY_MS);
+    cachedEmail.nextAttempt = new Date(smartMtaNextAttempt.getTime() + ACCEPTED_EMAIL_QUEUE_LEASE_MS);
+    await cachedEmail.save();
+    return true;
+  }
+
+  private getLiveQueueItemForCachedEmail(
+    cachedEmailId: string,
+    emailServer: UnifiedEmailServer,
+  ): TSmartMtaQueueItemLike | undefined {
+    const queueItems = (emailServer as TSmartMtaQueueReader).getQueueItems?.() || [];
+    return queueItems.find((item) => this.getCachedEmailIdFromQueueItem(item) === cachedEmailId);
+  }
+
   private getHeaderValue(headers: Record<string, string> | undefined, headerName: string): string | undefined {
     if (!headers) {
       return undefined;
@@ -501,6 +562,21 @@ export class AcceptedEmailSpool {
     return matchingHeaderName ? headers[matchingHeaderName] : undefined;
   }
 
+  private updateSmartMtaRouteData(
+    cachedEmail: CachedEmail,
+    item: TSmartMtaQueueItemLike,
+    status: 'queued' | 'deferred' | 'delivered' | 'failed',
+  ): void {
+    const routeData = this.parseCachedEmailRouteData(cachedEmail);
+    routeData.smartMta = {
+      status,
+      nextAttempt: item.nextAttempt?.toISOString(),
+      lastError: item.lastError,
+      updatedAt: new Date().toISOString(),
+    };
+    cachedEmail.routeData = JSON.stringify(routeData);
+  }
+
   private removeHeader(headers: Record<string, string>, headerName: string): void {
     const normalizedHeaderName = headerName.toLowerCase();
     for (const key of Object.keys(headers)) {

package/ts/email/classes.email-domain.manager.ts

@@ -5,7 +5,8 @@ import { EmailDomainDoc } from '../db/documents/classes.email-domain.doc.js';
 import { DomainDoc } from '../db/documents/classes.domain.doc.js';
 import { DnsRecordDoc } from '../db/documents/classes.dns-record.doc.js';
 import type { DnsManager } from '../dns/manager.dns.js';
-import type { IEmailDomain, IEmailDnsRecord, TDnsRecordStatus } from '../../ts_interfaces/data/email-domain.js';
+import type { IEmailDomain, IEmailDnsRecord, IEmailDomainRemoteIngress, TDnsRecordStatus } from '../../ts_interfaces/data/email-domain.js';
+import type { IRemoteIngress } from '../../ts_interfaces/data/remoteingress.js';
 import { buildEmailDnsRecords } from './email-dns-records.js';
 
 /**
@@ -18,6 +19,7 @@ import { buildEmailDnsRecords } from './email-dns-records.js';
 export class EmailDomainManager {
   private dcRouter: any; // DcRouter — avoids circular import
   private baseEmailDomains: IEmailDomainConfig[] = [];
+  private dnsClient?: plugins.smartdns.dnsClientMod.Smartdns;
 
   constructor(dcRouterRef: any) {
     this.dcRouter = dcRouterRef;
@@ -45,7 +47,10 @@ export class EmailDomainManager {
     await this.syncManagedDomainsToRuntime();
   }
 
-  public async stop(): Promise<void> {}
+  public async stop(): Promise<void> {
+    this.dnsClient?.destroy();
+    this.dnsClient = undefined;
+  }
 
   // ---------------------------------------------------------------------------
   // CRUD
@@ -93,6 +98,7 @@ export class EmailDomainManager {
     dkimKeySize?: number;
     rotateKeys?: boolean;
     rotationIntervalDays?: number;
+    remoteIngress?: IEmailDomainRemoteIngress;
   }): Promise<IEmailDomain> {
     // Resolve the linked DNS domain
     const domainDoc = await DomainDoc.findById(opts.linkedDomainId);
@@ -150,10 +156,12 @@ export class EmailDomainManager {
       dkim: 'unchecked',
       dmarc: 'unchecked',
     };
+    doc.remoteIngress = this.normalizeRemoteIngressPin(opts.remoteIngress, domainName);
     doc.createdAt = now;
     doc.updatedAt = now;
     await doc.save();
     await this.syncManagedDomainsToRuntime();
+    this.dcRouter.mailDnsSync?.requestSync(`email domain created: ${domainName}`);
 
     logger.log('info', `Email domain created: ${domainName}`);
     return this.docToInterface(doc);
@@ -165,6 +173,8 @@ export class EmailDomainManager {
       rotateKeys?: boolean;
       rotationIntervalDays?: number;
       rateLimits?: IEmailDomain['rateLimits'];
+      /** null clears the pin. */
+      remoteIngress?: IEmailDomainRemoteIngress | null;
     },
   ): Promise<void> {
     const doc = await EmailDomainDoc.findById(id);
@@ -173,9 +183,43 @@ export class EmailDomainManager {
     if (changes.rotateKeys !== undefined) doc.dkim.rotateKeys = changes.rotateKeys;
     if (changes.rotationIntervalDays !== undefined) doc.dkim.rotationIntervalDays = changes.rotationIntervalDays;
     if (changes.rateLimits !== undefined) doc.rateLimits = changes.rateLimits;
+    if (changes.remoteIngress !== undefined) {
+      doc.remoteIngress = changes.remoteIngress === null
+        ? undefined
+        : this.normalizeRemoteIngressPin(changes.remoteIngress, doc.domain);
+    }
     doc.updatedAt = new Date().toISOString();
     await doc.save();
     await this.syncManagedDomainsToRuntime();
+    this.dcRouter.mailDnsSync?.requestSync(`email domain updated: ${doc.domain}`);
+  }
+
+  /**
+   * Normalize a per-domain edge pin. Pins may reference edges that are not
+   * registered yet — that only warns, so pins can precede edge registration.
+   */
+  private normalizeRemoteIngressPin(
+    pin: IEmailDomainRemoteIngress | undefined,
+    domainName: string,
+  ): IEmailDomainRemoteIngress | undefined {
+    const edgeFilter = [...new Set((pin?.edgeFilter || []).map((entry) => `${entry}`.trim()).filter(Boolean))];
+    if (edgeFilter.length === 0) {
+      return undefined;
+    }
+    const manager = this.dcRouter.remoteIngressManager;
+    if (manager && manager.resolveEdgesByFilter(edgeFilter).length === 0) {
+      logger.log('warn', `Email domain ${domainName}: edge pin [${edgeFilter.join(', ')}] matches no registered enabled edge yet`);
+    }
+    return { edgeFilter };
+  }
+
+  /** Enabled edges pinned for this domain (empty when unpinned). */
+  private resolvePinnedEdges(doc: EmailDomainDoc): IRemoteIngress[] {
+    const edgeFilter = doc.remoteIngress?.edgeFilter;
+    if (!edgeFilter?.length) {
+      return [];
+    }
+    return this.dcRouter.remoteIngressManager?.resolveEdgesByFilter(edgeFilter) || [];
   }
 
   public async deleteEmailDomain(id: string): Promise<void> {
@@ -183,6 +227,7 @@ export class EmailDomainManager {
     if (!doc) throw new Error(`Email domain not found: ${id}`);
     await doc.delete();
     await this.syncManagedDomainsToRuntime();
+    this.dcRouter.mailDnsSync?.requestSync(`email domain deleted: ${doc.domain}`);
     logger.log('info', `Email domain deleted: ${doc.domain}`);
   }
 
@@ -199,7 +244,10 @@ export class EmailDomainManager {
 
     const domain = doc.domain;
     const selector = doc.dkim.selector;
-    const hostname = this.emailHostname;
+    // Pinned domains get their own MX host whose A records are the pinned edges'
+    // public IPs; unpinned domains use the shared mail hostname.
+    const pinnedEdges = this.resolvePinnedEdges(doc);
+    const hostname = pinnedEdges.length > 0 ? `mx.${domain}` : this.emailHostname;
     let dkimValue = `v=DKIM1; h=sha256; k=rsa; p=${doc.dkim.publicKey || ''}`;
 
     if (this.dkimCreator) {
@@ -211,13 +259,24 @@ export class EmailDomainManager {
       }
     }
 
-    return buildEmailDnsRecords({
+    const records = buildEmailDnsRecords({
       domain,
       hostname,
       selector,
       dkimValue,
       statuses: doc.dnsStatus,
     });
+
+    for (const edge of pinnedEdges) {
+      if (edge.publicIp) {
+        records.push({ type: 'A', name: hostname, value: edge.publicIp, status: doc.dnsStatus.mx });
+      }
+      if (edge.publicIpV6) {
+        records.push({ type: 'AAAA', name: hostname, value: edge.publicIpV6, status: doc.dnsStatus.mx });
+      }
+    }
+
+    return records;
   }
 
   // ---------------------------------------------------------------------------
@@ -280,7 +339,7 @@ export class EmailDomainManager {
 
     const domain = doc.domain;
     const selector = doc.dkim.selector;
-    const resolver = new plugins.dns.promises.Resolver();
+    const dnsClient = this.getDnsClient();
 
     // MX check
     const requiredRecords = await this.getRequiredDnsRecords(id);
@@ -290,16 +349,26 @@ export class EmailDomainManager {
     const dkimRecord = requiredRecords.find((record) => record.name === `${selector}._domainkey.${domain}`);
     const dmarcRecord = requiredRecords.find((record) => record.name === `_dmarc.${domain}`);
 
-    doc.dnsStatus.mx = await this.checkMx(resolver, domain, mxRecord?.value);
+    doc.dnsStatus.mx = await this.checkMx(dnsClient, domain, mxRecord?.value);
+
+    // Pinned domains: the MX host's A records must cover the pinned edges' IPs.
+    const requiredARecords = requiredRecords.filter((record) => record.type === 'A');
+    if (doc.dnsStatus.mx === 'valid' && requiredARecords.length > 0) {
+      const mxHostname = mxRecord?.value?.split(/\s+/)[1] || `mx.${domain}`;
+      const aStatus = await this.checkARecords(dnsClient, mxHostname, requiredARecords.map((record) => record.value));
+      if (aStatus !== 'valid') {
+        doc.dnsStatus.mx = aStatus;
+      }
+    }
 
     // SPF check
-    doc.dnsStatus.spf = await this.checkTxtRecord(resolver, domain, spfRecord?.value);
+    doc.dnsStatus.spf = await this.checkTxtRecord(dnsClient, domain, spfRecord?.value);
 
     // DKIM check
-    doc.dnsStatus.dkim = await this.checkTxtRecord(resolver, `${selector}._domainkey.${domain}`, dkimRecord?.value);
+    doc.dnsStatus.dkim = await this.checkTxtRecord(dnsClient, `${selector}._domainkey.${domain}`, dkimRecord?.value);
 
     // DMARC check
-    doc.dnsStatus.dmarc = await this.checkTxtRecord(resolver, `_dmarc.${domain}`, dmarcRecord?.value);
+    doc.dnsStatus.dmarc = await this.checkTxtRecord(dnsClient, `_dmarc.${domain}`, dmarcRecord?.value);
 
     doc.dnsStatus.lastCheckedAt = new Date().toISOString();
     doc.updatedAt = new Date().toISOString();
@@ -315,41 +384,72 @@ export class EmailDomainManager {
     return record.value.trim() === required.value.trim();
   }
 
+  /** Lazy shared smartdns client; the Rust bridge spawns on first non-system lookup. */
+  private getDnsClient(): plugins.smartdns.dnsClientMod.Smartdns {
+    if (!this.dnsClient) {
+      this.dnsClient = new plugins.smartdns.dnsClientMod.Smartdns({});
+    }
+    return this.dnsClient;
+  }
+
+  /** 'pref exchange' normalized for comparison: numeric pref, lowercased exchange, no trailing dot. */
+  private normalizeMxValue(value: string): string {
+    const [pref, exchange = ''] = value.trim().split(/\s+/);
+    return `${Number(pref)} ${exchange.toLowerCase().replace(/\.$/, '')}`;
+  }
+
   private async checkMx(
-    resolver: plugins.dns.promises.Resolver,
+    dnsClient: plugins.smartdns.dnsClientMod.Smartdns,
     domain: string,
     expectedValue?: string,
   ): Promise<TDnsRecordStatus> {
     try {
-      const records = await resolver.resolveMx(domain);
+      const records = await dnsClient.getRecords(domain, 'MX');
       if (!records || records.length === 0) {
         return 'missing';
       }
       if (!expectedValue) {
         return 'valid';
       }
-      const found = records.some((record) => `${record.priority} ${record.exchange}`.trim() === expectedValue.trim());
+      const expected = this.normalizeMxValue(expectedValue);
+      const found = records.some((record) => this.normalizeMxValue(record.value) === expected);
       return found ? 'valid' : 'invalid';
     } catch {
       return 'missing';
     }
   }
 
+  private async checkARecords(
+    dnsClient: plugins.smartdns.dnsClientMod.Smartdns,
+    name: string,
+    expectedIps: string[],
+  ): Promise<TDnsRecordStatus> {
+    try {
+      const records = await dnsClient.getRecordsA(name);
+      if (!records || records.length === 0) {
+        return 'missing';
+      }
+      const resolved = new Set(records.map((record) => record.value));
+      return expectedIps.every((ip) => resolved.has(ip)) ? 'valid' : 'invalid';
+    } catch {
+      return 'missing';
+    }
+  }
+
   private async checkTxtRecord(
-    resolver: plugins.dns.promises.Resolver,
+    dnsClient: plugins.smartdns.dnsClientMod.Smartdns,
     name: string,
     expectedValue?: string,
   ): Promise<TDnsRecordStatus> {
     try {
-      const records = await resolver.resolveTxt(name);
-      const flat = records.map((r) => r.join(''));
-      if (flat.length === 0) {
+      const records = await dnsClient.getRecordsTxt(name);
+      if (!records || records.length === 0) {
         return 'missing';
       }
       if (!expectedValue) {
         return 'valid';
       }
-      const found = flat.some((record) => record.trim() === expectedValue.trim());
+      const found = records.some((record) => record.value.trim() === expectedValue.trim());
       return found ? 'valid' : 'invalid';
     } catch {
       return 'missing';
@@ -368,6 +468,7 @@ export class EmailDomainManager {
       subdomain: doc.subdomain,
       dkim: doc.dkim,
       rateLimits: doc.rateLimits,
+      remoteIngress: doc.remoteIngress,
       dnsStatus: doc.dnsStatus,
       createdAt: doc.createdAt,
       updatedAt: doc.updatedAt,

package/ts/email/classes.email-route-builder.ts

@@ -3,6 +3,7 @@ import { logger } from '../logger.js';
 import type { IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
 import type { IRoute } from '../../ts_interfaces/data/route-management.js';
 import type { IDcRouterRouteConfig } from '../../ts_interfaces/data/remoteingress.js';
+import { REMOTE_INGRESS_MAIL_TAG } from '../../ts_interfaces/data/remoteingress.js';
 import type { DcRouter } from '../classes.dcrouter.js';
 
 type TInboundProxyProtocolPolicy = NonNullable<plugins.smartproxy.IRouteMatch['inboundProxyProtocol']>;
@@ -99,7 +100,9 @@ export class EmailRouteBuilder {
       };
 
       if (this.dcRouterRef.isRemoteIngressHubEnabled()) {
-        routeConfig.remoteIngress = { enabled: true };
+        // Only mail-tagged edges bind SMTP ports — other edges may sit on hosts
+        // where 25/465/587 belong to a different mail system.
+        routeConfig.remoteIngress = { enabled: true, edgeFilter: [REMOTE_INGRESS_MAIL_TAG] };
         const inboundProxyProtocol = this.getRemoteIngressEmailInboundProxyPolicy(port);
         if (inboundProxyProtocol) {
           routeConfig.match.inboundProxyProtocol = inboundProxyProtocol;

package/ts/email/classes.email-settings.manager.ts

@@ -22,7 +22,7 @@ function hasOwn(objectArg: object, keyArg: string): boolean {
 export class EmailSettingsManager {
   private cachedEmailConfig?: IUnifiedEmailServerOptions;
   private cachedEmailPortConfig?: IEmailPortConfig;
-  private outboundMode: TEmailOutboundMode = 'direct';
+  private outboundMode: TEmailOutboundMode = 'remoteIngress';
   private enabled = false;
   private updatedAt = 0;
   private updatedBy = 'default';
@@ -140,7 +140,7 @@ export class EmailSettingsManager {
   }
 
   private normalizeOutboundMode(mode: TEmailOutboundMode | undefined): TEmailOutboundMode {
-    if (!mode) return 'direct';
+    if (!mode) return 'remoteIngress';
     if (mode !== 'direct' && mode !== 'remoteIngress') {
       throw new Error('Invalid email outbound mode');
     }