@serve.zone/dcrouter 16.5.0 → 17.1.0

package/ts/email/classes.mail-dns-sync.ts

@@ -11,6 +11,7 @@ import type {
   IEmailDomainMxSlot,
   IEmailDomainOperationError,
   IEmailDkimMaterial,
+  TEmailDnsVerificationOutcome,
 } from '../../ts_interfaces/data/email-domain.js';
 import type { TDnsRecordType } from '../../ts_interfaces/data/dns-record.js';
 import {
@@ -18,23 +19,40 @@ import {
   ReleasedRemoteIngressEgressIdentitySource,
   type IEligibleMailEdge,
 } from './classes.mail-edge-eligibility.js';
+import {
+  evaluateMailTxtIntent,
+  type IMailDnsTxtPolicyResult,
+} from './mail-dns-txt-policy.js';
+import {
+  applyMailDnsVerificationResult,
+  reconcileMailDnsSingleton,
+} from './reconcile-mail-dns-singleton.js';
 
 export const MAIL_DNS_SYNC_CREATED_BY = 'mail-dns-reconciler';
 export const MAIL_DNS_MANAGED_BY = 'mail-dns-reconciler';
 export const MAIL_DNS_RETRY_INTERVAL_MS = 5 * 60_000;
-
+export const MAIL_DNS_MAX_RETRY_INTERVAL_MS = 60 * 60_000;
 
 export interface IMailDnsVerificationResult {
   valid: boolean;
+  outcome?: TEmailDnsVerificationOutcome;
   reason?: string;
+  effectiveValue?: string;
 }
 
 export interface IMailDnsVerifier {
   verifyRecord(intent: IEmailDnsRecordIntent): Promise<IMailDnsVerificationResult>;
-  verifyMxSet?(intents: IEmailDnsRecordIntent[]): Promise<IMailDnsVerificationResult>;
+  verifyMxSet?(
+    intents: IEmailDnsRecordIntent[],
+    previousValues?: string[],
+  ): Promise<IMailDnsVerificationResult>;
   verifyForwardConfirmedIdentity(
     identity: IEmailDomainEdgeIdentity,
   ): Promise<IMailDnsVerificationResult>;
+  evaluateTxtRecords?(
+    intent: IEmailDnsRecordIntent,
+    values: string[],
+  ): Promise<IMailDnsTxtPolicyResult>;
   destroy?(): void;
 }
 
@@ -47,6 +65,53 @@ function normalizeMx(value: string): string {
   return `${Number(priority)} ${normalizeHostname(exchange)}`;
 }
 
+function parseMx(value: string): string | undefined {
+  const match = value.trim().match(/^(\d{1,5})\s+([^\s]+)$/);
+  if (!match) return undefined;
+  const priority = Number.parseInt(match[1], 10);
+  const exchange = normalizeHostname(match[2]);
+  if (
+    priority < 0
+    || priority > 65_535
+    || !exchange
+    || exchange.length > 253
+    || !exchange.split('.').every((label) => (
+      label.length > 0
+      && label.length <= 63
+      && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label)
+    ))
+  ) return undefined;
+  return `${priority} ${exchange}`;
+}
+
+export function evaluateMailMxValues(
+  intents: IEmailDnsRecordIntent[],
+  rawValues: string[],
+  previousValues: string[] = [],
+): IMailDnsVerificationResult {
+  const parsed = rawValues.map(parseMx);
+  if (parsed.some((value) => value === undefined)) {
+    return { valid: false, outcome: 'invalid', reason: 'MX RRset contains an invalid priority or exchange' };
+  }
+  const actual = parsed as string[];
+  const desired = new Set(intents.map((intent) => normalizeMx(intent.value)));
+  const previous = new Set(previousValues.map(normalizeMx));
+  const counts = new Map<string, number>();
+  for (const value of actual) counts.set(value, (counts.get(value) || 0) + 1);
+  const unexpected = actual.filter((value) => !desired.has(value) && !previous.has(value));
+  if (unexpected.length > 0) {
+    return { valid: false, outcome: 'conflict', reason: `MX RRset contains unexpected value ${unexpected[0]}` };
+  }
+  if ([...counts.values()].some((count) => count > 1)) {
+    return { valid: false, outcome: 'duplicate', reason: 'MX RRset contains duplicate values' };
+  }
+  const missing = [...desired].filter((value) => !counts.has(value));
+  if (missing.length > 0) {
+    return { valid: false, outcome: 'propagation', reason: `MX ${missing[0]} has not propagated` };
+  }
+  return { valid: true, outcome: 'valid' };
+}
+
 function expandIpv6(address: string): string[] | undefined {
   let normalized = address.toLowerCase();
   if (normalized.includes('.')) {
@@ -89,49 +154,107 @@ export class SmartDnsMailVerifier implements IMailDnsVerifier {
     return this.client;
   }
 
+  private async queryValues(
+    name: string,
+    type: 'A' | 'AAAA' | 'MX' | 'TXT' | 'PTR',
+  ): Promise<
+    | { status: 'success'; values: string[] }
+    | { status: 'missing'; reason: string }
+    | { status: 'error'; reason: string }
+  > {
+    const result = await this.getClient().queryRecords(name, type);
+    if (result.status === 'success') {
+      return {
+        status: 'success',
+        values: result.records.map((record) => String(record.value).trim()),
+      };
+    }
+    if (result.status === 'missing') {
+      return { status: 'missing', reason: result.missingReason };
+    }
+    return {
+      status: 'error',
+      reason: `${result.error.code}: ${result.error.message}`,
+    };
+  }
+
   public async verifyRecord(intent: IEmailDnsRecordIntent): Promise<IMailDnsVerificationResult> {
     try {
-      const records = await this.getClient().getRecords(intent.name, intent.type);
-      const values = (records || []).map((record) => String(record.value).trim());
+      const query = await this.queryValues(intent.name, intent.type);
+      if (query.status === 'error') {
+        return { valid: false, outcome: 'lookup-error', reason: `DNS lookup failed: ${query.reason}` };
+      }
+      if (query.status === 'missing') {
+        return { valid: false, outcome: 'missing', reason: `${intent.type} ${intent.name} is missing` };
+      }
+      const values = query.values;
       if (intent.type === 'MX') {
-        return values.some((value) => normalizeMx(value) === normalizeMx(intent.value))
-          ? { valid: true }
-          : { valid: false, reason: `MX ${intent.value} has not propagated` };
+        return evaluateMailMxValues([intent], values);
       }
       if (intent.type === 'TXT') {
-        const exact = values.filter((value) => value === intent.value.trim());
-        const relevant = intent.value.startsWith('v=spf1')
-          ? values.filter((value) => value.toLowerCase().startsWith('v=spf1'))
-          : intent.value.startsWith('v=DMARC1')
-            ? values.filter((value) => value.toLowerCase().startsWith('v=dmarc1'))
-            : values;
-        return exact.length === 1 && relevant.length === 1
-          ? { valid: true }
-          : { valid: false, reason: `TXT ${intent.name} is missing, conflicting, or duplicated` };
+        return await this.evaluateTxtRecords(intent, values).then((result) => ({
+          valid: result.outcome === 'valid',
+          ...result,
+        }));
       }
-      const exact = values.filter((value) => normalizeHostname(value) === normalizeHostname(intent.value));
-      return exact.length === 1 && values.length === 1
-        ? { valid: true }
-        : { valid: false, reason: `${intent.type} ${intent.name} is missing, conflicting, or duplicated` };
+      const expectedFamily = intent.type === 'A' ? 4 : 6;
+      if (values.some((value) => plugins.smartnetwork.getIpVersion(value) !== expectedFamily)) {
+        return {
+          valid: false,
+          outcome: 'invalid',
+          reason: `${intent.type} ${intent.name} contains an invalid address`,
+        };
+      }
+      const normalizedValues = values.map((value) => normalizeHostname(value));
+      const expected = normalizeHostname(intent.value);
+      const exact = normalizedValues.filter((value) => value === expected);
+      const unexpected = normalizedValues.filter((value) => value !== expected);
+      const outcome: TEmailDnsVerificationOutcome = unexpected.length > 0
+        ? 'conflict'
+        : exact.length > 1
+          ? 'duplicate'
+          : exact.length === 0
+            ? 'propagation'
+            : 'valid';
+      return {
+        valid: outcome === 'valid',
+        outcome,
+        ...(outcome !== 'valid' ? { reason: `${intent.type} ${intent.name} did not match exactly` } : {}),
+      };
     } catch (error: unknown) {
-      return { valid: false, reason: `DNS lookup failed: ${(error as Error).message}` };
+      return { valid: false, outcome: 'lookup-error', reason: `DNS lookup failed: ${(error as Error).message}` };
     }
   }
 
-  public async verifyMxSet(intents: IEmailDnsRecordIntent[]): Promise<IMailDnsVerificationResult> {
+  public async evaluateTxtRecords(
+    intent: IEmailDnsRecordIntent,
+    values: string[],
+  ): Promise<IMailDnsTxtPolicyResult> {
+    return await evaluateMailTxtIntent(intent, values, {
+      resolveDns: async (name, type) => {
+        const query = await this.queryValues(name, type);
+        if (query.status === 'error') throw new Error(query.reason);
+        return query.status === 'missing' ? [] : query.values;
+      },
+    });
+  }
+
+  public async verifyMxSet(
+    intents: IEmailDnsRecordIntent[],
+    previousValues: string[] = [],
+  ): Promise<IMailDnsVerificationResult> {
     if (intents.length === 0) return { valid: false, reason: 'No desired MX records' };
     try {
-      const records = await this.getClient().getRecords(intents[0].name, 'MX');
-      const actual = (records || []).map((record) => normalizeMx(String(record.value))).sort();
-      const desired = intents.map((intent) => normalizeMx(intent.value)).sort();
-      return actual.length === desired.length && actual.every((value, index) => value === desired[index])
-        ? { valid: true }
-        : {
-            valid: false,
-            reason: `MX set for ${intents[0].name} does not exactly match priorities and exchanges`,
-          };
+      const query = await this.queryValues(intents[0].name, 'MX');
+      if (query.status === 'error') {
+        return { valid: false, outcome: 'lookup-error', reason: `MX lookup failed: ${query.reason}` };
+      }
+      if (query.status === 'missing') {
+        return { valid: false, outcome: 'missing', reason: `MX ${intents[0].name} is missing` };
+      }
+      return evaluateMailMxValues(intents, query.values, previousValues);
     } catch (error: unknown) {
-      return { valid: false, reason: `MX lookup failed: ${(error as Error).message}` };
+      return { valid: false, outcome: 'lookup-error', reason: `MX lookup failed: ${(error as Error).message}` };
     }
   }
 
@@ -143,16 +266,24 @@ export class SmartDnsMailVerifier implements IMailDnsVerifier {
     if (identity.ipv6) checks.push({ family: 'AAAA', address: identity.ipv6 });
     try {
       for (const check of checks) {
-        const ptrRecords = await this.getClient().getRecords(toReverseDnsName(check.address), 'PTR');
-        const ptrNames = (ptrRecords || []).map((record) => normalizeHostname(String(record.value)));
+        const ptrQuery = await this.queryValues(toReverseDnsName(check.address), 'PTR');
+        if (ptrQuery.status === 'error') {
+          return { valid: false, outcome: 'lookup-error', reason: `PTR lookup failed: ${ptrQuery.reason}` };
+        }
+        const ptrNames = ptrQuery.status === 'missing'
+          ? []
+          : ptrQuery.values.map(normalizeHostname);
         if (ptrNames.length !== 1 || ptrNames[0] !== normalizeHostname(identity.hostname)) {
           return {
             valid: false,
             reason: `PTR for ${check.address} must be exactly ${identity.hostname}`,
           };
         }
-        const forwardRecords = await this.getClient().getRecords(identity.hostname, check.family);
-        const forwardIps = (forwardRecords || []).map((record) => String(record.value));
+        const forwardQuery = await this.queryValues(identity.hostname, check.family);
+        if (forwardQuery.status === 'error') {
+          return { valid: false, outcome: 'lookup-error', reason: `${check.family} lookup failed: ${forwardQuery.reason}` };
+        }
+        const forwardIps = forwardQuery.status === 'missing' ? [] : forwardQuery.values;
         if (!forwardIps.includes(check.address)) {
           return {
             valid: false,
@@ -192,7 +323,11 @@ export class MailDnsSync {
   private stopped = false;
   private dirty = false;
   private runPromise?: Promise<void>;
-  private retryTimer?: ReturnType<typeof setInterval>;
+  private retryTimer?: ReturnType<typeof setTimeout>;
+  private requestedGeneration = 0;
+  private completedGeneration = 0;
+  private forceAll = false;
+  private forcedDomainIds = new Set<string>();
   private edgeEligibility: MailEdgeEligibility;
 
   constructor(
@@ -212,12 +347,11 @@ export class MailDnsSync {
     }
     this.started = true;
     this.stopped = false;
-    this.retryTimer = setInterval(() => this.requestSync('periodic retry'), MAIL_DNS_RETRY_INTERVAL_MS);
-    this.dirty = true;
+    this.queueRequest(undefined, true);
     try {
       await this.kick('startup');
     } catch (error: unknown) {
-      if (this.retryTimer) clearInterval(this.retryTimer);
+      if (this.retryTimer) clearTimeout(this.retryTimer);
       this.retryTimer = undefined;
       this.started = false;
       this.dirty = false;
@@ -230,16 +364,16 @@ export class MailDnsSync {
     this.started = false;
     this.dirty = false;
     if (this.retryTimer) {
-      clearInterval(this.retryTimer);
+      clearTimeout(this.retryTimer);
       this.retryTimer = undefined;
     }
     await this.runPromise?.catch(() => undefined);
     this.verifier.destroy?.();
   }
 
-  public requestSync(reason: string): void {
+  public requestSync(reason: string, domainIds?: string[]): void {
     if (this.stopped) return;
-    this.dirty = true;
+    this.queueRequest(domainIds, domainIds === undefined);
     if (!this.started) return;
     this.kick(reason).catch((error: unknown) => {
       logger.log('error', `MailDnsSync failed (${reason}): ${(error as Error).message}`);
@@ -247,36 +381,79 @@ export class MailDnsSync {
   }
 
   /** Coalescing entry point used by API actions that need the durable outcome. */
-  public async sync(reason: string): Promise<void> {
+  public async sync(reason: string, domainIds?: string[]): Promise<void> {
+    if (this.stopped) throw new Error('MailDnsSync is stopped');
+    const ticket = this.queueRequest(domainIds, domainIds === undefined);
+    while (this.completedGeneration < ticket) {
+      await this.kick(reason);
+    }
+  }
+
+  public async syncDomain(domainId: string, reason: string): Promise<{
+    requestedGeneration: number;
+    completedGeneration: number;
+    domain: EmailDomainDoc | null;
+    records: DnsRecordDoc[];
+  }> {
     if (this.stopped) throw new Error('MailDnsSync is stopped');
+    const requestedGeneration = this.queueRequest([domainId], false);
+    while (this.completedGeneration < requestedGeneration) {
+      await this.kick(reason);
+    }
+    const domain = await EmailDomainDoc.findById(domainId);
+    return {
+      requestedGeneration,
+      completedGeneration: this.completedGeneration,
+      domain,
+      records: domain ? await DnsRecordDoc.findByDomainId(domain.linkedDomainId) : [],
+    };
+  }
+
+  private queueRequest(domainIds: string[] | undefined, forceAll: boolean): number {
+    this.requestedGeneration++;
     this.dirty = true;
-    await this.kick(reason);
+    if (forceAll) this.forceAll = true;
+    for (const domainId of domainIds || []) this.forcedDomainIds.add(domainId);
+    return this.requestedGeneration;
   }
 
   private async kick(reason: string): Promise<void> {
     if (this.runPromise) return await this.runPromise;
     // Defer execution one microtask so runPromise is assigned before the first
     // awaited provider/eligibility hook can synchronously enqueue another event.
-    this.runPromise = Promise.resolve().then(() => this.runLoop(reason, false)).finally(() => {
+    this.runPromise = Promise.resolve().then(() => this.runLoop(reason)).finally(() => {
       this.runPromise = undefined;
       if (this.dirty && this.started && !this.stopped) {
-        this.requestSync(`${reason} (follow-up)`);
+        this.kick(`${reason} (follow-up)`).catch((error: unknown) => {
+          logger.log('error', `MailDnsSync follow-up failed: ${(error as Error).message}`);
+        });
       }
+      this.scheduleNextDue().catch((error: unknown) => {
+        logger.log('error', `MailDnsSync scheduling failed: ${(error as Error).message}`);
+      });
     });
     return await this.runPromise;
   }
 
-  private async runLoop(reason: string, singlePass: boolean): Promise<void> {
+  private async runLoop(reason: string): Promise<void> {
     do {
+      const generation = this.requestedGeneration;
+      const forceAll = this.forceAll;
+      const forcedDomainIds = new Set(this.forcedDomainIds);
       this.dirty = false;
-      await this.reconcile(reason);
-      if (singlePass) break;
+      this.forceAll = false;
+      this.forcedDomainIds.clear();
+      await this.reconcile(reason, { forceAll, forcedDomainIds });
+      this.completedGeneration = Math.max(this.completedGeneration, generation);
       // An event during the run leaves dirty=true and forces exactly one
       // immediate follow-up; repeated events coalesce into that pass.
     } while (this.dirty && !this.stopped);
   }
 
-  private async reconcile(reason: string): Promise<void> {
+  private async reconcile(
+    reason: string,
+    work: { forceAll: boolean; forcedDomainIds: Set<string> },
+  ): Promise<void> {
     if (this.dcRouterRef.options.dbConfig?.enabled === false) return;
     const dnsManager = this.dcRouterRef.dnsManager;
     if (!dnsManager) {
@@ -284,21 +461,30 @@ export class MailDnsSync {
       return;
     }
 
+    const zones = await DomainDoc.findAll();
+    const allDocs = await EmailDomainDoc.findAll();
+    const now = Date.now();
+    const docs = allDocs.filter((doc) => (
+      work.forceAll
+      || work.forcedDomainIds.has(doc.id)
+      || this.isDomainDue(doc, now)
+    ));
+    if (docs.length === 0) return;
+
     // Refresh the broad operational status independently from per-domain pins.
     await this.edgeEligibility.resolveForDomain();
-
-    const zones = await DomainDoc.findAll();
-    const docs = await EmailDomainDoc.findAll();
     const plans: IPlannedDomain[] = [];
+    const deletingDocs: EmailDomainDoc[] = [];
     for (const loadedDoc of docs) {
       const doc = await this.dcRouterRef.emailDomainManager?.stageDkimRotationIfDue?.(loadedDoc.id)
         || loadedDoc;
       if (doc.reconciliation?.lifecycleStatus === 'deleting') {
         await this.persistDeletingAttempt(doc);
+        deletingDocs.push(doc);
         continue;
       }
       const plan = await this.buildPlan(doc, zones);
-      await this.persistDesiredPlan(plan);
+      await this.persistDesiredPlan(plan, zones);
       plans.push(plan);
     }
 
@@ -309,7 +495,7 @@ export class MailDnsSync {
       }
     }
 
-    const zoneErrors = await this.reconcileZones([...uniqueIntents.values()], zones);
+    const zoneResult = await this.reconcileZones([...uniqueIntents.values()], zones);
     for (const plan of plans) {
       const errors = [...plan.preliminaryErrors];
       for (const intent of plan.intents) {
@@ -317,20 +503,90 @@ export class MailDnsSync {
         if (outcome) Object.assign(intent, outcome);
         if (intent.error) errors.push(intent.error);
       }
-      await this.validateAndActivate(plan, errors, zoneErrors);
+      await this.validateAndActivate(plan, errors, zoneResult.errors);
     }
 
-    await this.cleanupStaleManagedRecords(zones);
-    await this.finalizeDeletingDomains();
+    const cleanupProof = await this.refreshProviderZonesForCleanup(
+      [...plans.map((plan) => plan.doc), ...deletingDocs],
+      zones,
+      zoneResult.provenProviderZoneIds,
+    );
+    await this.cleanupStaleManagedRecords(
+      zones,
+      cleanupProof,
+      new Set(plans.map((plan) => `domain:${plan.doc.id}`).concat(
+        deletingDocs.map((doc) => `domain:${doc.id}`),
+      )),
+      work.forceAll,
+    );
+    await this.finalizeDeletingDomains(deletingDocs, zones);
     await this.dcRouterRef.emailDomainManager?.syncManagedDomainsToRuntime();
     await this.dcRouterRef.workAppMailManager?.applyStoredIdentitiesToRuntime();
+    this.dcRouterRef.opsServer?.invalidateRealtime?.(['emailDomains', 'dns'], {
+      changedIds: docs.map((doc) => doc.id),
+      reason: `mail-dns-reconciled:${reason}`,
+    });
+  }
+
+  private isDomainDue(doc: EmailDomainDoc, now: number): boolean {
+    const retryAt = Date.parse(doc.reconciliation?.retryAt || '');
+    if (Number.isFinite(retryAt) && retryAt <= now) return true;
+    if (!doc.reconciliation?.lastAttemptAt) return true;
+    const rotationDueAt = this.getDkimRotationDueAt(doc, now);
+    return rotationDueAt !== undefined && rotationDueAt <= now;
+  }
+
+  private getDkimRotationDueAt(doc: EmailDomainDoc, now: number): number | undefined {
+    if (!doc.dkim.rotateKeys || !doc.dkim.rotationIntervalDays) return undefined;
+    const activeDkim = this.getActiveDkim(doc);
+    const lastRotation = Date.parse(
+      activeDkim?.promotedAt
+      || doc.dkim.lastRotatedAt
+      || activeDkim?.createdAt
+      || doc.createdAt,
+    );
+    if (!Number.isFinite(lastRotation)) return undefined;
+    const dueAt = lastRotation + doc.dkim.rotationIntervalDays * 86_400_000;
+    const canStage = !doc.pendingDkim
+      && this.dcRouterRef.emailDomainManager?.supportsSelectorCorrectSigning?.() === true
+      && typeof this.dcRouterRef.emailDomainManager?.stageDkimRotationIfDue === 'function';
+    if (canStage) return dueAt;
+    const lastAttemptAt = Date.parse(doc.reconciliation?.lastAttemptAt || '');
+    const retryReference = Number.isFinite(lastAttemptAt) ? lastAttemptAt : now;
+    return Math.max(dueAt, retryReference + MAIL_DNS_RETRY_INTERVAL_MS);
+  }
+
+  private async scheduleNextDue(): Promise<void> {
+    if (this.retryTimer) clearTimeout(this.retryTimer);
+    this.retryTimer = undefined;
+    if (!this.started || this.stopped) return;
+    const dueTimes: number[] = [];
+    const now = Date.now();
+    for (const doc of await EmailDomainDoc.findAll()) {
+      const retryAt = Date.parse(doc.reconciliation?.retryAt || '');
+      if (Number.isFinite(retryAt)) dueTimes.push(retryAt);
+      const rotationDueAt = this.getDkimRotationDueAt(doc, now);
+      if (rotationDueAt !== undefined) dueTimes.push(rotationDueAt);
+    }
+    if (dueTimes.length === 0) return;
+    const delay = Math.max(1, Math.min(2_147_483_647, Math.min(...dueTimes) - now));
+    this.retryTimer = setTimeout(() => {
+      if (this.stopped) return;
+      this.queueRequest([], false);
+      this.kick('scheduled retry').catch((error: unknown) => {
+        logger.log('error', `MailDnsSync scheduled retry failed: ${(error as Error).message}`);
+      });
+    }, delay);
   }
 
   private async buildPlan(doc: EmailDomainDoc, zones: DomainDoc[]): Promise<IPlannedDomain> {
     const now = new Date().toISOString();
     const eligibility = await this.edgeEligibility.resolveForDomain(doc);
     const preliminaryErrors: IEmailDomainOperationError[] = [
-      ...(doc.reconciliation?.errors || []).filter((error) => error.code === 'DKIM_ROTATION_STAGE_FAILED'),
+      ...(doc.reconciliation?.errors || []).filter((error) => (
+        error.code === 'DKIM_ROTATION_STAGE_FAILED'
+        || error.code === 'DKIM_KEY_REPAIR_FAILED'
+      )),
     ];
     if (!eligibility.supported) {
       preliminaryErrors.push({
@@ -566,14 +822,30 @@ export class MailDnsSync {
     return `v=spf1 ${[...terms].sort().join(' ')} -all`.replace(/\s+/g, ' ').trim();
   }
 
-  private async persistDesiredPlan(plan: IPlannedDomain): Promise<void> {
+  private async persistDesiredPlan(plan: IPlannedDomain, zones: DomainDoc[]): Promise<void> {
     const previous = plan.doc.reconciliation;
     const previousSignature = JSON.stringify((previous?.intents || []).map((intent) => [intent.key, intent.value]));
     const nextSignature = JSON.stringify(plan.intents.map((intent) => [intent.key, intent.value]));
     const generation = (previous?.desiredGeneration || 0) + (previousSignature === nextSignature ? 0 : 1);
+    const desiredGeneration = Math.max(generation, 1);
+    plan.revision.generation = desiredGeneration;
+    const providerZoneIds = new Set(previous?.providerZoneIds || []);
+    const providerZones = new Set(zones.filter((zone) => zone.source === 'provider').map((zone) => zone.id));
+    for (const intent of plan.intents) {
+      if (providerZones.has(intent.domainId)) providerZoneIds.add(intent.domainId);
+    }
+    const linkedZone = zones.find((zone) => zone.id === plan.doc.linkedDomainId);
+    if (linkedZone?.source === 'provider') providerZoneIds.add(linkedZone.id);
+    for (const record of await DnsRecordDoc.findAll()) {
+      if (
+        record.managedBy === MAIL_DNS_MANAGED_BY
+        && record.managedOwnerId === `domain:${plan.doc.id}`
+        && providerZones.has(record.domainId)
+      ) providerZoneIds.add(record.domainId);
+    }
     plan.doc.reconciliation = {
       lifecycleStatus: previous?.lifecycleStatus === 'active' ? 'active' : 'pending',
-      desiredGeneration: Math.max(generation, 1),
+      desiredGeneration,
       activeRevision: previous?.activeRevision,
       pendingRevision: plan.revision,
       intents: plan.intents,
@@ -582,6 +854,8 @@ export class MailDnsSync {
         egressIdentityProof: plan.egressIdentitySupported ? 'supported' : 'unsupported',
         selectorCorrectSigning: plan.selectorCorrectSigningSupported ? 'supported' : 'unsupported',
       },
+      providerZoneIds: [...providerZoneIds].sort(),
+      retryAttempt: previous?.retryAttempt,
       lastAttemptAt: new Date().toISOString(),
       retryAt: new Date(Date.now() + MAIL_DNS_RETRY_INTERVAL_MS).toISOString(),
     };
@@ -609,8 +883,12 @@ export class MailDnsSync {
   private async reconcileZones(
     intents: IEmailDnsRecordIntent[],
     zones: DomainDoc[],
-  ): Promise<Map<string, IEmailDomainOperationError>> {
+  ): Promise<{
+    errors: Map<string, IEmailDomainOperationError>;
+    provenProviderZoneIds: Set<string>;
+  }> {
     const errors = new Map<string, IEmailDomainOperationError>();
+    const provenProviderZoneIds = new Set<string>();
     const byZone = new Map<string, IEmailDnsRecordIntent[]>();
     for (const intent of intents) {
       if (!intent.domainId || intent.error) continue;
@@ -625,6 +903,7 @@ export class MailDnsSync {
         if (zone.source === 'provider') {
           const result = await this.dcRouterRef.dnsManager!.syncDomain(zone.id);
           if (!result.success) throw new Error(result.message || `Failed to refresh ${zone.name}`);
+          provenProviderZoneIds.add(zone.id);
         }
         for (const intent of this.sortIntents(zoneIntents)) {
           await this.reconcileIntent(intent, zoneIntents);
@@ -637,12 +916,13 @@ export class MailDnsSync {
         };
         errors.set(zone.id, outcome);
         for (const intent of zoneIntents) {
-          intent.status = 'failed';
+          intent.status = 'pending';
+          intent.verificationOutcome = 'lookup-error';
           intent.error = { ...outcome, recordKey: intent.key };
         }
       }
     }
-    return errors;
+    return { errors, provenProviderZoneIds };
   }
 
   private sortIntents(intents: IEmailDnsRecordIntent[]): IEmailDnsRecordIntent[] {
@@ -663,7 +943,38 @@ export class MailDnsSync {
     const rrset = records.filter((record) => (
       record.name.toLowerCase() === intent.name.toLowerCase() && record.type === intent.type
     ));
+    if (await reconcileMailDnsSingleton({
+      intent,
+      rrset,
+      dnsManager: this.dcRouterRef.dnsManager!,
+      managedBy: MAIL_DNS_MANAGED_BY,
+      createdBy: MAIL_DNS_SYNC_CREATED_BY,
+      evaluate: async (candidate, values) => await this.evaluateTxtRecords(candidate, values),
+    })) return;
+
+    const exactOwner = rrset
+      .filter((record) => (
+        record.managedBy === MAIL_DNS_MANAGED_BY
+        && record.managedOwnerId === intent.ownerId
+        && record.managedRecordKey === intent.key
+      ))
+      .sort((left, right) => left.id.localeCompare(right.id));
     const exact = rrset.filter((record) => this.valuesEqual(intent.type, record.value, intent.value));
+    const exactOtherManaged = exact.filter((record) => (
+      record.managedBy === MAIL_DNS_MANAGED_BY
+      && (record.managedOwnerId !== intent.ownerId || record.managedRecordKey !== intent.key)
+    ));
+    if (exactOtherManaged.length > 0) {
+      intent.status = 'conflict';
+      intent.verificationOutcome = 'conflict';
+      intent.error = {
+        code: 'DNS_MANAGED_OWNER_CONFLICT',
+        message: `Another managed owner controls ${intent.type} ${intent.name}`,
+        recordKey: intent.key,
+        retryable: false,
+      };
+      return;
+    }
     const desiredValues = zoneIntents
       .filter((candidate) => candidate.name.toLowerCase() === intent.name.toLowerCase() && candidate.type === intent.type)
       .map((candidate) => candidate.value);
@@ -674,8 +985,9 @@ export class MailDnsSync {
     const conflictingUnmanaged = unmanaged.filter((record) => (
       !desiredValues.some((desired) => this.valuesEqual(intent.type, record.value, desired))
     ));
-    if (conflictingUnmanaged.length > 0 || (intent.type === 'TXT' && exactUnmanaged.length > 1)) {
+    if (conflictingUnmanaged.length > 0) {
       intent.status = 'conflict';
+      intent.verificationOutcome = 'conflict';
       intent.error = {
         code: 'DNS_UNMANAGED_CONFLICT',
         message: `Unmanaged ${intent.type} record conflicts with ${intent.name}`,
@@ -684,35 +996,32 @@ export class MailDnsSync {
       };
       return;
     }
-    if (exactUnmanaged.length === 1) {
+    if (exactUnmanaged.length > 0) {
       // Exact operator record satisfies the intent without adoption/deletion.
-      // Remove only a dcrouter-owned duplicate of this same intent; other MX
+      // Remove only dcrouter-owned duplicates of this same intent; other MX
       // values in the desired RRset remain independently managed.
-      const ownedDuplicates = rrset.filter((record) => (
-        record.managedBy === MAIL_DNS_MANAGED_BY
-        && (
-          record.managedRecordKey === intent.key
-          || this.valuesEqual(intent.type, record.value, intent.value)
-        )
-      ));
-      for (const duplicate of ownedDuplicates) {
+      for (const duplicate of exactOwner) {
         const result = await this.dcRouterRef.dnsManager!.deleteRecord(duplicate.id);
         if (!result.success) throw new Error(result.message || `Failed to delete duplicate ${intent.key}`);
       }
+      if (exactUnmanaged.length > 1) {
+        intent.status = 'conflict';
+        intent.verificationOutcome = 'duplicate';
+        intent.error = {
+          code: 'DNS_PUBLIC_RRSET_DUPLICATE',
+          message: `Operator ${intent.type} RRset has duplicate values at ${intent.name}`,
+          recordKey: intent.key,
+          retryable: false,
+        };
+        return;
+      }
       intent.status = 'satisfied';
+      intent.satisfactionSource = 'operator';
       return;
     }
 
-    let managed = rrset.find((record) => record.managedRecordKey === intent.key);
-    if (!managed) {
-      const adoptable = exact.find((record) => record.managedBy === MAIL_DNS_MANAGED_BY);
-      if (adoptable) {
-        adoptable.managedOwnerId = intent.ownerId;
-        adoptable.managedRecordKey = intent.key;
-        await adoptable.save();
-        managed = adoptable;
-      }
-    }
+    const managed = exactOwner.find((record) => this.valuesEqual(intent.type, record.value, intent.value))
+      || exactOwner[0];
     if (managed) {
       if (!this.valuesEqual(intent.type, managed.value, intent.value) || managed.name !== intent.name) {
         const result = await this.dcRouterRef.dnsManager!.updateRecord({
@@ -723,8 +1032,13 @@ export class MailDnsSync {
         });
         if (!result.success) throw new Error(result.message || `Failed to update ${intent.key}`);
       }
+      for (const duplicate of exactOwner.filter((record) => record.id !== managed.id)) {
+        const result = await this.dcRouterRef.dnsManager!.deleteRecord(duplicate.id);
+        if (!result.success) throw new Error(result.message || `Failed to delete duplicate ${intent.key}`);
+      }
       intent.providerRecordId = managed.providerRecordId;
       intent.status = 'satisfied';
+      intent.satisfactionSource = 'managed';
       intent.lastAttemptAt = new Date().toISOString();
       return;
     }
@@ -745,6 +1059,15 @@ export class MailDnsSync {
     intent.lastAttemptAt = new Date().toISOString();
   }
 
+  private async evaluateTxtRecords(
+    intent: IEmailDnsRecordIntent,
+    values: string[],
+  ): Promise<IMailDnsTxtPolicyResult> {
+    return this.verifier.evaluateTxtRecords
+      ? await this.verifier.evaluateTxtRecords(intent, values)
+      : await evaluateMailTxtIntent(intent, values);
+  }
+
   private valuesEqual(type: TDnsRecordType, left: string, right: string): boolean {
     if (type === 'MX') return normalizeMx(left) === normalizeMx(right);
     if (type === 'A' || type === 'AAAA') return left.trim() === right.trim();
@@ -770,19 +1093,12 @@ export class MailDnsSync {
       !intent.error && !zoneErrors.has(intent.domainId)
     ));
     const markResult = (intent: IEmailDnsRecordIntent, result: IMailDnsVerificationResult) => {
-      if (result.valid) {
-        intent.status = 'valid';
-        intent.validatedAt = new Date().toISOString();
-        intent.error = undefined;
-      } else {
-        intent.status = 'pending';
-        intent.error = {
-          code: 'DNS_PROPAGATION_PENDING',
-          message: result.reason || `${intent.type} ${intent.name} has not propagated`,
-          recordKey: intent.key,
-          retryable: true,
-        };
-      }
+      const outcome = result.outcome || (result.valid ? 'valid' : 'propagation');
+      applyMailDnsVerificationResult(intent, {
+        outcome,
+        reason: result.reason,
+        effectiveValue: result.effectiveValue,
+      }, 'verify');
     };
     const mxByName = new Map<string, IEmailDnsRecordIntent[]>();
     for (const intent of verifiable.filter((candidate) => candidate.type === 'MX')) {
@@ -793,22 +1109,42 @@ export class MailDnsSync {
     await Promise.all([
       ...verifiable.filter((intent) => intent.type !== 'MX').map(async (intent) => {
         const result = await this.verifier.verifyRecord(intent)
-          .catch((error: unknown) => ({ valid: false, reason: (error as Error).message }));
+          .catch((error: unknown) => ({
+            valid: false,
+            outcome: 'lookup-error' as const,
+            reason: (error as Error).message,
+          }));
         markResult(intent, result);
       }),
       ...[...mxByName.values()].map(async (intents) => {
         const previousMx = (plan.doc.reconciliation?.activeRevision?.mxSlots || [])
-          .map((slot) => `${slot.priority} ${slot.hostname}`).sort();
-        const desiredMx = intents.map((intent) => normalizeMx(intent.value)).sort();
-        const isMakeBeforeBreakTransition = previousMx.length > 0
-          && JSON.stringify(previousMx) !== JSON.stringify(desiredMx);
-        const result = await (this.verifier.verifyMxSet && !isMakeBeforeBreakTransition
-          ? this.verifier.verifyMxSet(intents)
-          : Promise.all(intents.map((intent) => this.verifier.verifyRecord(intent))).then((results) => ({
-              valid: results.every((entry) => entry.valid),
-              reason: results.find((entry) => !entry.valid)?.reason,
-            })))
-          .catch((error: unknown) => ({ valid: false, reason: (error as Error).message }));
+          .map((slot) => `${slot.priority} ${slot.hostname}`);
+        const result = await (this.verifier.verifyMxSet
+          ? this.verifier.verifyMxSet(intents, previousMx)
+          : Promise.all(intents.map((intent) => this.verifier.verifyRecord(intent))).then((results) => {
+              const precedence: TEmailDnsVerificationOutcome[] = [
+                'lookup-error',
+                'invalid',
+                'conflict',
+                'duplicate',
+                'missing',
+                'propagation',
+                'valid',
+              ];
+              const selected = precedence.find((outcome) => results.some((entry) => (
+                (entry.outcome || (entry.valid ? 'valid' : 'propagation')) === outcome
+              ))) || 'propagation';
+              return {
+                valid: selected === 'valid',
+                outcome: selected,
+                reason: results.find((entry) => !entry.valid)?.reason,
+              };
+            }))
+          .catch((error: unknown) => ({
+            valid: false,
+            outcome: 'lookup-error' as const,
+            reason: (error as Error).message,
+          }));
         for (const intent of intents) markResult(intent, result);
       }),
     ]);
@@ -822,7 +1158,11 @@ export class MailDnsSync {
       const identityResults = await Promise.all(plan.revision.edgeIdentities.map(async (identity) => ({
         identity,
         result: await this.verifier.verifyForwardConfirmedIdentity(identity)
-          .catch((error: unknown) => ({ valid: false, reason: (error as Error).message })),
+          .catch((error: unknown) => ({
+            valid: false,
+            outcome: 'lookup-error' as const,
+            reason: (error as Error).message,
+          })),
       })));
       for (const { identity, result } of identityResults) {
         if (!result.valid) {
@@ -845,8 +1185,28 @@ export class MailDnsSync {
       && plan.intents.length > 0
       && plan.intents.every((intent) => intent.status === 'valid')
       && errors.length === 0;
-    const hasPermanentError = errors.some((error) => error.retryable === false)
-      || errors.some((error) => ['DNS_PROVIDER_ZONE_FAILED', 'DNS_UNMANAGED_CONFLICT'].includes(error.code));
+    const hasPermanentError = errors.some((error) => error.retryable === false);
+    const hasOperationalError = errors.some((error) => (
+      error.retryable !== false
+      && (
+        error.code.includes('LOOKUP')
+        || error.code.includes('PROVIDER')
+        || error.code.includes('EGRESS')
+        || error.code.includes('ELIGIBLE')
+      )
+    )) || plan.intents.some((intent) => intent.verificationOutcome === 'lookup-error');
+    const previousRetryAttempt = plan.doc.reconciliation?.retryAttempt || 0;
+    const retryAttempt = canActivate || hasPermanentError
+      ? undefined
+      : hasOperationalError
+        ? previousRetryAttempt + 1
+        : 0;
+    const retryDelay = hasOperationalError
+      ? Math.min(
+          MAIL_DNS_RETRY_INTERVAL_MS * (2 ** Math.max(0, (retryAttempt || 1) - 1)),
+          MAIL_DNS_MAX_RETRY_INTERVAL_MS,
+        )
+      : MAIL_DNS_RETRY_INTERVAL_MS;
     const previousActive = plan.doc.reconciliation?.activeRevision;
     const topologyChanged = Boolean(previousActive) && JSON.stringify({
       selector: previousActive?.selector,
@@ -874,8 +1234,14 @@ export class MailDnsSync {
         egressIdentityProof: plan.egressIdentitySupported ? 'supported' : 'unsupported',
         selectorCorrectSigning: plan.selectorCorrectSigningSupported ? 'supported' : 'unsupported',
       },
+      providerZoneIds: plan.doc.reconciliation?.providerZoneIds || [],
+      retryAttempt,
       lastAttemptAt: now,
-      ...(canActivate ? { lastSuccessAt: now } : { retryAt: new Date(Date.now() + MAIL_DNS_RETRY_INTERVAL_MS).toISOString() }),
+      ...(canActivate
+        ? { lastSuccessAt: now }
+        : hasPermanentError
+          ? {}
+          : { retryAt: new Date(Date.now() + retryDelay).toISOString() }),
     };
     plan.doc.dnsStatus = {
       mx: this.statusForIntent(plan.intents, (intent) => intent.type === 'MX'),
@@ -889,7 +1255,7 @@ export class MailDnsSync {
     if (canActivate && topologyChanged) {
       // The transition SPF intentionally authorizes old + new identities. Run
       // one immediate follow-up to contract it to the newly active revision.
-      this.dirty = true;
+      this.queueRequest([plan.doc.id], false);
     }
   }
 
@@ -924,11 +1290,76 @@ export class MailDnsSync {
     const selected = intents.filter(predicate);
     if (selected.length === 0) return 'missing';
     if (selected.every((intent) => intent.status === 'valid')) return 'valid';
-    if (selected.some((intent) => intent.status === 'conflict' || intent.status === 'failed')) return 'invalid';
+    if (selected.some((intent) => (
+      intent.verificationOutcome === 'duplicate'
+      || intent.verificationOutcome === 'conflict'
+      || intent.verificationOutcome === 'invalid'
+      || intent.status === 'conflict'
+      || intent.status === 'failed'
+    ))) return 'invalid';
+    if (selected.some((intent) => intent.verificationOutcome === 'lookup-error')) {
+      return 'unchecked';
+    }
     return 'missing';
   }
 
-  private async cleanupStaleManagedRecords(zones: DomainDoc[]): Promise<void> {
+  private async refreshProviderZonesForCleanup(
+    docs: EmailDomainDoc[],
+    zones: DomainDoc[],
+    initialProof: Set<string>,
+  ): Promise<Set<string>> {
+    const provenZoneIds = new Set(initialProof);
+    const ownerDocsByZone = new Map<string, Set<EmailDomainDoc>>();
+    for (const doc of docs) {
+      if (!doc.reconciliation) continue;
+      if (doc.reconciliation.providerZoneIds === undefined) {
+        doc.reconciliation.errors.push({
+          code: 'DNS_PROVIDER_PROVENANCE_UNKNOWN',
+          message: 'Provider-zone provenance is unknown; destructive DNS cleanup is blocked',
+          retryable: true,
+        });
+        doc.reconciliation.retryAt = new Date(Date.now() + MAIL_DNS_RETRY_INTERVAL_MS).toISOString();
+        await doc.save();
+        continue;
+      }
+      for (const zoneId of doc.reconciliation.providerZoneIds) {
+        if (provenZoneIds.has(zoneId)) continue;
+        const owners = ownerDocsByZone.get(zoneId) || new Set<EmailDomainDoc>();
+        owners.add(doc);
+        ownerDocsByZone.set(zoneId, owners);
+      }
+    }
+    for (const [zoneId, owners] of ownerDocsByZone) {
+      const zone = zones.find((candidate) => candidate.id === zoneId);
+      try {
+        if (!zone || zone.source !== 'provider') {
+          throw new Error(`Provider zone ${zoneId} is not available`);
+        }
+        const result = await this.dcRouterRef.dnsManager!.syncDomain(zoneId);
+        if (!result.success) throw new Error(result.message || `Failed to refresh ${zone.name}`);
+        provenZoneIds.add(zoneId);
+      } catch (error: unknown) {
+        for (const owner of owners) {
+          if (!owner.reconciliation) continue;
+          owner.reconciliation.errors.push({
+            code: 'DNS_CLEANUP_FAILED',
+            message: `Failed to refresh provider zone ${zone?.name || zoneId} before cleanup: ${(error as Error).message}`,
+            retryable: true,
+          });
+          owner.reconciliation.retryAt = new Date(Date.now() + MAIL_DNS_RETRY_INTERVAL_MS).toISOString();
+          await owner.save();
+        }
+      }
+    }
+    return provenZoneIds;
+  }
+
+  private async cleanupStaleManagedRecords(
+    zones: DomainDoc[],
+    provenProviderZoneIds: Set<string>,
+    selectedOwnerIds: Set<string>,
+    allowTopologyCleanup: boolean,
+  ): Promise<void> {
     const docs = await EmailDomainDoc.findAll();
     const keep = new Set<string>();
     for (const doc of docs) {
@@ -940,7 +1371,14 @@ export class MailDnsSync {
     }
     const managed = (await DnsRecordDoc.findAll()).filter((record) => record.managedBy === MAIL_DNS_MANAGED_BY);
     for (const record of managed) {
+      if (!record.managedOwnerId || !record.managedRecordKey) continue;
+      if (
+        !selectedOwnerIds.has(record.managedOwnerId)
+        && !(allowTopologyCleanup && record.managedOwnerId.startsWith('topology:'))
+      ) continue;
       if (record.managedRecordKey && keep.has(record.managedRecordKey)) continue;
+      const zone = zones.find((candidate) => candidate.id === record.domainId);
+      if (zone?.source === 'provider' && !provenProviderZoneIds.has(zone.id)) continue;
       try {
         const result = await this.dcRouterRef.dnsManager!.deleteRecord(record.id);
         if (!result.success) throw new Error(result.message || 'delete failed');
@@ -961,11 +1399,39 @@ export class MailDnsSync {
     }
   }
 
-  private async finalizeDeletingDomains(): Promise<void> {
-    const docs = await EmailDomainDoc.findAll();
-    const records = await DnsRecordDoc.findAll();
-    for (const doc of docs) {
+  private async finalizeDeletingDomains(
+    deletingDocs: EmailDomainDoc[],
+    zones: DomainDoc[],
+  ): Promise<void> {
+    for (const doc of deletingDocs) {
       if (doc.reconciliation?.lifecycleStatus !== 'deleting') continue;
+      if (doc.reconciliation.providerZoneIds === undefined) continue;
+      if (doc.reconciliation.errors.some((error) => (
+        error.code === 'DNS_CLEANUP_FAILED'
+        || error.code === 'DNS_PROVIDER_PROVENANCE_UNKNOWN'
+      ))) continue;
+      let providerProofComplete = true;
+      for (const zoneId of doc.reconciliation.providerZoneIds) {
+        const zone = zones.find((candidate) => candidate.id === zoneId);
+        if (!zone || zone.source !== 'provider') {
+          providerProofComplete = false;
+          break;
+        }
+        const confirmation = await this.dcRouterRef.dnsManager!.syncDomain(zoneId);
+        if (!confirmation.success) {
+          providerProofComplete = false;
+          doc.reconciliation.errors.push({
+            code: 'DNS_CLEANUP_FAILED',
+            message: `Provider zone ${zone.name} could not confirm deletion: ${confirmation.message || 'list failed'}`,
+            retryable: true,
+          });
+          doc.reconciliation.retryAt = new Date(Date.now() + MAIL_DNS_RETRY_INTERVAL_MS).toISOString();
+          await doc.save();
+          break;
+        }
+      }
+      if (!providerProofComplete) continue;
+      const records = await DnsRecordDoc.findAll();
       const owned = records.some((record) => (
         record.managedBy === MAIL_DNS_MANAGED_BY && record.managedOwnerId === `domain:${doc.id}`
       ));