@serve.zone/dcrouter 17.10.2 → 18.0.1

package/ts/email/classes.accepted-email-spool.ts

@@ -77,6 +77,19 @@ const ACCEPTED_EMAIL_STOP_DRAIN_TIMEOUT_MS = 30_000;
 /** Retention for catch-all stored inbound mail (30 days). */
 const INBOUND_STORE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
 
+/**
+ * Permanent per-email storage failure: the raw RFC822 payload of an accepted
+ * email is unrecoverable, so delivery can never succeed. The spool marks such
+ * rows failed instead of retrying them, so one lost blob cannot wedge the
+ * whole queue.
+ */
+export class AcceptedEmailRawMessageMissingError extends Error {
+  constructor(messageArg: string) {
+    super(messageArg);
+    this.name = 'AcceptedEmailRawMessageMissingError';
+  }
+}
+
 export type TSmartMtaQueueItemLike = {
   id?: string;
   processingResult?: {
@@ -690,32 +703,55 @@ export class AcceptedEmailSpool {
     for (const item of (emailServerArg as TSmartMtaQueueReader).getQueueItems?.() || []) {
       const cachedEmailId = this.getCachedEmailIdFromQueueItem(item);
       if (!cachedEmailId || !item.smtpTransactions?.length) continue;
-      await this.runCachedEmailUpdate(cachedEmailId, async () => {
-        const cachedEmail = await CachedEmail.findById(cachedEmailId);
-        if (!cachedEmail) return;
-        for (const transaction of item.smtpTransactions || []) {
-          this.appendSmtpTransaction(cachedEmail, transaction);
-        }
-        await cachedEmail.save();
-      });
+      try {
+        await this.runCachedEmailUpdate(cachedEmailId, async () => {
+          const cachedEmail = await CachedEmail.findById(cachedEmailId);
+          if (!cachedEmail) return;
+          for (const transaction of item.smtpTransactions || []) {
+            this.appendSmtpTransaction(cachedEmail, transaction);
+          }
+          await cachedEmail.save();
+        });
+      } catch (error: unknown) {
+        // History reconciliation runs during email-server startup; one row that
+        // cannot be persisted must not abort reconciliation or startup.
+        logger.log('warn', `Unable to reconcile SMTP transaction history for accepted email ${cachedEmailId}: ${(error as Error).message}`);
+      }
     }
   }
 
   /** Requeue emails left in 'queued' state by a previous process as pending. */
   public async recoverQueuedEmails(): Promise<void> {
+    // Rows whose recovery save failed stay 'queued' and are re-served by
+    // findQueuedForRecovery; track them so they are neither retried in a loop
+    // within this run nor able to wedge recovery when they fill a whole batch.
+    const unrecoverableIds = new Set<string>();
     while (true) {
       const queuedEmails = await CachedEmail.findQueuedForRecovery(ACCEPTED_EMAIL_SPOOL_BATCH_SIZE);
-      if (queuedEmails.length === 0) {
+      const recoverableEmails = queuedEmails.filter((queuedEmail) => !unrecoverableIds.has(queuedEmail.id));
+      if (recoverableEmails.length === 0) {
         return;
       }
-      for (const queuedEmail of queuedEmails) {
+      for (const queuedEmail of recoverableEmails) {
         if (this.isCachedEmailTerminal(queuedEmail)) {
           continue;
         }
-        queuedEmail.status = 'pending';
-        queuedEmail.nextAttempt = new Date();
-        await queuedEmail.save();
-        await this.notifyEmailQueuePersisted(queuedEmail, 'email-queue-recovered');
+        const previousStatus = queuedEmail.status;
+        const previousNextAttempt = queuedEmail.nextAttempt;
+        try {
+          queuedEmail.status = 'pending';
+          queuedEmail.nextAttempt = new Date();
+          await queuedEmail.save();
+          await this.notifyEmailQueuePersisted(queuedEmail, 'email-queue-recovered');
+        } catch (error: unknown) {
+          // Recovery runs during email-server startup; a row that cannot be
+          // persisted stays 'queued' for the next startup and must not abort
+          // recovery of the remaining rows.
+          queuedEmail.status = previousStatus;
+          queuedEmail.nextAttempt = previousNextAttempt;
+          unrecoverableIds.add(queuedEmail.id);
+          logger.log('warn', `Unable to recover queued accepted email ${queuedEmail.id}: ${(error as Error).message}`);
+        }
       }
       if (queuedEmails.length < ACCEPTED_EMAIL_SPOOL_BATCH_SIZE) {
         return;
@@ -735,18 +771,54 @@ export class AcceptedEmailSpool {
         if (this.stopping || this.dcRouterRef.emailServer !== emailServer) {
           break;
         }
-        if (await this.postponeLiveSmartMtaOwnedEmail(cachedEmail, emailServer)) {
-          continue;
+        try {
+          if (await this.postponeLiveSmartMtaOwnedEmail(cachedEmail, emailServer)) {
+            continue;
+          }
+          const session = this.buildCachedEmailSession(cachedEmail);
+          const rawMessage = await this.readRawMessage(cachedEmail);
+          await this.processAcceptedCachedEmail(cachedEmail, rawMessage, session, emailServer);
+        } catch (error: unknown) {
+          // One poisoned row must never stall the rest of the batch: record the
+          // failure on that row alone and keep processing the remaining emails.
+          await this.handleSpoolItemFailure(cachedEmail, error);
         }
-        const session = this.buildCachedEmailSession(cachedEmail);
-        const rawMessage = await this.readRawMessage(cachedEmail);
-        await this.processAcceptedCachedEmail(cachedEmail, rawMessage, session, emailServer);
       }
     } finally {
       this.processing = false;
     }
   }
 
+  /**
+   * Record a per-email spool failure without aborting the batch: permanent
+   * raw-message losses are marked failed, everything else is deferred through
+   * the regular retry mechanism (which terminates at maxAttempts).
+   */
+  private async handleSpoolItemFailure(cachedEmail: CachedEmail, errorArg: unknown): Promise<void> {
+    const message = (errorArg as Error).message;
+    try {
+      const currentCachedEmail = await CachedEmail.findById(cachedEmail.id) || cachedEmail;
+      if (this.isCachedEmailTerminal(currentCachedEmail)) {
+        return;
+      }
+      if (errorArg instanceof AcceptedEmailRawMessageMissingError) {
+        currentCachedEmail.markFailed(message);
+        await currentCachedEmail.save();
+        await this.notifyEmailQueuePersisted(currentCachedEmail, 'email-raw-message-missing');
+        logger.log('error', `Accepted email ${currentCachedEmail.id} failed permanently: ${message}`);
+        return;
+      }
+      currentCachedEmail.scheduleRetry(ACCEPTED_EMAIL_RETRY_DELAY_MS);
+      currentCachedEmail.lastError = message;
+      await currentCachedEmail.save();
+      await this.notifyEmailQueuePersisted(currentCachedEmail, 'email-spool-deferred');
+      logger.log('warn', `Accepted email ${currentCachedEmail.id} deferred after spool processing failure: ${message}`);
+    } catch (persistError: unknown) {
+      // Even failing to persist the failure state must not abort the batch.
+      logger.log('error', `Unable to persist spool failure state for accepted email ${cachedEmail.id}: ${(persistError as Error).message} (original error: ${message})`);
+    }
+  }
+
   private async processAcceptedCachedEmail(
     cachedEmail: CachedEmail,
     emailData: Email | plugins.buffer.Buffer,
@@ -1010,11 +1082,16 @@ export class AcceptedEmailSpool {
       }
       const rawMessage = await blobStorage.get(cachedEmailArg.rawContentObjectKey);
       if (!rawMessage) {
-        throw new Error(`Raw RFC822 object is missing for accepted email ${cachedEmailArg.id}`);
+        throw new AcceptedEmailRawMessageMissingError(`Raw RFC822 object is missing for accepted email ${cachedEmailArg.id}`);
       }
       return plugins.buffer.Buffer.from(rawMessage);
     }
-    throw new Error(`Accepted email ${cachedEmailArg.id} has no raw RFC822 payload`);
+    if (cachedEmailArg.rawContent) {
+      // Legacy rows persisted before SmartBucket-backed storage keep their
+      // payload inline; serve it rather than declaring the payload lost.
+      return plugins.buffer.Buffer.from(cachedEmailArg.rawContent, 'utf8');
+    }
+    throw new AcceptedEmailRawMessageMissingError(`Accepted email ${cachedEmailArg.id} has no raw RFC822 payload`);
   }
 
   public async deleteRawMessage(cachedEmailArg: CachedEmail): Promise<void> {

package/ts/email/classes.smartmta-blob-storage-manager.ts

@@ -1,4 +1,5 @@
 import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
 import type { IBlobStorageManager } from '@push.rocks/smartmta';
 
 const SMARTMTA_BLOB_NAMESPACES = [
@@ -119,11 +120,18 @@ export class SmartMtaBlobStorageManager implements IBlobStorageManager {
     const objectPrefix = this.toObjectKey(prefix);
     const keys: string[] = [];
     for await (const objectKey of this.bucketRef.listAllObjects(objectPrefix)) {
+      // One stray or malformed object under the prefix must not abort the
+      // whole listing (SmartMTA queue recovery lists at startup); skip it.
       if (!objectKey.startsWith(this.objectPrefix)) {
-        throw new Error(`SmartBucket returned an object outside the configured prefix: ${objectKey}`);
+        logger.log('warn', `Skipping SmartBucket object outside the configured prefix during SmartMTA blob listing: ${objectKey}`);
+        continue;
       }
       const key = `/${objectKey.slice(this.objectPrefix.length)}`;
-      keys.push(normalizeBlobKey(key));
+      try {
+        keys.push(normalizeBlobKey(key));
+      } catch (error: unknown) {
+        logger.log('warn', `Skipping unnormalizable SmartBucket object key during SmartMTA blob listing: ${objectKey} (${(error as Error).message})`);
+      }
     }
     return keys.sort();
   }

package/ts/errors/error.codes.ts

@@ -80,6 +80,10 @@ export const DCR_ROUTING_ERROR = 'DCR_ROUTING_ERROR';
 export const DCR_CONFIGURATION_ERROR = 'DCR_CONFIGURATION_ERROR';
 export const DCR_PROXY_ERROR = 'DCR_PROXY_ERROR';
 export const DCR_DOMAIN_ERROR = 'DCR_DOMAIN_ERROR';
+/** A certificate requirement or authoritative DNS zone was requested for a domain we cannot prove we own. */
+export const DCR_DOMAIN_OWNERSHIP_UNVERIFIED = 'DCR_DOMAIN_OWNERSHIP_UNVERIFIED';
+/** ACME failed for a configuration cause that no amount of retrying can resolve. */
+export const DCR_ACME_PERMANENT_FAILURE = 'DCR_ACME_PERMANENT_FAILURE';
 
 // SMS service errors (SMS_*)
 export const SMS_SERVICE_ERROR = 'SMS_SERVICE_ERROR';

package/ts/opsserver/classes.opsserver.ts

@@ -37,6 +37,7 @@ export class OpsServer {
   private usersHandler!: handlers.UsersHandler;
   private dnsProviderHandler!: handlers.DnsProviderHandler;
   private domainHandler!: handlers.DomainHandler;
+  private dnsAuthorityHandler!: handlers.DnsAuthorityHandler;
   private dnsRecordHandler!: handlers.DnsRecordHandler;
   private acmeConfigHandler!: handlers.AcmeConfigHandler;
   private emailDomainHandler!: handlers.EmailDomainHandler;
@@ -104,6 +105,7 @@ export class OpsServer {
     this.usersHandler = new handlers.UsersHandler(this);
     this.dnsProviderHandler = new handlers.DnsProviderHandler(this);
     this.domainHandler = new handlers.DomainHandler(this);
+    this.dnsAuthorityHandler = new handlers.DnsAuthorityHandler(this);
     this.dnsRecordHandler = new handlers.DnsRecordHandler(this);
     this.acmeConfigHandler = new handlers.AcmeConfigHandler(this);
     this.emailDomainHandler = new handlers.EmailDomainHandler(this);

package/ts/opsserver/handlers/acme-config.handler.ts

@@ -66,6 +66,13 @@ export class AcmeConfigHandler {
               },
               userId,
             );
+            // The SmartAcme startup budget does not re-arm on a timer, so a
+            // corrected ACME configuration must re-arm it explicitly. Otherwise a
+            // permanently-failed or exhausted provider stays down until an
+            // unrelated SmartProxy rebuild or a restart (30–60 s of outage).
+            this.opsServerRef.dcRouterRef.smartAcmeLifecycle?.rearm(
+              'ACME configuration updated',
+            );
             return { success: true, config: updated };
           } catch (err: unknown) {
             return { success: false, message: (err as Error).message };

package/ts/opsserver/handlers/certificate.handler.ts

@@ -266,22 +266,35 @@ export class CertificateHandler {
         }
       }
 
-      // Try SmartProxy certificate status if no event data
-      if (status === 'unknown' && info.routeNames.length > 0) {
+      // What the running proxy actually serves. Always queried, not only as a
+      // fallback: the served state is an independent fact from the stored one and
+      // the two must be comparable.
+      let served: interfaces.requests.ICertificateServedState | undefined;
+      if (info.routeNames.length > 0) {
         try {
           const rustStatus = await smartProxy.getCertificateStatus(info.routeNames[0]);
           if (rustStatus) {
-            if (rustStatus.expiresAt > 0) {
-              expiryDate = new Date(rustStatus.expiresAt).toISOString();
-            }
-            if (rustStatus.source) issuer = rustStatus.source;
-            status = rustStatus.isValid ? 'valid' : 'expired';
+            served = {
+              expiryDate: rustStatus.expiresAt > 0
+                ? new Date(rustStatus.expiresAt).toISOString()
+                : undefined,
+              isValid: rustStatus.isValid,
+              source: rustStatus.source || undefined,
+            };
           }
         } catch {
-          // Rust bridge may not support this command yet — ignore
+          // Rust bridge may not support this command yet — leave served unknown.
         }
       }
 
+      // With no event data, the served state is also the best available view of
+      // the issued one.
+      if (status === 'unknown' && served) {
+        if (served.expiryDate) expiryDate = served.expiryDate;
+        if (served.source) issuer = served.source;
+        status = served.isValid ? 'valid' : 'expired';
+      }
+
       // Check persisted cert data from smartdata document classes
       if (status === 'unknown') {
         const cleanDomain = domain.replace(/^\*\.?/, '');
@@ -352,6 +365,23 @@ export class CertificateHandler {
         error = error || backoffInfo.lastError;
       }
 
+      // Issued is not served. A certificate valid in storage while the engine
+      // still presents an invalid or expired one is a failure, however healthy
+      // the issuance path looks — this is exactly what hid a 21-day outage.
+      const servedMismatch = Boolean(
+        served
+        && !served.isValid
+        && (status === 'valid' || status === 'expiring'),
+      );
+      if (servedMismatch) {
+        status = 'failed';
+        error = error
+          || `A valid certificate is stored for '${domain}'`
+            + `${expiryDate ? ` (expires ${expiryDate})` : ''}, but the running proxy is serving an invalid one`
+            + `${served?.expiryDate ? ` (expired ${served.expiryDate})` : ''}. `
+            + 'The issued certificate has not reached the engine.';
+      }
+
       certificates.push({
         domain,
         routeNames: info.routeNames,
@@ -363,6 +393,8 @@ export class CertificateHandler {
         issuedAt,
         error,
         canReprovision: info.canReprovision,
+        served,
+        ...(servedMismatch ? { servedMismatch: true } : {}),
         backoffInfo,
       });
     }
@@ -419,6 +451,21 @@ export class CertificateHandler {
       return { success: false, message: `No routes found for domain '${domain}'` };
     }
 
+    // Refuse before triggering an order that cannot succeed. forceRenew is an
+    // operator override for backoff, not for missing ownership: without a zone we
+    // can prove is ours there is nowhere to place the DNS-01 challenge record.
+    if (dcRouter.dnsManager) {
+      const ownership = await dcRouter.dnsManager.resolveDomainOwnership(domain);
+      if (!ownership.verified) {
+        return {
+          success: false,
+          message:
+            `Cannot provision a certificate for '${domain}': domain ownership is unverified `
+            + `(${ownership.reason}) — ${ownership.detail}`,
+        };
+      }
+    }
+
     // Respect existing backoff unless explicitly overridden. Automated
     // callers (gateway clients retrying cert fetches) used to reset the
     // backoff and trigger a route re-apply on every request, producing a
@@ -488,12 +535,60 @@ export class CertificateHandler {
         // Fallback when DB is disabled and there is no RouteConfigManager
         await smartProxy.updateRoutes(smartProxy.routeManager.getRoutes());
       }
+      const propagation = await this.describeCertPropagationGap(domain, routeNames);
+      if (propagation) {
+        return { success: false, message: propagation };
+      }
       return { success: true, message: forceRenew ? `Certificate force-renewed for domain '${domain}'` : `Certificate reprovisioning triggered for domain '${domain}'` };
     } catch (err: unknown) {
       return { success: false, message: (err as Error).message || `Failed to reprovision certificate for ${domain}` };
     }
   }
 
+  /**
+   * After triggering the apply pipeline, check whether the certificate the proxy
+   * is actually serving is still expired. If it is, the reprovision did not
+   * propagate and reporting success would be a lie.
+   *
+   * The known cause is SmartProxy's own per-domain provisioning cooldown
+   * (`certProvisionFailureCooldownMs`, 30 min default). It is private in-memory
+   * state with no invalidation path: a provisioning sweep skips a cooling-down
+   * domain, and because the sweep returns before its summary log when every
+   * domain is skipped, the skip is not logged either. So a valid certificate can
+   * sit in storage while the proxy keeps serving the expired one, silently.
+   *
+   * Returns undefined when propagation looks fine or cannot be determined —
+   * `getCertificateStatus` goes through the Rust bridge and may be unavailable.
+   */
+  private async describeCertPropagationGap(
+    domain: string,
+    routeNames: string[],
+  ): Promise<string | undefined> {
+    const smartProxy = this.opsServerRef.dcRouterRef.smartProxy;
+    if (!smartProxy || routeNames.length === 0) {
+      return undefined;
+    }
+    let status: Awaited<ReturnType<typeof smartProxy.getCertificateStatus>>;
+    try {
+      status = await smartProxy.getCertificateStatus(routeNames[0]);
+    } catch {
+      // Bridge command unsupported — cannot determine, so do not claim a gap.
+      return undefined;
+    }
+    if (!status || status.isValid || !status.expiresAt || status.expiresAt <= 0) {
+      return undefined;
+    }
+    const servedUntil = new Date(status.expiresAt).toISOString();
+    const message =
+      `Certificate for '${domain}' was issued and stored, but route '${routeNames[0]}' is still serving a `
+      + `certificate that expired at ${servedUntil}. The new certificate did not reach the running proxy: `
+      + 'SmartProxy keeps a private per-domain provisioning cooldown that a sweep cannot clear while it is '
+      + 'active, and it exposes no per-domain invalidation or hot-load API. Toggling this single route off and '
+      + 'back on is the only supported way to force a fresh attempt without restarting dcrouter.';
+    logger.log('error', message, { domain, routeName: routeNames[0] });
+    return message;
+  }
+
   /**
    * After a force-renew, walk every route in the smartproxy that resolves to
    * the same cert identity as `forcedDomain` and write the freshly-issued cert

package/ts/opsserver/handlers/config.handler.ts

@@ -137,7 +137,9 @@ export class ConfigHandler {
       enabled: !!dcRouter.dnsServer,
       port: 53,
       nsDomains: opts.dnsNsDomains || [],
-      scopes: opts.dnsScopes || [],
+      // The delegation-verified authority set. Deployment configuration no
+      // longer contributes: this is database state, and it is the only state.
+      scopes: dcRouter.dnsAuthorityManager?.getEffectiveZoneNames() || [],
       recordCount: dnsRecords.length,
       records: dnsRecords,
       dnsChallenge: dnsChallengeEnabled,

package/ts/opsserver/handlers/dns-authority.handler.ts

@@ -0,0 +1,142 @@
+import * as plugins from '../../plugins.js';
+import type { OpsServer } from '../classes.opsserver.js';
+import * as interfaces from '../../../ts_interfaces/index.js';
+import { requireOpsAuth } from '../helpers/auth.js';
+
+/**
+ * DNS authority handlers.
+ *
+ * Adding a zone here is an authority claim — after it succeeds dcrouter answers
+ * for that zone with the `aa` flag on a public port and will request
+ * certificates for it. So it carries the same posture as the other DNS write
+ * surfaces (admin identity or a `:write`-scoped token) *and* the claim itself is
+ * gated on a delegation proof the caller cannot forge. Authorization decides who
+ * may ask; the probe decides whether the answer is yes.
+ */
+export class DnsAuthorityHandler {
+  public typedrouter = new plugins.typedrequest.TypedRouter();
+
+  constructor(private opsServerRef: OpsServer) {
+    this.opsServerRef.typedrouter.addTypedRouter(this.typedrouter);
+    this.registerHandlers();
+  }
+
+  private async requireAuth(
+    request: { identity?: interfaces.data.IIdentity; apiToken?: string },
+    requiredScope?: interfaces.data.TApiTokenScope,
+  ): Promise<string> {
+    const auth = await requireOpsAuth(this.opsServerRef, request, {
+      scope: requiredScope,
+      requireAdminIdentity: requiredScope?.endsWith(':write'),
+    });
+    return auth.userId;
+  }
+
+  private registerHandlers(): void {
+    // Read the authority set: delegation-verified zones, and nothing else.
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetDnsAuthority>(
+        'getDnsAuthority',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            // No manager means the set was never loaded. Reported as
+            // 'unavailable' rather than as an empty set, so a reader cannot
+            // mistake "we could not look" for "there is nothing".
+            return {
+              settings: {
+                zones: [],
+                state: 'unavailable' as const,
+                expectedNameservers: [],
+                updatedAt: 0,
+                updatedBy: '',
+              },
+            };
+          }
+          return { settings: manager.getSettings() };
+        },
+      ),
+    );
+
+    // Probe a zone's delegation without changing anything
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_ProbeDnsAuthorityZone>(
+        'probeDnsAuthorityZone',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return {
+              probe: {
+                zone: dataArg.zone,
+                verdict: 'undeterminable' as const,
+                observedNameservers: [],
+                expectedNameservers: [],
+                detail: 'DnsAuthorityManager is not initialized',
+              },
+            };
+          }
+          return { probe: await manager.probeDelegation(dataArg.zone) };
+        },
+      ),
+    );
+
+    // Claim authority over a zone, against a delegation proof
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_VerifyDnsAuthorityZone>(
+        'verifyDnsAuthorityZone',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'dns-authority:write');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { success: false, message: 'DnsAuthorityManager is not initialized' };
+          }
+          const result = await manager.verifyZone(dataArg.zone, userId);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.(['dns', 'routes'], {
+              reason: 'dns-authority-verified',
+            });
+          }
+          return result;
+        },
+      ),
+    );
+
+    // Drop a verified zone. Every zone is revocable — there is no bootstrap floor.
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_RevokeDnsAuthorityZone>(
+        'revokeDnsAuthorityZone',
+        async (dataArg) => {
+          const userId = await this.requireAuth(dataArg, 'dns-authority:write');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { success: false, message: 'DnsAuthorityManager is not initialized' };
+          }
+          const result = await manager.revokeZone(dataArg.zone, userId);
+          if (result.success) {
+            this.opsServerRef.invalidateRealtime?.(['dns', 'routes'], {
+              reason: 'dns-authority-revoked',
+            });
+          }
+          return result;
+        },
+      ),
+    );
+
+    // Compare declared authority against observed delegation, both directions
+    this.typedrouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetDnsAuthorityDrift>(
+        'getDnsAuthorityDrift',
+        async (dataArg) => {
+          await this.requireAuth(dataArg, 'dns-authority:read');
+          const manager = this.opsServerRef.dcRouterRef.dnsAuthorityManager;
+          if (!manager) {
+            return { drift: [] };
+          }
+          return { drift: await manager.auditDelegationDrift() };
+        },
+      ),
+    );
+  }
+}

package/ts/opsserver/handlers/dns-provider.handler.ts

@@ -138,6 +138,12 @@ export class DnsProviderHandler {
           if (!dnsManager) return { success: false, message: 'DnsManager not initialized' };
           const result = await dnsManager.deleteProvider(dataArg.id, dataArg.force ?? false);
           if (result.success) {
+            // Removing a provider removes the credentialed zone listing that
+            // proved ownership for its domains, so the ownership-gated private
+            // route DNS overlay must be re-derived rather than left serving.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'DNS provider deletion',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'dns-provider-deleted',

package/ts/opsserver/handlers/domain.handler.ts

@@ -138,6 +138,13 @@ export class DomainHandler {
           if (!dnsManager) return { success: false, message: 'DnsManager not initialized' };
           const ok = await dnsManager.deleteDomain(dataArg.id);
           if (ok) {
+            // The private-route DNS overlay is derived from routes but gated on
+            // domain ownership, so deleting a domain invalidates it even though no
+            // route changed. Without this it keeps answering authoritatively for a
+            // zone we no longer manage until an unrelated route apply.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'domain deletion',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'domain-deleted',
@@ -183,6 +190,11 @@ export class DomainHandler {
             deleteExistingProviderRecords: dataArg.deleteExistingProviderRecords,
           });
           if (result.success) {
+            // Migrating away from a provider can drop the proof that made the
+            // overlay's hostnames servable, so re-derive it here too.
+            await this.opsServerRef.dcRouterRef.resyncPrivateRouteDnsOverlay(
+              'domain migration',
+            );
             this.opsServerRef.invalidateRealtime?.(['dns', 'emailDomains'], {
               changedIds: [dataArg.id],
               reason: 'domain-migrated',

package/ts/opsserver/handlers/gatewayclient.handler.ts

@@ -604,7 +604,7 @@ export class GatewayClientHandler {
         enabled: Boolean(dcRouter.remoteIngressManager?.getHubSettings().enabled),
       },
       dns: {
-        authoritative: Boolean(dcRouter.options.dnsScopes?.length),
+        authoritative: Boolean(dcRouter.dnsAuthorityManager?.getEffectiveZoneNames().length),
         providerManaged: Boolean(dcRouter.dnsManager),
       },
       http3: {

package/ts/opsserver/handlers/index.ts

@@ -17,6 +17,7 @@ export * from './network-target.handler.js';
 export * from './users.handler.js';
 export * from './dns-provider.handler.js';
 export * from './domain.handler.js';
+export * from './dns-authority.handler.js';
 export * from './dns-record.handler.js';
 export * from './acme-config.handler.js';
 export * from './email-domain.handler.js';

package/ts/readme.md

@@ -58,7 +58,7 @@ await router.start();
 - SmartProxy for HTTP/HTTPS/TCP routes
 - `UnifiedEmailServer` for SMTP ingress, delivery, managed app address bindings, and outbound SMTP submission when `emailConfig` is present
 - DB-backed managers for routes, API tokens, target profiles, domains, records, ACME config, and email domains when the DB is enabled
-- embedded authoritative DNS and DoH route generation from `dnsNsDomains` and `dnsScopes`
+- embedded authoritative DNS and DoH route generation from `dnsNsDomains` plus the delegation-verified zones held in the database
 - VPN, RADIUS, and remote ingress services when their config blocks are enabled
 - OpsServer and the dashboard, which start on every boot
 - an admin-JWT authenticated read-only MCP endpoint at `/mcp` for safe route, DNS, email, RemoteIngress, and VPN summaries

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '17.10.2',
+  version: '18.0.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }