unifi-cli 0.4.2__tar.gz → 0.4.3__tar.gz

unifi_cli-0.4.3/.github/workflows/dependencies.yml

@@ -0,0 +1,25 @@
+name: Dependency health
+
+on:
+  schedule:
+    - cron: "51 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  packages: read
+  pull-requests: read
+
+jobs:
+  update:
+    uses: rvben/upd/.github/workflows/dependency-health.yml@ecb605d32c4edc8dee4091aeb30b3d37ebdd290a # v0.10.0
+    with:
+      langs: rust,actions
+      lock: true
+      min-age: 7d
+      max-bump: minor
+      validation-command: make check
+      fail-on-blocked: false
+      branch: deps/upd
+      commit-message: "chore(deps): refresh dependencies"

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/.github/workflows/release.yml

@@ -270,6 +270,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
     needs: [build, sdist]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
@@ -283,10 +284,16 @@ jobs:
         with:
           enable-cache: false
 
+      - name: Authenticate to crates.io via Trusted Publishing
+        id: crates_io_auth
+        if: ${{ inputs.dry_run != true && inputs.skip_crates_io != true }}
+        # v1.0.5
+        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18
+
       - name: Publish to crates.io
         if: ${{ inputs.dry_run != true && inputs.skip_crates_io != true }}
         env:
-          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+          CARGO_REGISTRY_TOKEN: ${{ steps.crates_io_auth.outputs.token }}
         run: cargo publish --locked
 
       - name: Test crates.io publish (dry run)

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.4.3](https://github.com/rvben/unifi-cli/compare/v0.4.2...v0.4.3) - 2026-09-17
+
+### Added
+
+- **dns**: manage static DNS records ([149edf3](https://github.com/rvben/unifi-cli/commit/149edf379d1df00e79ea8c2b783c9895e4d7f74e))
+
+### Fixed
+
+- **dns**: stop update from destroying records on v2 controllers ([445be02](https://github.com/rvben/unifi-cli/commit/445be02b5ab59dd04382ac93787afc407b7d4bd9))
+
 ## [0.4.2](https://github.com/rvben/unifi-cli/compare/v0.4.1...v0.4.2) - 2026-08-26
 
 ### Added

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/Cargo.lock

@@ -2786,7 +2786,7 @@ checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
 [[package]]
 name = "unifi-cli"
-version = "0.4.2"
+version = "0.4.3"
 dependencies = [
  "clap",
  "clap_complete",

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "unifi-cli"
-version = "0.4.2"
+version = "0.4.3"
 edition = "2024"
 rust-version = "1.90"
 description = "CLI for UniFi Network controller"

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: unifi-cli
-Version: 0.4.2
+Version: 0.4.3
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
@@ -137,16 +137,16 @@ to trust the controller and saves `accept_invalid_certs = true` for you.
 ### Destructive commands
 
 `clients block`, `clients unblock`, `clients kick`, `devices restart`,
-`devices upgrade`, `ports cycle` and `protect rtsps delete` all ask before they
-act. On a terminal you get a yes/no question naming the target; declining exits
-2 with `kind: confirmation_required` and sends nothing. When stdin is not a
-terminal there is nobody to ask, so they refuse with the same error unless you
-pass `--yes`, which skips the question everywhere.
+`devices upgrade`, `ports cycle`, `protect rtsps delete` and `dns delete` all
+ask before they act. On a terminal you get a yes/no question naming the target;
+declining exits 2 with `kind: confirmation_required` and sends nothing. When
+stdin is not a terminal there is nobody to ask, so they refuse with the same
+error unless you pass `--yes`, which skips the question everywhere.
 
 `unifi schema` marks exactly these commands `confirmation_required: true`, so a
 caller can tell them apart from mutating commands that act immediately
-(`devices locate`, `clients set-fixed-ip`, `protect rtsps create`) without
-hardcoding the list.
+(`devices locate`, `clients set-fixed-ip`, `protect rtsps create`, `dns create`,
+`dns update`) without hardcoding the list.
 
 ## TUI dashboard
 
@@ -283,6 +283,31 @@ unifi port-forwards list
 unifi port-forwards show plex
 ```
 
+### DNS records
+
+Static DNS records the controller answers locally. Network 10.1+ uses the
+official DNS-policies Integration API; older controllers fall back to the v2
+`static-dns` API. Domain-forward policies are not listed.
+
+```bash
+unifi dns list
+unifi dns list --type A
+unifi dns show nas.example.com
+unifi dns create nas.example.com 192.0.2.10
+unifi dns create printer.example.com 2001:db8::10 --type AAAA
+unifi dns create media.example.com nas.example.com --type CNAME
+unifi dns update nas.example.com --value 192.0.2.11
+unifi dns delete nas.example.com
+```
+
+`dns delete` is destructive and follows the same confirmation rules as
+`clients block`. Create and update act immediately.
+
+The v2 API has no PUT, so `dns update` is refused on a controller that falls
+back to it. Editing a record there means `dns delete` followed by
+`dns create`, which keeps the delete explicit and confirmed instead of hiding
+it inside an update that cannot undo it when the create fails.
+
 ### Events
 
 ```bash

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/README.md

@@ -116,16 +116,16 @@ to trust the controller and saves `accept_invalid_certs = true` for you.
 ### Destructive commands
 
 `clients block`, `clients unblock`, `clients kick`, `devices restart`,
-`devices upgrade`, `ports cycle` and `protect rtsps delete` all ask before they
-act. On a terminal you get a yes/no question naming the target; declining exits
-2 with `kind: confirmation_required` and sends nothing. When stdin is not a
-terminal there is nobody to ask, so they refuse with the same error unless you
-pass `--yes`, which skips the question everywhere.
+`devices upgrade`, `ports cycle`, `protect rtsps delete` and `dns delete` all
+ask before they act. On a terminal you get a yes/no question naming the target;
+declining exits 2 with `kind: confirmation_required` and sends nothing. When
+stdin is not a terminal there is nobody to ask, so they refuse with the same
+error unless you pass `--yes`, which skips the question everywhere.
 
 `unifi schema` marks exactly these commands `confirmation_required: true`, so a
 caller can tell them apart from mutating commands that act immediately
-(`devices locate`, `clients set-fixed-ip`, `protect rtsps create`) without
-hardcoding the list.
+(`devices locate`, `clients set-fixed-ip`, `protect rtsps create`, `dns create`,
+`dns update`) without hardcoding the list.
 
 ## TUI dashboard
 
@@ -262,6 +262,31 @@ unifi port-forwards list
 unifi port-forwards show plex
 ```
 
+### DNS records
+
+Static DNS records the controller answers locally. Network 10.1+ uses the
+official DNS-policies Integration API; older controllers fall back to the v2
+`static-dns` API. Domain-forward policies are not listed.
+
+```bash
+unifi dns list
+unifi dns list --type A
+unifi dns show nas.example.com
+unifi dns create nas.example.com 192.0.2.10
+unifi dns create printer.example.com 2001:db8::10 --type AAAA
+unifi dns create media.example.com nas.example.com --type CNAME
+unifi dns update nas.example.com --value 192.0.2.11
+unifi dns delete nas.example.com
+```
+
+`dns delete` is destructive and follows the same confirmation rules as
+`clients block`. Create and update act immediately.
+
+The v2 API has no PUT, so `dns update` is refused on a controller that falls
+back to it. Editing a record there means `dns delete` followed by
+`dns create`, which keeps the delete explicit and confirmed instead of hiding
+it inside an update that cannot undo it when the create fails.
+
 ### Events
 
 ```bash

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/src/api/client.rs

@@ -118,10 +118,17 @@ fn normalize_base_url(host: &str) -> Result<String, ApiError> {
     Ok(candidate)
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum DnsApiKind {
+    Integration,
+    LegacyV2,
+}
+
 pub struct UnifiClient {
     http: reqwest::Client,
     base_url: String,
     site_id: Option<String>,
+    dns_api: Option<DnsApiKind>,
 }
 
 impl UnifiClient {
@@ -153,6 +160,7 @@ impl UnifiClient {
             http,
             base_url,
             site_id: None,
+            dns_api: None,
         })
     }
 
@@ -256,6 +264,53 @@ impl UnifiClient {
         json_or_unsupported(resp, &endpoint).await
     }
 
+    async fn send(
+        &self,
+        method: reqwest::Method,
+        path: &str,
+        body: Option<&serde_json::Value>,
+    ) -> Result<reqwest::Response, ApiError> {
+        let url = format!("{}{path}", self.base_url);
+        let mut req = self.http.request(method, &url);
+        if let Some(body) = body {
+            req = req.json(body);
+        }
+        let resp = req.send().await?;
+        let status = resp.status().as_u16();
+        if !resp.status().is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            return Err(error_for_status(status, body));
+        }
+        Ok(resp)
+    }
+
+    async fn send_json<T: DeserializeOwned>(
+        &self,
+        method: reqwest::Method,
+        path: &str,
+        body: Option<&serde_json::Value>,
+    ) -> Result<T, ApiError> {
+        let resp = self.send(method, path, body).await?;
+        json_or_unsupported(resp, path).await
+    }
+
+    async fn send_empty(
+        &self,
+        method: reqwest::Method,
+        path: &str,
+        body: Option<&serde_json::Value>,
+    ) -> Result<(), ApiError> {
+        self.send(method, path, body).await?;
+        Ok(())
+    }
+
+    /// True when a DNS endpoint is not there: the legacy markers, plus the
+    /// `Unsupported` that `json_or_unsupported` raises when UniFi OS proxies
+    /// an unknown path to the web UI.
+    fn is_absent_dns_endpoint(err: &ApiError) -> bool {
+        is_absent_legacy_endpoint(err) || matches!(err, ApiError::Unsupported { .. })
+    }
+
     // Paginate through all results from Integration API
     async fn paginate_all<T: DeserializeOwned>(&self, base_path: &str) -> Result<Vec<T>, ApiError> {
         let mut all = Vec::new();
@@ -477,6 +532,214 @@ impl UnifiClient {
             .ok_or_else(|| ApiError::NotFound(format!("Port forward '{identifier}' not found")))
     }
 
+    // Static DNS records.
+    //
+    // Network 10.1+ serves these as Integration DNS policies:
+    // `/proxy/network/integration/v1/sites/{siteId}/dns/policies`. Network 8.2+
+    // serves the same records at `/proxy/network/v2/api/site/{site}/static-dns`.
+    // Domain-forward policies live on the Integration collection too and are
+    // not static records, so they are dropped.
+
+    async fn ensure_dns_api(&mut self) -> Result<DnsApiKind, ApiError> {
+        if let Some(kind) = self.dns_api {
+            return Ok(kind);
+        }
+        match self.probe_integration_dns().await {
+            Ok(()) => {
+                self.dns_api = Some(DnsApiKind::Integration);
+                Ok(DnsApiKind::Integration)
+            }
+            Err(err) if Self::is_absent_dns_endpoint(&err) => {
+                match self.list_legacy_static_dns().await {
+                    Ok(_) => {
+                        self.dns_api = Some(DnsApiKind::LegacyV2);
+                        Ok(DnsApiKind::LegacyV2)
+                    }
+                    Err(legacy_err) if Self::is_absent_dns_endpoint(&legacy_err) => {
+                        Err(ApiError::Unsupported {
+                            endpoint: "/proxy/network/integration/v1/sites/{siteId}/dns/policies"
+                                .into(),
+                            reason: UnsupportedReason::Removed,
+                        })
+                    }
+                    Err(legacy_err) => Err(legacy_err),
+                }
+            }
+            Err(err) => Err(err),
+        }
+    }
+
+    async fn probe_integration_dns(&mut self) -> Result<(), ApiError> {
+        let site_id = self.ensure_site_id().await?.to_string();
+        let _: PaginatedResponse<IntegrationDnsPolicy> = self
+            .get_integration(&format!(
+                "/proxy/network/integration/v1/sites/{site_id}/dns/policies?offset=0&limit=1"
+            ))
+            .await?;
+        Ok(())
+    }
+
+    async fn list_integration_dns_policies(&mut self) -> Result<Vec<StaticDnsRecord>, ApiError> {
+        let site_id = self.ensure_site_id().await?.to_string();
+        let policies: Vec<IntegrationDnsPolicy> = self
+            .paginate_all(&format!(
+                "/proxy/network/integration/v1/sites/{site_id}/dns/policies"
+            ))
+            .await?;
+        Ok(policies
+            .iter()
+            .filter_map(IntegrationDnsPolicy::to_static_record)
+            .collect())
+    }
+
+    async fn list_legacy_static_dns(&self) -> Result<Vec<StaticDnsRecord>, ApiError> {
+        let records: Vec<LegacyStaticDns> = self
+            .send_json(
+                reqwest::Method::GET,
+                "/proxy/network/v2/api/site/default/static-dns",
+                None,
+            )
+            .await?;
+        Ok(records
+            .iter()
+            .filter_map(LegacyStaticDns::to_static_record)
+            .collect())
+    }
+
+    pub async fn list_static_dns(&mut self) -> Result<Vec<StaticDnsRecord>, ApiError> {
+        match self.ensure_dns_api().await? {
+            DnsApiKind::Integration => self.list_integration_dns_policies().await,
+            DnsApiKind::LegacyV2 => self.list_legacy_static_dns().await,
+        }
+    }
+
+    pub async fn get_static_dns(&mut self, identifier: &str) -> Result<StaticDnsRecord, ApiError> {
+        let records = self.list_static_dns().await?;
+        resolve_static_dns(&records, identifier).cloned()
+    }
+
+    pub async fn create_static_dns(
+        &mut self,
+        write: &StaticDnsWrite,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        match self.ensure_dns_api().await? {
+            DnsApiKind::Integration => self.create_integration_dns(write).await,
+            DnsApiKind::LegacyV2 => self.create_legacy_static_dns(write).await,
+        }
+    }
+
+    pub async fn update_static_dns(
+        &mut self,
+        identifier: &str,
+        write: &StaticDnsWrite,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        let existing = self.get_static_dns(identifier).await?;
+        match self.dns_api {
+            Some(DnsApiKind::Integration) => self.update_integration_dns(&existing.id, write).await,
+            Some(DnsApiKind::LegacyV2) => {
+                // The v2 API has no PUT. Deleting the record and recreating it
+                // would lose it outright whenever the create fails, and the
+                // caller asked to edit a record, not to risk it. Deleting is
+                // still available as its own confirmed command.
+                Err(ApiError::Unsupported {
+                    endpoint: "/proxy/network/v2/api/site/default/static-dns".into(),
+                    reason: UnsupportedReason::NoUpdateEndpoint,
+                })
+            }
+            None => unreachable!("get_static_dns selects an API"),
+        }
+    }
+
+    pub async fn delete_static_dns(
+        &mut self,
+        identifier: &str,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        let existing = self.get_static_dns(identifier).await?;
+        match self.dns_api {
+            Some(DnsApiKind::Integration) => {
+                self.delete_integration_dns(&existing.id).await?;
+            }
+            Some(DnsApiKind::LegacyV2) => {
+                self.delete_legacy_static_dns(&existing.id).await?;
+            }
+            None => unreachable!("get_static_dns selects an API"),
+        }
+        Ok(existing)
+    }
+
+    async fn create_integration_dns(
+        &mut self,
+        write: &StaticDnsWrite,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        let site_id = self.ensure_site_id().await?.to_string();
+        let body = write.integration_body().map_err(ApiError::Other)?;
+        let created: IntegrationDnsPolicy = self
+            .send_json(
+                reqwest::Method::POST,
+                &format!("/proxy/network/integration/v1/sites/{site_id}/dns/policies"),
+                Some(&body),
+            )
+            .await?;
+        created.to_static_record().ok_or_else(|| {
+            ApiError::Other("Controller created a DNS policy that is not a static record".into())
+        })
+    }
+
+    async fn update_integration_dns(
+        &mut self,
+        id: &str,
+        write: &StaticDnsWrite,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        let site_id = self.ensure_site_id().await?.to_string();
+        let body = write.integration_body().map_err(ApiError::Other)?;
+        let updated: IntegrationDnsPolicy = self
+            .send_json(
+                reqwest::Method::PUT,
+                &format!("/proxy/network/integration/v1/sites/{site_id}/dns/policies/{id}"),
+                Some(&body),
+            )
+            .await?;
+        updated.to_static_record().ok_or_else(|| {
+            ApiError::Other("Controller updated a DNS policy that is not a static record".into())
+        })
+    }
+
+    async fn delete_integration_dns(&mut self, id: &str) -> Result<(), ApiError> {
+        let site_id = self.ensure_site_id().await?.to_string();
+        self.send_empty(
+            reqwest::Method::DELETE,
+            &format!("/proxy/network/integration/v1/sites/{site_id}/dns/policies/{id}"),
+            None,
+        )
+        .await
+    }
+
+    async fn create_legacy_static_dns(
+        &self,
+        write: &StaticDnsWrite,
+    ) -> Result<StaticDnsRecord, ApiError> {
+        let body = write.legacy_body().map_err(ApiError::Other)?;
+        let created: LegacyStaticDns = self
+            .send_json(
+                reqwest::Method::POST,
+                "/proxy/network/v2/api/site/default/static-dns",
+                Some(&body),
+            )
+            .await?;
+        created.to_static_record().ok_or_else(|| {
+            ApiError::Other("Controller created an unreadable static DNS record".into())
+        })
+    }
+
+    async fn delete_legacy_static_dns(&self, id: &str) -> Result<(), ApiError> {
+        self.send_empty(
+            reqwest::Method::DELETE,
+            &format!("/proxy/network/v2/api/site/default/static-dns/{id}"),
+            None,
+        )
+        .await
+    }
+
     pub async fn list_wan_interfaces(&self) -> Result<Vec<NamedWanInterface>, ApiError> {
         let gateways: Vec<GatewayWanStatus> = self.get_legacy("/stat/device").await?;
         let gateway = gateways

unifi_cli-0.4.3/src/api/mod.rs

@@ -0,0 +1,14 @@
+mod client;
+pub mod types;
+
+pub use client::ClientOptions;
+pub use client::ProtectSession;
+pub use client::UnifiClient;
+pub use client::error_for_status;
+pub use types::{
+    ApiError, Client, DEFAULT_DNS_TTL_SECONDS, Device, DeviceWithPorts, DnsRecordType, Event,
+    HealthSubsystem, HostSystem, LastConnection, LegacyClient, LegacyDevice, LegacyResponse,
+    NamedWanInterface, Network, PortEntry, PortForward, StaticDnsRecord, StaticDnsWrite, SysInfo,
+    UnsupportedReason, WanInterface, format_bytes, format_mac, format_uptime, normalize_mac,
+    resolve_static_dns,
+};

{unifi_cli-0.4.2 → unifi_cli-0.4.3}/src/api/tests.rs

@@ -894,3 +894,163 @@ fn port_entry_tolerates_absent_last_connection() {
     assert_eq!(p.autoneg, None);
     assert_eq!(p.is_uplink, None);
 }
+
+#[test]
+fn dns_record_type_accepts_integration_and_legacy_spellings() {
+    assert_eq!(DnsRecordType::parse("A").unwrap(), DnsRecordType::A);
+    assert_eq!(DnsRecordType::parse("a_record").unwrap(), DnsRecordType::A);
+    assert_eq!(DnsRecordType::parse("AAAA").unwrap(), DnsRecordType::Aaaa);
+    assert!(DnsRecordType::parse("FORWARD_DOMAIN").is_err());
+}
+
+#[test]
+fn integration_forward_domain_is_not_a_static_record() {
+    let policy: IntegrationDnsPolicy = serde_json::from_value(serde_json::json!({
+        "type": "FORWARD_DOMAIN",
+        "id": "ffffffff-ffff-ffff-ffff-ffffffffffff",
+        "enabled": true,
+        "domain": "corp.example.com",
+        "ipAddress": "192.0.2.53"
+    }))
+    .unwrap();
+    assert!(policy.to_static_record().is_none());
+}
+
+#[test]
+fn integration_a_record_maps_to_the_cli_shape() {
+    let policy: IntegrationDnsPolicy = serde_json::from_value(serde_json::json!({
+        "type": "A_RECORD",
+        "id": "11111111-2222-3333-4444-555555555555",
+        "enabled": true,
+        "domain": "nas.example.com",
+        "ipv4Address": "192.0.2.10",
+        "ttlSeconds": 14400
+    }))
+    .unwrap();
+    let record = policy.to_static_record().unwrap();
+    assert_eq!(record.name, "nas.example.com");
+    assert_eq!(record.record_type, DnsRecordType::A);
+    assert_eq!(record.value, "192.0.2.10");
+    assert_eq!(record.ttl, Some(14400));
+}
+
+#[test]
+fn integration_srv_owner_is_rebuilt_from_split_fields() {
+    let policy: IntegrationDnsPolicy = serde_json::from_value(serde_json::json!({
+        "type": "SRV_RECORD",
+        "id": "11111111-2222-3333-4444-555555555555",
+        "enabled": true,
+        "domain": "example.com",
+        "service": "_ldap",
+        "protocol": "_tcp",
+        "serverDomain": "dir.example.com",
+        "priority": 10,
+        "weight": 20,
+        "port": 389
+    }))
+    .unwrap();
+    let record = policy.to_static_record().unwrap();
+    assert_eq!(record.name, "_ldap._tcp.example.com");
+    assert_eq!(record.value, "dir.example.com");
+    assert_eq!(record.port, Some(389));
+}
+
+#[test]
+fn mx_write_omits_ttl_on_the_integration_body() {
+    let write = StaticDnsWrite {
+        name: "example.com".into(),
+        record_type: DnsRecordType::Mx,
+        value: "mail.example.com".into(),
+        ttl: None,
+        enabled: true,
+        priority: Some(10),
+        weight: None,
+        port: None,
+    };
+    let body = write.integration_body().unwrap();
+    assert!(body.get("ttlSeconds").is_none(), "{body}");
+    assert_eq!(body["mailServerDomain"], "mail.example.com");
+    assert_eq!(body["priority"], 10);
+}
+
+#[test]
+fn resolve_static_dns_prefers_id_and_conflicts_on_duplicate_names() {
+    let records = vec![
+        StaticDnsRecord {
+            id: "id-1".into(),
+            name: "dup.example.com".into(),
+            record_type: DnsRecordType::A,
+            value: "192.0.2.10".into(),
+            ttl: None,
+            enabled: true,
+            priority: None,
+            weight: None,
+            port: None,
+        },
+        StaticDnsRecord {
+            id: "id-2".into(),
+            name: "dup.example.com".into(),
+            record_type: DnsRecordType::A,
+            value: "192.0.2.11".into(),
+            ttl: None,
+            enabled: true,
+            priority: None,
+            weight: None,
+            port: None,
+        },
+    ];
+    assert_eq!(resolve_static_dns(&records, "id-2").unwrap().id, "id-2");
+    match resolve_static_dns(&records, "dup.example.com") {
+        Err(ApiError::Conflict(message)) => {
+            assert!(message.contains("id-1"), "{message}");
+            assert!(message.contains("id-2"), "{message}");
+        }
+        other => panic!("expected conflict, got {other:?}"),
+    }
+}
+
+#[test]
+fn update_from_a_legacy_mx_record_drops_the_ttl_it_cannot_send() {
+    let existing = StaticDnsRecord {
+        id: "aaaaaaaaaaaaaaaaaaaaaaaa".into(),
+        name: "example.com".into(),
+        record_type: DnsRecordType::Mx,
+        value: "mail.example.com".into(),
+        ttl: Some(300),
+        enabled: true,
+        priority: Some(10),
+        weight: None,
+        port: None,
+    };
+    let write = StaticDnsWrite::from_record(&existing);
+    assert_eq!(write.ttl, None);
+    write
+        .validate()
+        .expect("an untouched MX record must still validate");
+}
+
+#[test]
+fn legacy_body_keeps_a_trailing_dot_in_txt_data() {
+    let write = StaticDnsWrite {
+        name: "example.com".into(),
+        record_type: DnsRecordType::Txt,
+        value: "v=spf1 -all.".into(),
+        ttl: None,
+        enabled: true,
+        priority: None,
+        weight: None,
+        port: None,
+    };
+    assert_eq!(write.legacy_body().unwrap()["value"], "v=spf1 -all.");
+    let cname = StaticDnsWrite {
+        name: "media.example.com".into(),
+        record_type: DnsRecordType::Cname,
+        value: "nas.example.com.".into(),
+        ttl: None,
+        enabled: true,
+        priority: None,
+        weight: None,
+        port: None,
+    };
+    assert_eq!(cname.legacy_body().unwrap()["value"], "nas.example.com");
+}