feat: answer CNAME, MX and TXT from the record set

[ralyodio]

Brings this bridge level with the registry, which can now publish four record types (moshcoder/moshcode#241) and whose own resolver already answers them (moshcoder/moshcode#242).

What was wrong

The socket gated on A/AAAA and returned an honest empty NOERROR for everything else. So an owner could publish an MX in the Pit, see it listed on their name, and get nothing from dig MX — with no way to tell a record that isn't served from one they typed wrong.

What changed

CNAME, MX and TXT are answered out of the ?records=1 the registry already exposes.

• TXT splits at 255 bytes on byte boundaries. Long values are normal rather than exceptional — a DKIM key never fits in one string — and splitting on characters cuts a multi-byte one in half so neither piece decodes. There's a test that publishes 60 emoji and requires the value back whole.
• MX carries its preference first, as the wire format requires.
• A record whose rdata won't encode is dropped, not thrown. This reads JSON over HTTP from a registry that may be a different version than the bridge; one bad row must not take down the answers beside it.
• Oversized replies are trimmed to 512 bytes and marked TC, rather than dropping every answer — this bridge speaks UDP only, so a client told to retry over TCP finds nobody home.
• A published CNAME now answers the address question it was invisible to. A name pointed at a hostname has no address to give (targetAddress returns null for one on purpose — this bridge does not do clearnet DNS), so it was NODATA and looked exactly like a typo. The extra round trip happens only when the name is here and has no address, so a name that already resolves pays nothing.

Note the CNAME is answered only when one is actually published, not synthesized from any hostname target — that keeps the existing NODATA behaviour for a hostname or :8080 target exactly as its tests require.

Compatibility

records appears on a resolveName result only when asked for, so every existing caller sees the shape it always did. buildResponse, answerPolicy and answerFor are untouched.

This matters beyond this repo: moshcode vendors this file as src/dns.mjs and has a drift test that compares the two. Keeping these shapes stable is what lets that test stay meaningful.

Tests

14 new in test/dns-records.test.mjs, decoding rdata back off the wire rather than counting answers — an MX with its preference in the wrong order produces a reply of exactly the right shape that no client can use.

Full suite: 82/82 pass (68 existing, unchanged).

Note on versions

package.json said 0.2.1 while npm has 0.2.2 published — the repo was behind what shipped. Bumped to 0.3.0, which clears both. I have not published to npm; that's yours to run when you're happy with this.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.