propgate docs

@propgate/dns › Overview

@propgate/dns

The resolver, the six evaluators, and the diagnosis taxonomy are one MIT package with zero runtime dependencies, Node built-ins only. It is not a simplified extract of what runs behind the API: it is the exact same code, workspace:*-linked into apps/api and this docs site. Nothing about the hosted product knows more than the package does.

pnpm add @propgate/dns

Why take it alone

  • No API key, no network call to us. query and the evaluators talk straight to whatever resolver you point them at.
  • The taxonomy is the point. 73 diagnosis codes, each either produced by a fixture in the test harness or carrying a written reason it cannot be. Useful on its own if you are building diagnostics rather than a full checker.
  • MIT, forever. packages/db, packages/jobs, and everything else in this repo that talks to a database is private. This package is not, and never becomes, gated behind an account.

Why not node:dns

Node's built-in resolver wraps c-ares, which cannot express several things this package exists to report on. Each row below is load-bearing for at least one diagnosis code: lose the signal and the code becomes unreachable.

Needed for

node:dns

Load-bearing for

The TC bit: was the answer truncated?

Not exposed. An oversized DKIM key is indistinguishable from a missing record.

TCP_SILENTLY_BLOCKED

DO bit / RRSIG records

Cannot set DO; never returns RRSIGs, so DNSSEC state is invisible.

DNSSEC_BOGUS, DNSSEC_INSECURE_ISLAND

Authority-section SOA of an NXDOMAIN

Discarded, so the RFC 2308 negative-cache TTL cannot be computed.

NEGATIVE_CACHE_LIKELY

Advertised EDNS buffer size

Not controllable, so truncation cannot be driven from the client.

TCP_SILENTLY_BLOCKED

REFUSED vs SERVFAIL vs NXDOMAIN

Collapsed into error codes that lose the distinction.

CAA_POLICY_FROM_ANCESTOR, SPF_TEMPORARY_FAILURE

AA flag

Not exposed, so a lame delegation is invisible.

NS_DELEGATION_LAME

The trade is a hand-rolled wire codec over node:dgram and node:net, roughly 2 kLOC checked against a fixture tier of deliberately broken servers, in exchange for being able to see everything on the wire. See the resolver for how that surfaces.

What's in the package

  • The resolver: query, QueryOutcome, port awareness, truncation and the TCP fallback.
  • The evaluators: runChecks, a DomainProfile, and the six checks: delegation, SPF, DKIM, DMARC, MX, CAA.
  • Recipes: three complete files: check a domain and switch on the verdict, query a specific resolver on a non-standard port, and read the lookups behind a finding.