nx_dns_authoritative.nx

nx_dns_authoritative.nx -- UDP/53 authoritative DNS serve. Composes the shipped DNS substrate (nx_dns.nx endian + label encode/decode + parse) + UDP socket syscalls to serve A records from a caller-provided zone table. Per cardinal feedback-no-third-party-trust-native-or-nothing: substrate's own authoritative DNS. No bind, no powerdns, no nsd, no Cloudflare API. Per cardinal user-owns-every-bit: - Caller provides the zone-table buffer + the listen address. - Substrate doesn't auto-bind to 0.0.0.0:53. Default helper uses 127.0.0.1; public binding is an explicit caller choice. - No upstream resolution. This is AUTHORITATIVE only (RFC 1035 §6). Out-of-zone queries get REFUSED, not forwarded. What this primitive does: 1. Parse incoming DNS query packet 2. Extract QNAME + QTYPE 3. Look up QNAME in caller's zone table 4. Build response: header + question echo + answer or NXDOMAIN What this primitive does NOT do (queued): - DNSSEC signing (RFC 4035): nx_dns_dnssec_sign.nx queued - TCP DNS (RFC 7766): use UDP-truncated TC bit to force retry - Zone transfer (AXFR/IXFR): only single-server today - Recursive resolution: out-of-zone -> REFUSED - EDNS(0) OPT pseudo-record: ignored on input, omitted on output Sealed enums: NxDnsAuthVerdict (7 states): OK / SOCKET_ERR / BIND_ERR / RECV_ERR / PARSE_ERR / SEND_ERR / BAD_ARG NxDnsResponseClass (4 states for canonical response codes): NOERROR (0) -- answer matched zone NXDOMAIN (3) -- name not in zone REFUSED (5) -- name not in this server's zone (out-of-scope)