nx_email_mx.nx

nx_email_mx.nx -- EMAIL RUNG R0: MX-record resolution (RFC 5321 §5.1). module: nishi-core.email.mx depends: nishi-core.net.dns capability: CORE_EMAIL The FIRST email-specific rung above the existing sovereign transport hardware (nx_socket UDP + nx_dns wire codec). Before sending mail a client must learn WHICH host accepts mail for a domain: that is the domain's MX (Mail eXchanger) record set, ordered by preference (lowest preference value = highest priority, tried first -- RFC 5321 §5.1). nx_dns already encodes the MX qtype (NX_DNS_TYPE_MX=15) and a generic query builder; what was missing is the ANSWER-side parse for MX rdata (preference u16 + exchange domain-name, which may use RFC 1035 §4.1.4 compression pointers) plus the preference ordering. This module is PURE (no syscalls): parse/decode/sort over caller buffers, architecture-neutral exactly like nx_dns.nx, so the live UDP composition can live in a later nx_email_mx_io.nx (mirrors the nx_dns / nx_dns_io split) without dragging a syscall dependency into the codec. Query building is already covered: call the existing nx_dns_build_query(name, len, NX_DNS_TYPE_MX, tx_id, out, cap). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_1035 + ietf/rfc_5321 lineage_id: nishi_email_mx_resolution_r0 nx_safety_envelope: intended_use: "MX rdata parse (preference + exchange name) + preference ordering. RFC 5321 §5.1 substrate." sil_target: SIL2 (DNS-spoof picks the attacker's MX) evidence: [RFC_5321_canonical_basis, sealed_verdict_enum, txid_spoof_gate, bounded_128_hop_anti_cycle, compression_pointer_decode, preference_sort] hazard_register: [bug-tape-MX-spoof-relay-hijack, bug-tape-compression-pointer-cycle-OOM] residual_risk: "Authenticity of the MX set needs DNSSEC / DANE in an upstream consumer (queued R5). This substrate enforces the txid spoof gate + a 128-hop bound on compression-pointer chase."