Missing A or AAAA record causes NXDOMAIN

dig A app.example.com +noall +comment
dig AAAA app.example.com +noall +comment
dig app.example.com CNAME

dig @ns1.example.com app.example.com A
dig +trace app.example.com A

app.example.com  300  IN  A      203.0.113.10
app.example.com  300  IN  AAAA   2001:db8::10

; or, if it should point to another hostname instead:
app.example.com  300  IN  CNAME  target.cdnprovider.net.

curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "Authorization: Bearer {CLOUDFLARE_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{"type":"A","name":"app.example.com","content":"203.0.113.10","ttl":300,"proxied":false}'

dig A app.example.com +noall +answer
dig @ns1.example.com app.example.com A
dig @1.1.1.1 app.example.com A
dig @8.8.8.8 app.example.com A
curl -Iv https://app.example.com

# a good answer looks like:
# ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 9182
# app.example.com.  300  IN  A  203.0.113.10

"""Detect a missing A/AAAA record (true NXDOMAIN) and repair it via Cloudflare.
Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("missing_address_record")


def classify_missing_record(rcode: str, answer_count: int, expected_name_exists: bool) -> str:
    """Pure decision function. No network, no I/O."""
    if rcode == "NXDOMAIN" and answer_count == 0 and expected_name_exists:
        return "missing_record_nxdomain"
    if rcode == "NOERROR" and answer_count == 0:
        return "nodata_wrong_type"
    if answer_count > 0:
        return "ok"
    return "unexpected"


def run():
    # Imported lazily so the pure function above can be tested with no
    # network libraries installed at all.
    import dns.resolver
    import dns.rdatatype
    import requests

    domain = os.environ["DNS_DOMAIN"]
    record_type = os.environ.get("RECORD_TYPE", "A")
    target = os.environ.get("RECORD_TARGET", "203.0.113.10")
    ttl = int(os.environ.get("RECORD_TTL", "300"))
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"

    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]

    # Find the authoritative nameservers for the zone, then query them
    # directly so the answer cannot be a stale cache.
    ns_answer = dns.resolver.resolve(domain, "NS")
    nameservers = [str(r.target).rstrip(".") for r in ns_answer]
    ns_ip = dns.resolver.resolve(nameservers[0], "A")[0].address

    resolver = dns.resolver.Resolver()
    resolver.nameservers = [ns_ip]

    try:
        answer = resolver.resolve(domain, record_type)
        rcode = "NOERROR"
        answer_count = len(answer)
    except dns.resolver.NXDOMAIN:
        rcode = "NXDOMAIN"
        answer_count = 0
    except dns.resolver.NoAnswer:
        rcode = "NOERROR"
        answer_count = 0

    outcome = classify_missing_record(rcode, answer_count, expected_name_exists=True)
    log.info("Name %s classified as %s (rcode=%s, answers=%d)", domain, outcome, rcode, answer_count)

    if outcome != "missing_record_nxdomain":
        log.info("Nothing to repair.")
        return

    log.info("Missing %s record for %s. %s create it pointing to %s.",
              record_type, domain, "Would" if dry_run else "Will", target)

    if dry_run:
        return

    resp = requests.post(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        headers={"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"},
        json={"type": record_type, "name": domain, "content": target, "ttl": ttl},
        timeout=30,
    )
    resp.raise_for_status()
    log.info("Created %s record for %s -> %s", record_type, domain, target)


if __name__ == "__main__":
    run()

/**
 * Detect a missing A/AAAA record (true NXDOMAIN) and repair it via Cloudflare.
 * Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

export function classifyMissingRecord(rcode, answerCount, expectedNameExists) {
  // Pure decision function. No network, no I/O.
  if (rcode === "NXDOMAIN" && answerCount === 0 && expectedNameExists) {
    return "missing_record_nxdomain";
  }
  if (rcode === "NOERROR" && answerCount === 0) {
    return "nodata_wrong_type";
  }
  if (answerCount > 0) {
    return "ok";
  }
  return "unexpected";
}

export async function run() {
  // Imported lazily so the pure function above can be tested with no
  // network modules touched at all.
  const dns = await import("node:dns");
  const resolvePromises = dns.promises;

  const domain = process.env.DNS_DOMAIN;
  const recordType = process.env.RECORD_TYPE || "A";
  const target = process.env.RECORD_TARGET || "203.0.113.10";
  const ttl = Number(process.env.RECORD_TTL || 300);
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";

  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;

  // Find the authoritative nameservers for the zone, then query them
  // directly so the answer cannot be a stale cache.
  const nameservers = await resolvePromises.resolveNs(domain);
  const nsIp = (await resolvePromises.resolve4(nameservers[0]))[0];

  const resolver = new dns.promises.Resolver();
  resolver.setServers([nsIp]);

  let rcode = "NOERROR";
  let answerCount = 0;
  try {
    const answers = recordType === "AAAA"
      ? await resolver.resolve6(domain)
      : await resolver.resolve4(domain);
    answerCount = answers.length;
  } catch (err) {
    if (err.code === "ENOTFOUND") {
      rcode = "NXDOMAIN";
    } else if (err.code === "ENODATA") {
      rcode = "NOERROR";
      answerCount = 0;
    } else {
      throw err;
    }
  }

  const outcome = classifyMissingRecord(rcode, answerCount, true);
  console.log(`Name ${domain} classified as ${outcome} (rcode=${rcode}, answers=${answerCount})`);

  if (outcome !== "missing_record_nxdomain") {
    console.log("Nothing to repair.");
    return;
  }

  console.log(`Missing ${recordType} record for ${domain}. ${dryRun ? "Would" : "Will"} create it pointing to ${target}.`);

  if (dryRun) return;

  const res = await fetch(`https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`, {
    method: "POST",
    headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
    body: JSON.stringify({ type: recordType, name: domain, content: target, ttl }),
  });
  if (!res.ok) throw new Error(`Cloudflare API returned ${res.status}`);
  console.log(`Created ${recordType} record for ${domain} -> ${target}`);
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => { console.error(err); process.exit(1); });
}

from missing_address_record import classify_missing_record


def test_missing_record_nxdomain():
    assert classify_missing_record("NXDOMAIN", 0, True) == "missing_record_nxdomain"


def test_nodata_wrong_type():
    assert classify_missing_record("NOERROR", 0, True) == "nodata_wrong_type"


def test_ok_when_answers_present():
    assert classify_missing_record("NOERROR", 1, True) == "ok"


def test_nxdomain_not_expected_is_unexpected():
    assert classify_missing_record("NXDOMAIN", 0, False) == "unexpected"

import { test } from "node:test";
import assert from "node:assert/strict";
import { classifyMissingRecord } from "./missing-address-record.js";

test("missing record nxdomain", () => {
  assert.equal(classifyMissingRecord("NXDOMAIN", 0, true), "missing_record_nxdomain");
});

test("nodata wrong type", () => {
  assert.equal(classifyMissingRecord("NOERROR", 0, true), "nodata_wrong_type");
});

test("ok when answers present", () => {
  assert.equal(classifyMissingRecord("NOERROR", 1, true), "ok");
});

test("nxdomain not expected is unexpected", () => {
  assert.equal(classifyMissingRecord("NXDOMAIN", 0, false), "unexpected");
});