MX record has no A or AAAA record

dig +short MX example.com

# example answer:
# 10 mail.example.com.

dig +short A mail.example.com
dig +short AAAA mail.example.com

# a broken target returns nothing for either line

dig mail.example.com CNAME

# if this returns an answer, the MX target is a CNAME, which is not allowed

dig +short NS example.com
dig @ns1.example.com MX example.com
dig @ns1.example.com A mail.example.com
dig +trace mail.example.com A

mail.example.com  3600  IN  A     203.0.113.25
mail.example.com  3600  IN  AAAA  2001:db8::25

; Name: mail
; Value: 203.0.113.25 (your mail server's real IP)
; TTL: 3600 (or Auto)

; option A: remove the CNAME, add a direct A record instead
mail.example.com  3600  IN  A     203.0.113.25

; option B: point the MX record itself at the provider host
example.com        3600  IN  MX  10  mailhost.provider.net.

curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "Authorization: Bearer {CLOUDFLARE_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{"type":"A","name":"mail.example.com","content":"203.0.113.25","ttl":3600,"proxied":false}'

dig +short A mail.example.com
dig +short AAAA mail.example.com

dig +short MX example.com
dig +short A mail.example.com

nc -vz mail.example.com 25
openssl s_client -connect mail.example.com:25 -starttls smtp

# good result: a real routable IP for every target, and the SMTP
# port answers with a banner or completes the STARTTLS handshake

"""Detect an MX target with no A/AAAA record (a dangling MX) and repair it
via Cloudflare. Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("mx_target_missing_address_record")


def find_dangling_mx_targets(mx_targets: list[str], resolved_addresses: dict[str, list[str]]) -> list[str]:
    """mx_targets: list of MX target hostnames (e.g. ['mail.example.com']).
    resolved_addresses: mapping of hostname -> list of A/AAAA IPs already looked up (empty list if none/NXDOMAIN).
    Returns the subset of mx_targets that have no A or AAAA address (dangling MX), preserving order, deduplicated."""
    seen = set()
    dangling = []
    for host in mx_targets:
        if host in seen:
            continue
        seen.add(host)
        if not resolved_addresses.get(host):
            dangling.append(host)
    return dangling


def run():
    # Imported lazily so the pure function above can be tested with no
    # network libraries installed at all.
    import dns.resolver
    import dns.exception
    import requests

    domain = os.environ["DNS_DOMAIN"]
    fallback_ip = os.environ.get("RECORD_TARGET", "203.0.113.25")
    ttl = int(os.environ.get("RECORD_TTL", "3600"))
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"

    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]

    mx_answer = dns.resolver.resolve(domain, "MX")
    mx_targets = [str(r.exchange).rstrip(".") for r in mx_answer]
    log.info("Found %d MX target(s) for %s: %s", len(mx_targets), domain, mx_targets)

    resolved_addresses = {}
    for host in mx_targets:
        addresses = []
        for rtype in ("A", "AAAA"):
            try:
                answer = dns.resolver.resolve(host, rtype)
                addresses.extend(str(r) for r in answer)
            except (dns.resolver.NXDOMAIN, dns.resolver.NoAnswer):
                pass
        resolved_addresses[host] = addresses

    dangling = find_dangling_mx_targets(mx_targets, resolved_addresses)

    if not dangling:
        log.info("Every MX target for %s has an A or AAAA record. Nothing to repair.", domain)
        return

    for host in dangling:
        log.info("MX target %s has no A/AAAA record. %s create an A record pointing to %s.",
                  host, "Would" if dry_run else "Will", fallback_ip)

        if dry_run:
            continue

        resp = requests.post(
            f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
            headers={"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"},
            json={"type": "A", "name": host, "content": fallback_ip, "ttl": ttl, "proxied": False},
            timeout=30,
        )
        resp.raise_for_status()
        log.info("Created A record for %s -> %s (DNS only)", host, fallback_ip)


if __name__ == "__main__":
    run()

/**
 * Detect an MX target with no A/AAAA record (a dangling MX) and repair it
 * via Cloudflare. Safe to run on a schedule. Stays in dry run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

export function findDanglingMxTargets(mxTargets, resolvedAddresses) {
  // mxTargets: array of MX target hostnames (e.g. ["mail.example.com"]).
  // resolvedAddresses: object mapping hostname -> array of A/AAAA IPs already
  // looked up (empty array if none/NXDOMAIN).
  // Returns the subset of mxTargets with no A or AAAA address (dangling MX),
  // preserving order, deduplicated.
  const seen = new Set();
  const dangling = [];
  for (const host of mxTargets) {
    if (seen.has(host)) continue;
    seen.add(host);
    const addresses = resolvedAddresses[host] || [];
    if (addresses.length === 0) dangling.push(host);
  }
  return dangling;
}

export async function run() {
  // Imported lazily so the pure function above can be tested with no
  // network modules touched at all.
  const dns = await import("node:dns");
  const resolvePromises = dns.promises;

  const domain = process.env.DNS_DOMAIN;
  const fallbackIp = process.env.RECORD_TARGET || "203.0.113.25";
  const ttl = Number(process.env.RECORD_TTL || 3600);
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";

  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;

  const mxRecords = await resolvePromises.resolveMx(domain);
  const mxTargets = mxRecords.map((r) => r.exchange.replace(/\.$/, ""));
  console.log(`Found ${mxTargets.length} MX target(s) for ${domain}: ${mxTargets.join(", ")}`);

  const resolvedAddresses = {};
  for (const host of mxTargets) {
    const addresses = [];
    for (const resolveFn of [resolvePromises.resolve4, resolvePromises.resolve6]) {
      try {
        const answers = await resolveFn.call(resolvePromises, host);
        addresses.push(...answers);
      } catch (err) {
        if (err.code !== "ENOTFOUND" && err.code !== "ENODATA") throw err;
      }
    }
    resolvedAddresses[host] = addresses;
  }

  const dangling = findDanglingMxTargets(mxTargets, resolvedAddresses);

  if (dangling.length === 0) {
    console.log(`Every MX target for ${domain} has an A or AAAA record. Nothing to repair.`);
    return;
  }

  for (const host of dangling) {
    console.log(`MX target ${host} has no A/AAAA record. ${dryRun ? "Would" : "Will"} create an A record pointing to ${fallbackIp}.`);

    if (dryRun) continue;

    const res = await fetch(`https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`, {
      method: "POST",
      headers: { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" },
      body: JSON.stringify({ type: "A", name: host, content: fallbackIp, ttl, proxied: false }),
    });
    if (!res.ok) throw new Error(`Cloudflare API returned ${res.status}`);
    console.log(`Created A record for ${host} -> ${fallbackIp} (DNS only)`);
  }
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => { console.error(err); process.exit(1); });
}

from mx_target_missing_address_record import find_dangling_mx_targets


def test_no_dangling_when_every_target_has_an_address():
    targets = ["mail.example.com"]
    resolved = {"mail.example.com": ["203.0.113.25"]}
    assert find_dangling_mx_targets(targets, resolved) == []


def test_flags_target_with_empty_address_list():
    targets = ["mail.example.com"]
    resolved = {"mail.example.com": []}
    assert find_dangling_mx_targets(targets, resolved) == ["mail.example.com"]


def test_flags_target_missing_from_the_mapping():
    targets = ["mail.example.com"]
    resolved = {}
    assert find_dangling_mx_targets(targets, resolved) == ["mail.example.com"]


def test_preserves_order_and_dedupes():
    targets = ["b.example.com", "a.example.com", "b.example.com"]
    resolved = {"a.example.com": [], "b.example.com": []}
    assert find_dangling_mx_targets(targets, resolved) == ["b.example.com", "a.example.com"]


def test_mixed_targets_only_flags_the_broken_one():
    targets = ["good.example.com", "bad.example.com"]
    resolved = {"good.example.com": ["203.0.113.1"], "bad.example.com": []}
    assert find_dangling_mx_targets(targets, resolved) == ["bad.example.com"]

import { test } from "node:test";
import assert from "node:assert/strict";
import { findDanglingMxTargets } from "./mx-target-missing-address-record.js";

test("no dangling when every target has an address", () => {
  const targets = ["mail.example.com"];
  const resolved = { "mail.example.com": ["203.0.113.25"] };
  assert.deepEqual(findDanglingMxTargets(targets, resolved), []);
});

test("flags target with empty address list", () => {
  const targets = ["mail.example.com"];
  const resolved = { "mail.example.com": [] };
  assert.deepEqual(findDanglingMxTargets(targets, resolved), ["mail.example.com"]);
});

test("flags target missing from the mapping", () => {
  const targets = ["mail.example.com"];
  const resolved = {};
  assert.deepEqual(findDanglingMxTargets(targets, resolved), ["mail.example.com"]);
});

test("preserves order and dedupes", () => {
  const targets = ["b.example.com", "a.example.com", "b.example.com"];
  const resolved = { "a.example.com": [], "b.example.com": [] };
  assert.deepEqual(findDanglingMxTargets(targets, resolved), ["b.example.com", "a.example.com"]);
});

test("mixed targets only flags the broken one", () => {
  const targets = ["good.example.com", "bad.example.com"];
  const resolved = { "good.example.com": ["203.0.113.1"], "bad.example.com": [] };
  assert.deepEqual(findDanglingMxTargets(targets, resolved), ["bad.example.com"]);
});