From 31188e019b3b3beb1a61db9f5cb2b40a7f14fffb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fredrik=20Sj=C3=B6beck?= <fredrik@rukkor.com>
Date: Fri, 1 May 2026 13:28:40 +0200
Subject: [PATCH] Import dropdown: pull a zone live from a public resolver
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Topbar's "Import…" button is now a dropdown that offers the
existing file-pick path plus three "From public DNS" entries —
one per configured DoH resolver (Cloudflare, Google, DNS.SB).

Picking a resolver opens an inline form for the domain. On submit
we fan out DoH queries for the apex RR types (SOA, NS, A, AAAA,
MX, TXT, CAA) plus a small set of well-known subdomain probes
(www, _dmarc, mail, autodiscover) and assemble a Zone from the
answers. SOA TTL becomes the zone $TTL; per-record TTLs come
straight from the resolver's response.

Per-type errors are collected and surfaced through the existing
parseErrors panel so a partial import is still usable. The import
button shows "Resolving…" and disables while a fan-out is in
flight.

New module \`src/dns/import.ts\` is the pure logic; \`useZoneFile\`
gains \`importFromDns(resolverId, domain)\` and an \`isResolving\`
flag. New component \`ImportMenu\` owns the dropdown + the inline
domain form and replaces the inline file-input button in Topbar.
9 new tests cover the apex fan-out, MX/TXT/SOA shape, domain
normalization, unknown resolver, empty domain, and network failure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 src/App.tsx                   |  13 ++-
 src/components/ImportMenu.tsx | 128 ++++++++++++++++++++++++++++
 src/components/Topbar.tsx     |  23 ++---
 src/dns/import.ts             | 152 ++++++++++++++++++++++++++++++++++
 src/hooks/useZoneFile.ts      |  29 ++++++-
 src/styles.css                |  95 +++++++++++++++++++++
 tests/dns-import.test.ts      | 131 +++++++++++++++++++++++++++++
 7 files changed, 555 insertions(+), 16 deletions(-)
 create mode 100644 src/components/ImportMenu.tsx
 create mode 100644 src/dns/import.ts
 create mode 100644 tests/dns-import.test.ts

diff --git a/src/App.tsx b/src/App.tsx
index 5c7e8f0..ed1d514 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -29,7 +29,7 @@ export function App() {
   const [zone, setZone] = useState<Zone>(emptyZone);
   const [typeFilter, setTypeFilter] = useState<TypeFilter>("ALL");
   const [selectedPath, setSelectedPath] = useState<string[]>([]);
-  const { parseErrors, importedName, importFile, exportZone, reset } = useZoneFile();
+  const { parseErrors, importedName, isResolving, importFile, importFromDns, exportZone, reset } = useZoneFile();
   const dns = useDnsCheck();
 
   const issues = useMemo(() => validateZone(zone), [zone]);
@@ -72,6 +72,15 @@ export function App() {
     }
   };
 
+  const handleImportFromDns = async (resolverId: string, domain: string) => {
+    dns.reset();
+    const next = await importFromDns(resolverId, domain);
+    if (next) {
+      setZone(next);
+      setSelectedPath([]);
+    }
+  };
+
   const handleNew = () => {
     setZone(emptyZone());
     reset();
@@ -127,7 +136,9 @@ export function App() {
       <Topbar
         canExport={errorCount === 0}
         isChecking={dns.isChecking}
+        isResolving={isResolving}
         onImport={handleImport}
+        onImportFromDns={handleImportFromDns}
         onExport={() => exportZone(zone)}
         onNew={handleNew}
         onAddRecord={handleAddRecord}
diff --git a/src/components/ImportMenu.tsx b/src/components/ImportMenu.tsx
new file mode 100644
index 0000000..719a675
--- /dev/null
+++ b/src/components/ImportMenu.tsx
@@ -0,0 +1,128 @@
+import { useEffect, useRef, useState, type FormEvent } from "react";
+import { DEFAULT_RESOLVERS } from "../dns/resolvers";
+
+interface ImportMenuProps {
+  onImportFile: (file: File) => void;
+  onImportFromDns: (resolverId: string, domain: string) => void;
+  isResolving: boolean;
+}
+
+export function ImportMenu({ onImportFile, onImportFromDns, isResolving }: ImportMenuProps) {
+  const [open, setOpen] = useState(false);
+  const [resolverId, setResolverId] = useState<string | null>(null);
+  const [domain, setDomain] = useState("");
+  const fileInput = useRef<HTMLInputElement>(null);
+  const containerRef = useRef<HTMLDivElement>(null);
+
+  useEffect(() => {
+    if (!open && resolverId === null) return;
+    const handler = (e: MouseEvent) => {
+      if (containerRef.current && !containerRef.current.contains(e.target as Node)) {
+        setOpen(false);
+        setResolverId(null);
+      }
+    };
+    const keyHandler = (e: KeyboardEvent) => {
+      if (e.key === "Escape") {
+        setOpen(false);
+        setResolverId(null);
+      }
+    };
+    window.addEventListener("mousedown", handler);
+    window.addEventListener("keydown", keyHandler);
+    return () => {
+      window.removeEventListener("mousedown", handler);
+      window.removeEventListener("keydown", keyHandler);
+    };
+  }, [open, resolverId]);
+
+  const handlePickResolver = (id: string) => {
+    setOpen(false);
+    setResolverId(id);
+    setDomain("");
+  };
+
+  const handleSubmit = (e: FormEvent) => {
+    e.preventDefault();
+    const trimmed = domain.trim();
+    if (!trimmed || !resolverId) return;
+    onImportFromDns(resolverId, trimmed);
+    setResolverId(null);
+    setDomain("");
+  };
+
+  const activeResolver = resolverId
+    ? DEFAULT_RESOLVERS.find((r) => r.id === resolverId)
+    : null;
+
+  return (
+    <div className="import-menu" ref={containerRef}>
+      <button
+        onClick={() => setOpen((o) => !o)}
+        aria-haspopup="menu"
+        aria-expanded={open}
+        disabled={isResolving}
+      >
+        {isResolving ? "Resolving…" : "Import…"}
+      </button>
+      <input
+        ref={fileInput}
+        type="file"
+        accept=".zone,.db,.txt,text/plain"
+        className="hidden"
+        onChange={(e) => {
+          const f = e.target.files?.[0];
+          if (f) onImportFile(f);
+          e.target.value = "";
+          setOpen(false);
+        }}
+      />
+
+      {open && (
+        <div className="import-dropdown" role="menu">
+          <button type="button" role="menuitem" onClick={() => fileInput.current?.click()}>
+            From file…
+          </button>
+          <div className="dropdown-divider" />
+          <div className="dropdown-label">From public DNS</div>
+          {DEFAULT_RESOLVERS.map((r) => (
+            <button
+              key={r.id}
+              type="button"
+              role="menuitem"
+              onClick={() => handlePickResolver(r.id)}
+            >
+              <span>{r.name}</span>
+              <span className="region">{r.region}</span>
+            </button>
+          ))}
+        </div>
+      )}
+
+      {activeResolver && (
+        <form className="dns-import-form" onSubmit={handleSubmit}>
+          <span className="hint">Resolve from {activeResolver.name}:</span>
+          <input
+            autoFocus
+            type="text"
+            value={domain}
+            onChange={(e) => setDomain(e.target.value)}
+            placeholder="example.com"
+          />
+          <button type="submit" className="primary" disabled={!domain.trim()}>
+            Resolve
+          </button>
+          <button
+            type="button"
+            onClick={() => {
+              setResolverId(null);
+              setDomain("");
+            }}
+          >
+            Cancel
+          </button>
+        </form>
+      )}
+    </div>
+  );
+}
diff --git a/src/components/Topbar.tsx b/src/components/Topbar.tsx
index c56b973..0d80527 100644
--- a/src/components/Topbar.tsx
+++ b/src/components/Topbar.tsx
@@ -1,11 +1,13 @@
-import { useRef } from "react";
 import { GitHubLink } from "./GitHubLink";
+import { ImportMenu } from "./ImportMenu";
 import { Logo } from "./Logo";
 
 interface TopbarProps {
   canExport: boolean;
   isChecking: boolean;
+  isResolving: boolean;
   onImport: (file: File) => void;
+  onImportFromDns: (resolverId: string, domain: string) => void;
   onExport: () => void;
   onNew: () => void;
   onAddRecord: () => void;
@@ -16,15 +18,15 @@ interface TopbarProps {
 export function Topbar({
   canExport,
   isChecking,
+  isResolving,
   onImport,
+  onImportFromDns,
   onExport,
   onNew,
   onAddRecord,
   onCheck,
   onCancelCheck,
 }: TopbarProps) {
-  const fileInput = useRef<HTMLInputElement>(null);
-
   return (
     <header className="topbar">
       <div className="brand">
@@ -32,17 +34,10 @@ export function Topbar({
         <h1>Codabind</h1>
       </div>
       <div className="actions">
-        <button onClick={() => fileInput.current?.click()}>Import…</button>
-        <input
-          ref={fileInput}
-          type="file"
-          accept=".zone,.db,.txt,text/plain"
-          className="hidden"
-          onChange={(e) => {
-            const f = e.target.files?.[0];
-            if (f) onImport(f);
-            e.target.value = "";
-          }}
+        <ImportMenu
+          onImportFile={onImport}
+          onImportFromDns={onImportFromDns}
+          isResolving={isResolving}
         />
         <button
           onClick={onExport}
diff --git a/src/dns/import.ts b/src/dns/import.ts
new file mode 100644
index 0000000..69d4e0d
--- /dev/null
+++ b/src/dns/import.ts
@@ -0,0 +1,152 @@
+import type { RecordType, Zone, ZoneRecord } from "../zone/types";
+import { query } from "./query";
+import { DEFAULT_RESOLVERS } from "./resolvers";
+import type { DohAnswer } from "./types";
+
+const APEX_TYPES: RecordType[] = ["SOA", "NS", "A", "AAAA", "MX", "TXT", "CAA"];
+const SUBDOMAIN_PROBES: Array<{ name: string; types: RecordType[] }> = [
+  { name: "www", types: ["A", "AAAA", "CNAME"] },
+  { name: "_dmarc", types: ["TXT"] },
+  { name: "mail", types: ["A", "AAAA", "CNAME"] },
+  { name: "autodiscover", types: ["CNAME"] },
+];
+
+export interface DnsImportResult {
+  zone: Zone;
+  errors: string[];
+}
+
+export async function importFromDns(
+  resolverId: string,
+  rawDomain: string,
+  signal?: AbortSignal,
+): Promise<DnsImportResult> {
+  const resolver = DEFAULT_RESOLVERS.find((r) => r.id === resolverId);
+  if (!resolver) {
+    return { zone: emptyZoneFor(rawDomain), errors: [`Unknown resolver: ${resolverId}`] };
+  }
+
+  const cleanDomain = rawDomain.trim().replace(/^\.+|\.+$/g, "").toLowerCase();
+  if (!cleanDomain) {
+    return { zone: emptyZoneFor(""), errors: ["Domain is required"] };
+  }
+
+  const origin = `${cleanDomain}.`;
+  const errors: string[] = [];
+  const records: ZoneRecord[] = [];
+
+  // Apex records — single name "@", multiple RR types
+  await Promise.all(
+    APEX_TYPES.map(async (type) => {
+      const resp = await query(resolver, origin, type, signal);
+      if (resp.status === "error") {
+        errors.push(`${type} @ ${cleanDomain}: ${resp.errorMessage ?? "fetch failed"}`);
+        return;
+      }
+      for (const ans of resp.answers) {
+        const rec = answerToRecord("@", ans, type);
+        if (rec) records.push(rec);
+      }
+    }),
+  );
+
+  // Best-effort subdomain probes
+  await Promise.all(
+    SUBDOMAIN_PROBES.flatMap(({ name, types }) =>
+      types.map(async (type) => {
+        const fqdn = `${name}.${origin}`;
+        const resp = await query(resolver, fqdn, type, signal);
+        if (resp.status !== "ok") return;
+        for (const ans of resp.answers) {
+          const rec = answerToRecord(name, ans, type);
+          if (rec) records.push(rec);
+        }
+      }),
+    ),
+  );
+
+  const ttl = pickZoneTtl(records);
+  return { zone: { origin, ttl, records }, errors };
+}
+
+function answerToRecord(name: string, ans: DohAnswer, type: RecordType): ZoneRecord | null {
+  const id = crypto.randomUUID();
+  const ttl = String(ans.TTL);
+  const cls = "IN";
+  const parts = ans.data.split(/\s+/);
+
+  switch (type) {
+    case "A":
+    case "AAAA":
+      return { id, name, ttl, class: cls, record: { type, data: { address: ans.data } } };
+    case "NS":
+    case "CNAME":
+    case "PTR":
+      return { id, name, ttl, class: cls, record: { type, data: { target: ans.data } } };
+    case "MX":
+      return {
+        id, name, ttl, class: cls,
+        record: { type: "MX", data: { priority: parts[0] ?? "10", target: parts.slice(1).join(" ") } },
+      };
+    case "TXT":
+      return { id, name, ttl, class: cls, record: { type: "TXT", data: { text: stripOuterQuotes(ans.data) } } };
+    case "SOA":
+      return {
+        id, name, ttl, class: cls,
+        record: {
+          type: "SOA",
+          data: {
+            mname: parts[0] ?? "",
+            rname: parts[1] ?? "",
+            serial: parts[2] ?? "",
+            refresh: parts[3] ?? "",
+            retry: parts[4] ?? "",
+            expire: parts[5] ?? "",
+            minimum: parts[6] ?? "",
+          },
+        },
+      };
+    case "SRV":
+      return {
+        id, name, ttl, class: cls,
+        record: {
+          type: "SRV",
+          data: {
+            priority: parts[0] ?? "",
+            weight: parts[1] ?? "",
+            port: parts[2] ?? "",
+            target: parts.slice(3).join(" "),
+          },
+        },
+      };
+    case "CAA":
+      return {
+        id, name, ttl, class: cls,
+        record: {
+          type: "CAA",
+          data: {
+            flags: parts[0] ?? "0",
+            tag: parts[1] ?? "issue",
+            value: stripOuterQuotes(parts.slice(2).join(" ")),
+          },
+        },
+      };
+  }
+}
+
+function pickZoneTtl(records: ZoneRecord[]): string {
+  const soa = records.find((r) => r.record.type === "SOA");
+  return soa?.ttl || "3600";
+}
+
+function emptyZoneFor(domain: string): Zone {
+  const cleaned = domain.trim().replace(/^\.+|\.+$/g, "");
+  return { origin: cleaned ? `${cleaned}.` : "", ttl: "3600", records: [] };
+}
+
+function stripOuterQuotes(s: string): string {
+  if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) {
+    return s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, "\\");
+  }
+  return s;
+}
diff --git a/src/hooks/useZoneFile.ts b/src/hooks/useZoneFile.ts
index 0b69cab..be50d3b 100644
--- a/src/hooks/useZoneFile.ts
+++ b/src/hooks/useZoneFile.ts
@@ -1,4 +1,6 @@
 import { useCallback, useState } from "react";
+import { importFromDns as fetchFromDns } from "../dns/import";
+import { DEFAULT_RESOLVERS } from "../dns/resolvers";
 import { MAX_FILE_BYTES } from "../zone/constants";
 import { parseZone } from "../zone/parser";
 import { serializeZone } from "../zone/serializer";
@@ -7,7 +9,9 @@ import type { Zone } from "../zone/types";
 interface UseZoneFile {
   parseErrors: string[];
   importedName: string;
+  isResolving: boolean;
   importFile: (file: File) => Promise<Zone | null>;
+  importFromDns: (resolverId: string, domain: string) => Promise<Zone | null>;
   exportZone: (zone: Zone) => void;
   reset: () => void;
 }
@@ -15,6 +19,7 @@ interface UseZoneFile {
 export function useZoneFile(): UseZoneFile {
   const [parseErrors, setParseErrors] = useState<string[]>([]);
   const [importedName, setImportedName] = useState("");
+  const [isResolving, setIsResolving] = useState(false);
 
   const importFile = useCallback(async (file: File): Promise<Zone | null> => {
     if (file.size > MAX_FILE_BYTES) {
@@ -31,6 +36,28 @@ export function useZoneFile(): UseZoneFile {
     return result.zone;
   }, []);
 
+  const importFromDns = useCallback(
+    async (resolverId: string, domain: string): Promise<Zone | null> => {
+      setIsResolving(true);
+      try {
+        const result = await fetchFromDns(resolverId, domain);
+        const resolver = DEFAULT_RESOLVERS.find((r) => r.id === resolverId);
+        const label = resolver?.name ?? resolverId;
+        const cleaned = domain.trim().replace(/\.$/, "");
+        if (result.zone.records.length === 0 && result.errors.length === 0) {
+          setParseErrors([`No records returned from ${label} for ${cleaned}.`]);
+        } else {
+          setParseErrors(result.errors);
+        }
+        setImportedName(`${cleaned} (via ${label})`);
+        return result.zone;
+      } finally {
+        setIsResolving(false);
+      }
+    },
+    [],
+  );
+
   const exportZone = useCallback((zone: Zone) => {
     const text = serializeZone(zone);
     const blob = new Blob([text], { type: "text/plain" });
@@ -50,5 +77,5 @@ export function useZoneFile(): UseZoneFile {
     setImportedName("");
   }, []);
 
-  return { parseErrors, importedName, importFile, exportZone, reset };
+  return { parseErrors, importedName, isResolving, importFile, importFromDns, exportZone, reset };
 }
diff --git a/src/styles.css b/src/styles.css
index c041956..fee416f 100644
--- a/src/styles.css
+++ b/src/styles.css
@@ -209,6 +209,101 @@ button.primary:hover:not(:disabled) {
   align-items: center;
 }
 
+.import-menu {
+  position: relative;
+  display: inline-flex;
+}
+
+.import-dropdown {
+  position: absolute;
+  top: calc(100% + 4px);
+  left: 0;
+  z-index: 50;
+  min-width: 220px;
+  background: var(--panel);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 4px;
+  display: flex;
+  flex-direction: column;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.4);
+}
+.import-dropdown button[role="menuitem"] {
+  background: transparent;
+  border: none;
+  border-radius: 4px;
+  padding: 8px 10px;
+  text-align: left;
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 8px;
+  font-size: 13px;
+  color: var(--text);
+  cursor: pointer;
+}
+.import-dropdown button[role="menuitem"]:hover {
+  background: var(--panel-2);
+}
+.import-dropdown .region {
+  color: var(--muted);
+  font-size: 11px;
+  font-family: var(--mono);
+}
+.dropdown-divider {
+  height: 1px;
+  background: var(--border);
+  margin: 4px 0;
+}
+.dropdown-label {
+  padding: 6px 10px 4px;
+  font-size: 10px;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--muted);
+  font-weight: 600;
+}
+
+.dns-import-form {
+  position: absolute;
+  top: calc(100% + 4px);
+  left: 0;
+  z-index: 50;
+  background: var(--panel);
+  border: 1px solid var(--accent);
+  border-radius: 6px;
+  padding: 8px;
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  box-shadow: 0 8px 24px rgba(0, 0, 0, 0.4);
+}
+.dns-import-form .hint {
+  color: var(--muted);
+  font-size: 11px;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  white-space: nowrap;
+}
+.dns-import-form input {
+  background: var(--bg);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  color: var(--text);
+  padding: 6px 8px;
+  font-family: var(--mono);
+  font-size: 13px;
+  min-width: 220px;
+}
+.dns-import-form input:focus {
+  outline: none;
+  border-color: var(--accent);
+}
+.dns-import-form button {
+  padding: 6px 12px;
+  font-size: 12px;
+}
+
 .github-link {
   display: inline-flex;
   align-items: center;
diff --git a/tests/dns-import.test.ts b/tests/dns-import.test.ts
new file mode 100644
index 0000000..54c2ec3
--- /dev/null
+++ b/tests/dns-import.test.ts
@@ -0,0 +1,131 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { importFromDns } from "../src/dns/import";
+
+interface DohResponseShape {
+  Status: number;
+  Answer?: Array<{ name: string; type: number; TTL: number; data: string }>;
+}
+
+function dohJson(answers: DohResponseShape["Answer"]): DohResponseShape {
+  return { Status: 0, Answer: answers ?? [] };
+}
+
+function nx(): DohResponseShape {
+  return { Status: 3, Answer: [] };
+}
+
+function mockFetch(routes: Map<string, DohResponseShape>) {
+  return vi.fn(async (url: string | URL | Request) => {
+    const u = new URL(typeof url === "string" ? url : url.toString());
+    const name = u.searchParams.get("name") ?? "";
+    const type = u.searchParams.get("type") ?? "";
+    const key = `${name.toLowerCase()}|${type.toUpperCase()}`;
+    const body = routes.get(key) ?? nx();
+    return new Response(JSON.stringify(body), {
+      status: 200,
+      headers: { "content-type": "application/dns-json" },
+    });
+  });
+}
+
+const origFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = origFetch;
+  vi.restoreAllMocks();
+});
+
+describe("importFromDns — apex records", () => {
+  beforeEach(() => {
+    const routes = new Map<string, DohResponseShape>([
+      ["example.com.|SOA", dohJson([
+        { name: "example.com.", type: 6, TTL: 300, data: "ns1.example.com. admin.example.com. 2026010101 3600 1800 1209600 3600" },
+      ])],
+      ["example.com.|NS", dohJson([
+        { name: "example.com.", type: 2, TTL: 3600, data: "ns1.example.com." },
+        { name: "example.com.", type: 2, TTL: 3600, data: "ns2.example.com." },
+      ])],
+      ["example.com.|A", dohJson([
+        { name: "example.com.", type: 1, TTL: 300, data: "192.0.2.1" },
+      ])],
+      ["example.com.|MX", dohJson([
+        { name: "example.com.", type: 15, TTL: 3600, data: "10 mail.example.com." },
+      ])],
+      ["example.com.|TXT", dohJson([
+        { name: "example.com.", type: 16, TTL: 300, data: '"v=spf1 -all"' },
+      ])],
+    ]);
+    globalThis.fetch = mockFetch(routes) as unknown as typeof fetch;
+  });
+
+  it("returns a zone with origin and SOA-derived TTL", async () => {
+    const { zone, errors } = await importFromDns("cloudflare", "example.com");
+    expect(errors).toEqual([]);
+    expect(zone.origin).toBe("example.com.");
+    expect(zone.ttl).toBe("300");
+    expect(zone.records.length).toBeGreaterThan(0);
+  });
+
+  it("populates each apex RR type in the zone", async () => {
+    const { zone } = await importFromDns("cloudflare", "example.com");
+    const types = new Set(zone.records.map((r) => r.record.type));
+    expect(types.has("SOA")).toBe(true);
+    expect(types.has("NS")).toBe(true);
+    expect(types.has("A")).toBe(true);
+    expect(types.has("MX")).toBe(true);
+    expect(types.has("TXT")).toBe(true);
+  });
+
+  it("splits MX answer into priority and target", async () => {
+    const { zone } = await importFromDns("cloudflare", "example.com");
+    const mx = zone.records.find((r) => r.record.type === "MX");
+    if (mx?.record.type === "MX") {
+      expect(mx.record.data.priority).toBe("10");
+      expect(mx.record.data.target).toBe("mail.example.com.");
+    }
+  });
+
+  it("strips outer quotes from TXT data", async () => {
+    const { zone } = await importFromDns("cloudflare", "example.com");
+    const txt = zone.records.find((r) => r.record.type === "TXT");
+    if (txt?.record.type === "TXT") {
+      expect(txt.record.data.text).toBe("v=spf1 -all");
+    }
+  });
+
+  it("expands SOA into structured fields", async () => {
+    const { zone } = await importFromDns("cloudflare", "example.com");
+    const soa = zone.records.find((r) => r.record.type === "SOA");
+    if (soa?.record.type === "SOA") {
+      expect(soa.record.data.mname).toBe("ns1.example.com.");
+      expect(soa.record.data.rname).toBe("admin.example.com.");
+      expect(soa.record.data.serial).toBe("2026010101");
+    }
+  });
+
+  it("trims and normalizes the input domain", async () => {
+    const { zone } = await importFromDns("cloudflare", "  Example.com.  ");
+    expect(zone.origin).toBe("example.com.");
+  });
+});
+
+describe("importFromDns — error paths", () => {
+  it("rejects unknown resolver", async () => {
+    const { errors } = await importFromDns("nonexistent", "example.com");
+    expect(errors[0]).toMatch(/unknown resolver/i);
+  });
+
+  it("rejects empty domain", async () => {
+    const { errors } = await importFromDns("cloudflare", "  .  ");
+    expect(errors[0]).toMatch(/required/i);
+  });
+
+  it("collects per-type errors when fetch throws", async () => {
+    globalThis.fetch = vi.fn(async () => {
+      throw new Error("network down");
+    }) as unknown as typeof fetch;
+    const { errors, zone } = await importFromDns("cloudflare", "example.com");
+    expect(errors.length).toBeGreaterThan(0);
+    expect(zone.records).toHaveLength(0);
+  });
+});