From cc67f56d66e124b47f648372c6d31cbfe0beb443 Mon Sep 17 00:00:00 2001
From: Arthur Vuillard <arthur@hashbang.fr>
Date: Fri, 12 Jan 2024 16:05:04 +0100
Subject: [PATCH 1/2] use authoritative server to perform dns checks

---
 modoboa/admin/lib.py | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/modoboa/admin/lib.py b/modoboa/admin/lib.py
index b81f9dd6f..06c12fa98 100644
--- a/modoboa/admin/lib.py
+++ b/modoboa/admin/lib.py
@@ -190,11 +190,45 @@ def get_dns_resolver():
     return resolver
 
 
+def get_authoritative_server(domain, resolver=None):
+    if not resolver:
+       resolver = get_dns_resolver()
+
+    dnsname = dns.name.from_text(domain)
+
+    while True:
+        try:
+            answers = dns.resolver.resolve(dnsname, 'NS')
+            return str(answers[0].target)
+        except dns.resolver.NoAnswer as e:
+            dnsname = dnsname.parent()
+
+
+def get_authoritative_ip(domain, resolver=None):
+    dnsserver_name = get_authoritative_server(domain, resolver=resolver)
+    if not resolver:
+       resolver = get_dns_resolver()
+    answer = resolver.resolve(dnsserver_name)
+    if answer:
+        return answer[0].address
+    return None
+
+
+def get_authoritative_resolver(domain, resolver=None):
+    dnsserver_ip = get_authoritative_ip(domain, resolver=resolver)
+    if dnsserver_ip:
+        resolver = dns.resolver.Resolver()
+        resolver.nameservers = [dnsserver_ip]
+    else:
+        resolver = get_dns_resolver()
+    return resolver
+
+
 def get_dns_records(name, typ, resolver=None):
     """Retrieve DNS records for given name and type."""
     logger = logging.getLogger("modoboa.admin")
-    if not resolver:
-        resolver = get_dns_resolver()
+
+    resolver = get_authoritative_resolver(name, resolver=resolver)
     try:
         dns_answers = resolver.resolve(name, typ, search=True)
     except dns.resolver.NXDOMAIN as e:

From 813b63db7aed4ed933fa143fbcaf5e231b01b498 Mon Sep 17 00:00:00 2001
From: Arthur Vuillard <arthur@hashbang.fr>
Date: Tue, 16 Jul 2024 18:18:40 +0200
Subject: [PATCH 2/2] make the dns authoritative check code stronger

---
 modoboa/admin/lib.py | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/modoboa/admin/lib.py b/modoboa/admin/lib.py
index 06c12fa98..256ad23e0 100644
--- a/modoboa/admin/lib.py
+++ b/modoboa/admin/lib.py
@@ -199,9 +199,16 @@ def get_authoritative_server(domain, resolver=None):
     while True:
         try:
             answers = dns.resolver.resolve(dnsname, 'NS')
-            return str(answers[0].target)
+            if answers:
+                first_answer = answers[0]
+                if hasattr(first_answer, "target"):
+                    return str(first_answer.target)
+                if hasattr(first_answer, "address"):
+                    return str(first_answer.address)
         except dns.resolver.NoAnswer as e:
             dnsname = dnsname.parent()
+        else:
+            dnsname = dnsname.parent()
 
 
 def get_authoritative_ip(domain, resolver=None):