Netdns2 Laravel Package

Product Decisions This Supports

• Custom-domain onboarding as a feature, not a manual step. A pure-PHP resolver lets us verify customer-owned domains (CNAME/A/TXT ownership records) inside the app request lifecycle—no shelling out to dig, no external verification SaaS, no per-check fees. This directly gates activation funnels for multi-tenant SaaS and white-label products.
• Email deliverability tooling. Inspecting SPF, DKIM, DMARC, MX, and _domainkey TXT records programmatically opens up a "why is my mail going to spam?" diagnostic feature, pre-send domain health checks, and onboarding warnings—high-value, low-engineering-cost surfaces.
• Automated TLS / ACME DNS-01 issuance. RFC 2136 DNS UPDATE support means we can write _acme-challenge TXT records directly to authoritative servers (BIND, Knot, Windows DNS, PowerDNS) for wildcard certs—removing a paid ACME-DNS vendor or a fragile manual DNS step from our infra roadmap.
• Dynamic DNS and failover. Programmatic record updates with TSIG authentication enable internal features like blue/green cutovers, region failover, or a "point this hostname at our edge" product—without building a DNS control plane from scratch.
• Infrastructure health and audit views. Bulk SOA/NS/AAAA/CAA/DS queries support an internal "DNS posture" dashboard: expiring records, missing CAA, mismatched nameservers, DNSSEC readiness. Useful for internal platform ops and as a premium customer-facing audit.
• Build-vs-buy input. This is the "build" option for DNS reads/writes. It competes against (a) provider SDKs (Cloudflare, Route 53, DigitalOcean) for managed-zone work, and (b) managed verification vendors (e.g., DNS-verification APIs) for onboarding. Net_DNS2 wins where the target zone is not behind a single cloud provider—i.e., customer-owned, self-hosted, or mixed-DNS estates—which is exactly where provider SDKs fall short.
• Roadmap sequencing. Adopt this as the substrate for a "DNS utilities" capability layer; defer a full managed-DNS product until we see demand for record CRUD UI, propagation monitoring, or multi-provider orchestration.

When to Consider This Package

Adopt when:

• We are on PHP/Laravel and want zero new runtime dependencies (no ext-dns requirement, no dig/nslookup binary dependency—important in containerized or restricted-host environments).
• We need record types beyond gethostbyname's A/AAAA: MX, TXT, SRV, CAA, SOA, NS, PTR, DS, DNSKEY, NAPTR.
• We need RFC 2136 dynamic updates with TSIG authentication against authoritative servers—this is the differentiating capability and is rare in PHP packages.
• Zones are customer-owned, self-hosted, or spread across providers, so no single cloud SDK covers them.
• We want a swappable internal DnsResolver interface where Net_DNS2 is one adapter and Cloudflare/Route 53 SDKs are others.

Look elsewhere when:

• The zone lives in one managed provider. Use that provider's API/SDK—it gives auth, retries, rate limiting, and change auditing for free.
• Throughput or concurrency matters. This is a synchronous, blocking library; high-volume lookups want a caching resolver (Unbound/dnsmasq) or an async/ReactPHP-based approach.
• We only need simple A/AAAA lookups—gethostbyname or Laravel's HTTP/DNS helpers are sufficient.
• We need full DNSSEC chain validation, not just record retrieval. Net_DNS2 can fetch DNSSEC records, but end-to-end validation belongs to a validating resolver.
• Operational maturity is the priority. 142 GitHub stars signals a small community; we must own caching, retry/backoff, timeouts, metrics, and test fixtures ourselves. If we can't absorb that, a managed API is cheaper in total cost.

How to Pitch It (Stakeholders)

To executives: This is a small, MIT-licensed, actively maintained PHP library that lets us query and update DNS records from inside our application. It removes a dependency on paid domain-verification and DNS-management vendors, and it's the enabler for three roadmap items we already want: self-serve custom domains, email-deliverability diagnostics, and automated TLS certificate issuance. Cost is effectively zero, license risk is zero, and the integration surface is small and replaceable—we'll wrap it behind our own interface so no product decision becomes irreversible.

To engineering: Net_DNS2 is the maintained successor to PEAR's Net_DNS, pure PHP, no ext-dns, no dig. It covers the full record-type set plus RFC 2136 dynamic updates with TSIG, which is what unlocks ACME DNS-01 and programmatic record management against BIND/Knot/Windows DNS. Two honest caveats: it's synchronous and has a modest community (~142 stars), so we own connection reuse, caching, timeouts, retries, and test doubles. Recommend a thin DnsResolver contract with a Net_DNS2 adapter now and provider-SDK adapters later; that keeps the blast radius small and preserves the option to buy if volume or compliance demands it.