Net Dns2 Laravel Package

Product Decisions This Supports

• Custom-domain / white-label tenant verification. TXT and CNAME ownership checks are the gate for "activate your domain" flows. This library lets us query authoritative nameservers directly and distinguish NXDOMAIN from SERVFAIL from timeout — which is the difference between "records not added yet" and "your DNS provider is broken," two very different support experiences.
• Email deliverability features. SPF/DKIM/DMARC validation via TXT, MX routing sanity checks, MTA-STS and TLS-RPT discovery — surfaceable as a pre-send validator, an onboarding checklist, or a paid deliverability audit.
• DNS security posture reporting. DNSSEC status, dangling CNAME detection (subdomain takeover risk), missing SPF, multiple/conflicting records. A natural premium add-on with low marginal cost.
• DNS propagation checker. Because we can target specific nameservers, we can ask each of a domain's authoritative servers for the same record and diff the answers — a feature native PHP resolution cannot express.
• Programmatic record management for self-hosted DNS products: RFC 2136 dynamic updates with optional TSIG, plus AXFR/IXFR zone transfers for import, inventory, and drift detection.
• Build vs buy: buy the protocol, build the product. We should not write a DNS wire-format parser, EDNS0 handling, or TSIG signing. Spend engineering on the verification state machine, caching, and UI instead.
• Roadmap input: capabilities like targeted nameserver queries and raw response codes unlock features that competitors typically resell as a third-party service — worth pricing into the roadmap rather than treating as plumbing.

When to Consider This Package

Consider it when:

• You must query a specific nameserver — authoritative checks, propagation monitoring, split-horizon or internal DNS — rather than whatever the system resolver returns.
• You need record-level detail or response codes that dns_get_record() doesn't reliably surface, or raw parsed packet access for diagnostics.
• You need tunable per-query timeouts, retry counts, and TCP fallback — essential inside queue workers fanning out across many tenants.
• You need DNSSEC validation signals, TSIG authentication, RFC 2136 updates, or AXFR/IXFR. These have effectively no native PHP equivalent.
• You're constrained to pure PHP: no compiled extensions, no shelling out to dig, and no desire to hit a paid DNS API on every lookup.

Look elsewhere when:

• You only need hostname→IP or a single TXT check. dns_get_record() is dependency-free and sufficient; a lighter wrapper (e.g. league/dns) may read better.
• You need to write records and your provider has an API (Cloudflare, Route 53, DigitalOcean). Provider SDKs beat generic RFC 2136 — simpler, documented, auditable, and already part of your blast radius.
• You need high query throughput. This is synchronous and blocking; an async sidecar or managed resolver service will win. Try queue fan-out first, then offload.
• You require vendor SLAs or commercial support. This is a small-maintainer package (142 stars, minimal dependent footprint in our scan). Budget for source reading, version pinning, and contract tests.

Adoption notes for a Laravel codebase: there is no service provider. Wrap it — one DnsResolver interface, one adapter implementation, container binding, per-environment resolver and timeout config, TTL-aware caching, and a fake resolver so CI never touches live DNS. Keep the surface narrow so it stays replaceable.

How to Pitch It (Stakeholders)

Executives. This is a free, MIT-licensed, pure-PHP DNS library that lets us verify customer domains, validate email-sending configuration, and detect DNS misconfigurations from inside the app — no third-party API contract, no per-lookup fees, no new infrastructure. It unblocks a known friction point in onboarding (custom domain activation) and enables differentiated tooling — propagation checks, security posture reports — that competitors typically resell as a service. Risk is contained by design: it is a library, not a platform, and it sits behind a single internal interface, so we can swap it for a provider API later without touching product code. The real cost is a thin wrapper plus tests, not licensing.

Engineering. Adopt it as a leaf dependency behind a DnsResolver interface. It buys us nameserver-targeted queries, real response codes as first-class data, per-query timeouts, EDNS0 and TCP fallback, DNSSEC inspection, TSIG, RFC 2136 updates, and AXFR — none of which native PHP exposes cleanly. It is blocking, so it belongs in queued jobs, never request paths, and answers need TTL-aware caching. Caveats: PEAR-style packaging and a small maintainer base mean we pin the version, keep the wrapper narrow, and lock behavior with recorded-response tests. If requirements ever shrink to plain hostname resolution, we delete it rather than grow it.