validateDomainName in client.ts:73 uses /^[a-z0-9-]+$/i which rejects underscores in labels. This prevents querying any domain with underscores, including:
- DKIM:
selector1._domainkey.example.com - DMARC:
_dmarc.example.com - SRV:
_sip._tcp.example.com - TLSA:
_443._tcp.example.com
Per RFC 2181 §11, any binary label up to 63 octets is valid in DNS. The hostname restriction (no underscores) is an application-layer convention that doesn't apply to DNS names in general.
Fix: [a-z0-9-] → [a-z0-9_-] on line 73.
We're currently forced to bypass DnsClient entirely and use DnsEncoder directly to query these records, which means we lose EDNS0, truncation/TCP fallback, retries, and authority section parsing — all of which the client handles correctly.