Upgrade models to full NetboxModel to allow UI/API interaction:

modified:   netbox_dns_bridge/models.py
deleted:    netbox_dns_bridge/migrations/0003_catalogzone_and_per_zone_identifier.py
new file:   netbox_dns_bridge/migrations/0003_full_netbox_models.py

Adjust model access and function calls to match new models:
modified:   netbox_dns_bridge/signals/netbox_dns_zones.py
modified:   netbox_dns_bridge/management/commands/dns_transfer_endpoint/catalog_zone_manager.py
modified:   netbox_dns_bridge/management/commands/dns_transfer_endpoint/request_handler.py

Update UI elements and permission interactions:
modified:   netbox_dns_bridge/filtersets.py
modified:   netbox_dns_bridge/forms.py
modified:   netbox_dns_bridge/jobs/notify.py
modified:   netbox_dns_bridge/navigation.py
modified:   netbox_dns_bridge/tables.py
deleted:    netbox_dns_bridge/templates/netbox_dns_bridge/catalog_zone_members.html
new file:   netbox_dns_bridge/templates/netbox_dns_bridge/catalogzone.html
new file:   netbox_dns_bridge/templates/netbox_dns_bridge/catalogzonemember.html
deleted:    netbox_dns_bridge/templates/netbox_dns_bridge/notify_overview.html
new file:   netbox_dns_bridge/templates/netbox_dns_bridge/seentransferclient.html
modified:   netbox_dns_bridge/urls.py
modified:   netbox_dns_bridge/views.py

AI/LLM updated tests (Not verified):
modified:   netbox_dns_bridge/tests/conftest.py
modified:   netbox_dns_bridge/tests/test_catalog_zone_manager.py
modified:   netbox_dns_bridge/tests/test_models.py
modified:   netbox_dns_bridge/tests/test_notify.py
modified:   netbox_dns_bridge/tests/test_request_handler_integration.py
modified:   netbox_dns_bridge/tests/test_signals.py
modified:   netbox_dns_bridge/tests/test_smoke.py
modified:   netbox_dns_bridge/tests/test_views.py

CHANGELOG.md

@@ -1,3 +1,37 @@
+## Unreleased
+- Move `notify_handler` from `signals/` to `jobs/` and rename to `notify`.
+- Rename `SendClientDNSNotify` to `SendClientNotify`. It now sends a single NOTIFY
+  for the zone only; catalog zone entries (`catz`, `{view}.catz`) have been removed.
+- Catalog zone NOTIFY is now scheduled by `increment_soa_serial` via
+  `schedule_catalog_zone_notify`, which enqueues `SendClientNotify` for `catz` and
+  `{view}.catz` — no separate job class needed.
+- Extract a shared `_send_notify` helper used by both `SendClientNotify` and
+  `SendNSNotify` for message building and the send loop.
+- Move all NOTIFY scheduling gates (`notify_clients`, `notify_ns_all_zones`, custom
+  field) into the scheduling functions. The signal handler calls the scheduling
+  functions unconditionally; each function decides whether to enqueue based on its
+  own settings gate.
+- Replace the global `IntegerKeyValueSetting` model (single `catalog-zone-soa-serial`
+  value shared by all catalog zones) with a new `CatalogZone` model that has a 1:1
+  foreign key to `netbox_dns.models.View` and its own `soa_serial` field. Each view's
+  catalog zone now tracks and increments its SOA serial independently. Existing serials
+  are preserved during migration by copying the old global value into every view's new
+  `CatalogZone` row.
+- Change the `CatalogZoneMemberIdentifier.name` uniqueness from globally unique to
+  unique per catalog zone (`UniqueConstraint(name, catalog_zone)`). A `catalog_zone`
+  foreign key has been added to the identifier model to enforce this.
+- Remove the `dns-settings` management command, which was a generic get/set/list
+  interface over `IntegerKeyValueSetting` (now removed).
+- Defer the catalog zone SOA serial increment on zone deletion to `transaction.on_commit`, matching
+  the create/modify path. Previously the increment ran immediately at `post_delete` time, so a
+  rollback of the delete transaction would have left the catalog serial bumped anyway.
+- Add the option to send a NOTIFY directly to a zone's own nameservers when its SOA serial number
+  changes. Enable it per zone via a boolean custom field named by `notify_ns_custom_field_name`,
+  globally for all zones via `notify_ns_all_zones` (default `False`), or both. Nameserver addresses
+  are resolved from NetBox DNS A/AAAA records within the zone's view and the NOTIFY is signed with
+  the per-view TSIG key. A companion `notify_ns_port` setting (default 53) controls the destination
+  port.
+
 ## 1.0.7 - 2026-03-02
 README Change - Moving private keys to global scope since Bind 9.20 view scoped keys have become unreliable and sometimes wouldnt match.
 

MANIFEST.in

@@ -1 +1,2 @@
 recursive-include netbox_dns_bridge *.py
+recursive-include netbox_dns_bridge/templates *.html

README.md

@@ -18,7 +18,8 @@ changes (RFC 1996).
 <a href="https://pepy.tech/project/netbox-plugin-dns-bridge"><img src="https://static.pepy.tech/personalized-badge/netbox-plugin-dns-bridge?period=monthly&left_color=BLACK&right_color=BLUE&left_text=Downloads%2fMonth" alt="Downloads/Month"></a>
 <a href="https://pepy.tech/project/netbox-plugin-dns-bridge"><img src="https://static.pepy.tech/personalized-badge/netbox-plugin-dns-bridge?period=weekly&left_color=BLACK&right_color=BLUE&left_text=Downloads%2fWeek" alt="Downloads/Week"></a>
 
-## Plugin configuration
+
+# Plugin configuration
 While providing Zone transfers via AXFR, the Server also exposes specialized catalog zones that BIND
 and other RFC9432 compliant DNS Servers use to automatically discover newly created zones and remove
 deleted ones. The plugin supports views and basic DNS security via TSIG.
@@ -39,13 +40,15 @@ This process needs to be scheduled as a background service for the built-in DNS
 correctly. For Linux users with Systemd (Ubuntu, etc), Matt Kollross provides a startup unit and
 instructions [here](docs/install-systemd-service.md).
 
-### Service parameters
+
+## Service parameters
 Parameter | Description
 --------- | -------------------------------------------------------------------
 --port    | Port to listen on for requests (defaults to 5354)
 --address | IP of interface to bind to (defaults to 0.0.0.0)
 
-### Plugin settings
+
+## Plugin settings
 Plugin settings should be configured under `PLUGINS_CONFIG` in `netbox_dns_bridge`:
 ```
 PLUGINS_CONFIG = {
@@ -56,8 +59,8 @@ PLUGINS_CONFIG = {
 }
 ```
 
-#### TSIG Authentication
-Following sets the TSIG key that allows clients to query the transfer endpoint and also they key to
+### TSIG Authentication
+Following sets the TSIG key that allows clients to query the transfer endpoint and also the key to
 be used to sign NOTIFY messages to clients on zone changes. Each view should have its own unique
 key to allow the plugin to identify the view the client is trying to access. Re-using the key for
 multiple views yields unpredicted behavior.
@@ -71,7 +74,29 @@ multiple views yields unpredicted behavior.
 }
 ```
 
-#### NOTIFY
+### NOTIFY
+The plugin has 2 different NOTIFY mechanisms that may be turned on individually or together.
+
+1. [Client Notify](#client-notify)
+   Notify clients that are regularly contacting the transfer endpoint for zone updates.
+
+2. [NS Notify](#ns-notify)
+   Notify the zone's NS Servers when a zone changes.
+
+   - [Per Zone](#ns-notify-per-zone)
+     Notify NS servers for zones that have a specific custom field set to true.
+
+   - [For all Zones](#ns-notify-for-all-zones)
+     Notify NS servers for all zones.
+     Note: This makes the *Per Zone* mechanism redundant. There is no point in enabling both.
+
+#### Global NOTIFY Settings
+```
+'notify_over_tcp': True
+```
+Switch to using TCP instead of UDP. Defaults to False
+
+#### Client NOTIFY
 Clients may be notified of zone changes using the NOTIFY mechanism defined in RFC 1996.
 When enabled, the zone transfer endpoint keeps track of any client that successfully queried the
 endpoint. Once a zone has changed, NetBox informs each client about the zone changed so that the
@@ -81,7 +106,6 @@ Note that this feature uses NetBox's background job system to schedule the messa
 In order to work, you need at least one `rq-worker` service running in the background to handle
 the queued jobs.
 
-##### NOTIFY Settings
 ```
 'notify_clients': True
 ```
@@ -93,10 +117,62 @@ This enables the NOTIFY system. Defaults to False
 This sets how long a client is considred "alive" after it last queried the transfer endpoint. 
 Once the client has failed to check in for this amout of time, it is automatically removed from the
 list of clients to be notified on zone changes. Default is 24 hours.
+
 ```
-'notify_over_tcp': True
+'notify_client_port': 53
 ```
-Switch to using TCP instead of UDP. Defaults to False
+Destination port used to send NOTIFY messages to clients. Defaults to 53.
+
+
+
+#### NS NOTIFY
+In addition to notifying clients that queried the transfer endpoint, the plugin can send a NOTIFY
+directly to a zone's own nameservers whenever that zone's SOA serial number changes. This is useful
+when you want nameservers to pull updates immediately, independent of the `notify_clients` mechanism.
+Only a change of the SOA serial triggers this — other zone edits that leave the serial untouched do
+not.
+
+This can be enabled per zone, globally, or both. If neither of the settings below is configured, the
+feature is disabled entirely.
+
+
+##### NS NOTIFY per Zone
+This uses a True/False custom field attached to each Zone to enable/disable NOTIFY for each
+individually.
+
+Create a boolean custom field (e.g. `dns_bridge_notify_ns`) that applies
+to `netbox_dns > zone`, then point the plugin at it:
+```
+'notify_ns_custom_field_name': 'dns_bridge_notify_ns'
+```
+A NOTIFY is then sent for any zone whose custom field is set to `True`. This lets you toggle the
+behavior per zone straight from the NetBox UI, without changing the plugin config.
+
+
+##### NS NOTIFY for all Zones
+```
+'notify_ns_all_zones': True
+```
+When enabled, a NOTIFY is sent for every zone on serial change, regardless of the custom field.
+Defaults to `False`. The two options coexist: a NOTIFY is sent if the global switch is on **or** the
+zone's custom field is set.
+
+
+##### NS NOTIFY Settings
+
+The nameserver addresses are resolved from NetBox DNS itself by looking up active A/AAAA records
+(within the zone's view) matching each nameserver's hostname. The NOTIFY messages are signed with the
+same per-view TSIG key configured under `tsig_keys`, so the receiving nameservers must accept NOTIFY
+signed with that key (e.g. BIND's `allow-notify { key "..."; };`).
+
+```
+'notify_ns_port': 53
+```
+Destination port used for these NOTIFY messages. Defaults to 53.
+
+As with the client NOTIFY feature, this uses NetBox's background job system, so at least one
+`rq-worker` service must be running.
+
 
 ## Plugin compatibility
 This plugin extends the netbox-plugin-dns plugin. As such the versioning was changed to match the
@@ -104,6 +180,7 @@ one of netbox-plugin-dns more closely. To guarantee compatability, ensure that t
 version match between both plugins. For example, when using netbox-plugin-dns `v1.5.5` install
 netbox-plugin-dns-bridge `v1.5.x`.
 
+
 ## Installation guide
 This setup provisions a BIND9 server directly with DNS data from NetBox. BIND9 can optionally run on
 a separate server. If so, any reference to 127.0.0.1 in step 6 must be replaced with the IP address

conftest.py

@@ -0,0 +1,13 @@
+"""Root conftest: ensure Django is configured before any test conftest imports
+models. pytest-django normally handles this, but our tests-dir conftest imports
+plugin modules (which import netbox_dns models) at collection time, so we force
+``django.setup()`` here unconditionally and early.
+"""
+import os
+
+os.environ.setdefault("DJANGO_SETTINGS_MODULE", "netbox.settings")
+
+import django  # noqa: E402
+
+if not django.apps.apps.ready:
+    django.setup()

netbox_dns_bridge/__init__.py

@@ -1,11 +1,7 @@
 from netbox.plugins import PluginConfig
 from django.conf import settings
-from .logger import get_logger
-
-__version__ = "1.5.6"
-
-LOGGER = get_logger(__name__)
 
+__version__ = "1.5.8"
 
 class DNSBridgeConfig(PluginConfig):
     name = "netbox_dns_bridge"
@@ -17,10 +13,12 @@ class DNSBridgeConfig(PluginConfig):
     base_url = "dns-bridge"
 
     def ready(self):
+        super().ready()
         self.settings = settings.PLUGINS_CONFIG.get(self.name, None)
         if not self.settings:
             raise RuntimeError(
-                f"{self.name}: Plugin {self.verbose_name} failed to initialize due to missing settings. Terminating Netbox."
+                f"{self.name}: Plugin {self.verbose_name} failed to"
+                " initialize due to missing settings. Terminating Netbox."
             )
 
         from . import signals

netbox_dns_bridge/filtersets.py

@@ -0,0 +1,59 @@
+import django_filters
+from django.db.models import Q
+
+import netbox_dns.models
+from netbox.filtersets import NetBoxModelFilterSet
+
+from .models import CatalogZone, CatalogZoneMember, SeenTransferClient
+
+
+class CatalogZoneFilterSet(NetBoxModelFilterSet):
+    view = django_filters.ModelMultipleChoiceFilter(
+        field_name="view",
+        queryset=netbox_dns.models.View.objects.all(),
+    )
+
+    class Meta:
+        model = CatalogZone
+        fields = ("id", "view")
+
+    def search(self, queryset, name, value):
+        if not value.strip():
+            return queryset
+        return queryset.filter(Q(view__name__icontains=value))
+
+
+class CatalogZoneMemberFilterSet(NetBoxModelFilterSet):
+    catalog_zone = django_filters.ModelMultipleChoiceFilter(
+        field_name="catalog_zone",
+        queryset=CatalogZone.objects.all(),
+    )
+
+    class Meta:
+        model = CatalogZoneMember
+        fields = ("id", "catalog_zone", "zone")
+
+    def search(self, queryset, name, value):
+        if not value.strip():
+            return queryset
+        return queryset.filter(
+            Q(name__icontains=value) | Q(zone__name__icontains=value)
+        )
+
+
+class SeenTransferClientFilterSet(NetBoxModelFilterSet):
+    view = django_filters.ModelMultipleChoiceFilter(
+        field_name="view",
+        queryset=netbox_dns.models.View.objects.all(),
+    )
+
+    class Meta:
+        model = SeenTransferClient
+        fields = ("id", "view", "source_ip")
+
+    def search(self, queryset, name, value):
+        if not value.strip():
+            return queryset
+        return queryset.filter(
+            Q(source_ip__icontains=value) | Q(view__name__icontains=value)
+        )

netbox_dns_bridge/forms.py

@@ -0,0 +1,64 @@
+from django import forms
+from django.utils.translation import gettext_lazy as _
+
+import netbox_dns.models
+from netbox.forms import NetBoxModelFilterSetForm, NetBoxModelForm
+from utilities.forms.fields import DynamicModelMultipleChoiceField
+
+from .models import CatalogZone, CatalogZoneMember, SeenTransferClient
+
+
+class CatalogZoneForm(NetBoxModelForm):
+    soa_serial = forms.IntegerField(label=_("SOA Serial"))
+    soa_refresh = forms.IntegerField(label=_("Refresh"))
+    soa_retry = forms.IntegerField(label=_("Retry"))
+    soa_expire = forms.IntegerField(label=_("Expire"))
+    soa_minimum = forms.IntegerField(label=_("Minimum"))
+
+    view = forms.ModelChoiceField(
+        queryset=netbox_dns.models.View.objects.all(),
+        disabled=True,
+        required=False,
+        label=_("View"),
+    )
+
+    class Meta:
+        model = CatalogZone
+        fields = (
+            "view",
+            "soa_serial",
+            "soa_refresh",
+            "soa_retry",
+            "soa_expire",
+            "soa_minimum",
+        )
+
+
+class CatalogZoneFilterForm(NetBoxModelFilterSetForm):
+    model = CatalogZone
+
+    q = forms.CharField(required=False, label=_("Search"))
+    view = DynamicModelMultipleChoiceField(
+        queryset=netbox_dns.models.View.objects.all(),
+        required=False,
+    )
+
+
+class CatalogZoneMemberFilterForm(NetBoxModelFilterSetForm):
+    model = CatalogZoneMember
+
+    q = forms.CharField(required=False, label=_("Search"))
+    catalog_zone = forms.ModelMultipleChoiceField(
+        queryset=CatalogZone.objects.all(),
+        required=False,
+    )
+
+
+class SeenTransferClientFilterForm(NetBoxModelFilterSetForm):
+    model = SeenTransferClient
+
+    q = forms.CharField(required=False, label=_("Search"))
+    view = forms.ModelMultipleChoiceField(
+        queryset=netbox_dns.models.View.objects.all(),
+        required=False,
+    )

netbox_dns_bridge/jobs/notify.py

@@ -0,0 +1,318 @@
+import dns.message
+import dns.name
+import dns.opcode
+import dns.query
+import dns.rdatatype
+import dns.rdataclass
+import dns.rrset
+import dns.tsig
+from django.conf import settings
+from django.utils import timezone
+from django.db import close_old_connections, OperationalError
+from netbox.jobs import JobRunner
+from netbox_dns.models import View, Zone, Record
+from netbox_dns_bridge.utils import get_logger
+from netbox_dns_bridge.models import SeenTransferClient, CatalogZone
+
+LOGGER = get_logger(__name__)
+SETTINGS = settings.PLUGINS_CONFIG.get("netbox_dns_bridge", {})
+
+
+def _load_tsig_key(view_name: str) -> dns.tsig.Key:
+    tsig_keys = SETTINGS.get("tsig_keys", {})
+    if view_name not in tsig_keys:
+        raise RuntimeError(f"No TSIG key configured for view '{view_name}'")
+
+    key_data = tsig_keys[view_name]
+    raw_key_name = key_data.get("keyname")
+    secret = key_data.get("secret")
+    algorithm = key_data.get("algorithm")
+    if not algorithm:
+        raise RuntimeError(
+            f"Missing 'algorithm' in TSIG key configuration for view '{view_name}'"
+        )
+
+    if not raw_key_name or not secret:
+        raise RuntimeError(f"Incomplete TSIG key configuration for view '{view_name}'")
+
+    key_name = dns.name.from_text(raw_key_name, origin=None).canonicalize()
+    if not key_name.is_absolute():
+        key_name = key_name.concatenate(dns.name.root)
+
+    return dns.tsig.Key(name=key_name, secret=secret, algorithm=algorithm)
+
+
+def _send_notify(
+    zone_name,
+    soa_serial,
+    targets,
+    tsig_key,
+    view_name,
+    notify_over_tcp,
+    port,
+    log_prefix="NOTIFY",
+    soa_refresh=60,
+    soa_retry=10,
+    soa_expire=1209600,
+    soa_minimum=0,
+):
+    """Build a DNS NOTIFY message for *zone_name* and send it to every target IP."""
+    fqdn = dns.name.from_text(zone_name, dns.name.root).to_text()
+    msg = dns.message.make_query(fqdn, dns.rdatatype.SOA)
+    msg.flags |= dns.flags.AA
+    msg.set_opcode(dns.opcode.NOTIFY)
+
+    soa_rdata = dns.rdata.from_text(
+        dns.rdataclass.IN,
+        dns.rdatatype.SOA,
+        f"invalid. invalid. {soa_serial} {soa_refresh} {soa_retry} {soa_expire} {soa_minimum}",
+    )
+    msg.answer.append(dns.rrset.from_rdata(fqdn, 0, soa_rdata))
+    msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
+
+    for target in targets:
+        try:
+            if notify_over_tcp:
+                LOGGER.debug(f"Sending {log_prefix} over TCP")
+                dns.query.tcp(msg, target, port=port, timeout=2)
+            else:
+                LOGGER.debug(f"Sending {log_prefix} over UDP")
+                dns.query.udp(msg, target, port=port, timeout=2)
+
+            LOGGER.info(
+                f"{log_prefix} sent: {target} {view_name}/{fqdn} {soa_serial}"
+            )
+        except Exception as e:
+            LOGGER.error(
+                f"{log_prefix} failed: {target}:{port}"
+                f" {view_name}/{fqdn} {soa_serial}: {e}"
+            )
+
+
+class SendClientNotify(JobRunner):
+    class Meta:
+        name = "Send DNS NOTIFY"
+
+    def run(self, *args, **kwargs):
+        notify_over_tcp = SETTINGS.get("notify_over_tcp", False)
+        port = SETTINGS.get("notify_client_port", 53)
+        view_name = kwargs["view_name"]
+        zone_name = kwargs["zone_name"]
+        soa_serial = kwargs["soa_serial"]
+        soa_refresh = kwargs.get("soa_refresh", 60)
+        soa_retry = kwargs.get("soa_retry", 10)
+        soa_expire = kwargs.get("soa_expire", 1209600)
+        soa_minimum = kwargs.get("soa_minimum", 0)
+
+        try:
+            view = View.objects.get(name=view_name)
+            tsig_key = _load_tsig_key(view_name)
+            cutoff_hours = SETTINGS.get("notify_client_alive_threshold_hours", 24)
+            seen_cutoff = timezone.now() - timezone.timedelta(hours=cutoff_hours)
+
+            clients = list(
+                SeenTransferClient.objects.filter(
+                    view=view, last_seen__gte=seen_cutoff
+                ).values_list("source_ip", flat=True)
+            )
+
+            _send_notify(
+                zone_name, soa_serial, clients, tsig_key,
+                view_name, notify_over_tcp, port, log_prefix="NOTIFY",
+                soa_refresh=soa_refresh, soa_retry=soa_retry,
+                soa_expire=soa_expire, soa_minimum=soa_minimum,
+            )
+
+        except View.DoesNotExist as e:
+            LOGGER.error(f"Failed to get view for NOTIFY: {e}")
+
+        except OperationalError as e:
+            LOGGER.error(f"NOTIFY failed due to unexpected error: {e}")
+            close_old_connections()
+
+
+class SendNSNotify(JobRunner):
+    """Send a NOTIFY straight to a zone's own nameservers.
+
+    Unlike ``SendClientNotify`` (which notifies clients that previously queried
+    the transfer endpoint), this job resolves the addresses of the zone's
+    configured nameservers from NetBox DNS itself and notifies each of them so
+    they pick up the changed zone quickly.
+    """
+
+    class Meta:
+        name = "Send DNS NOTIFY to zone nameservers"
+
+    def run(self, *args, **kwargs):
+        notify_over_tcp = SETTINGS.get("notify_over_tcp", False)
+        port = SETTINGS.get("notify_ns_port", 53)
+        view_name = kwargs["view_name"]
+        zone_name = kwargs["zone_name"]
+        soa_serial = kwargs["soa_serial"]
+
+        try:
+            zone = Zone.objects.get(pk=kwargs["zone_id"])
+        except Zone.DoesNotExist:
+            LOGGER.error(f"NS NOTIFY: zone id {kwargs['zone_id']} no longer exists")
+            return
+        except OperationalError as e:
+            LOGGER.error(f"NS NOTIFY failed due to unexpected error: {e}")
+            close_old_connections()
+            return
+
+        ns_targets = _resolve_zone_nameserver_ips(zone)
+        if not ns_targets:
+            LOGGER.warning(
+                f"NS NOTIFY: no nameserver addresses found in NetBox DNS for "
+                f"{view_name}/{zone_name} — skipping"
+            )
+            return
+
+        try:
+            tsig_key = _load_tsig_key(view_name)
+        except RuntimeError as e:
+            LOGGER.error(f"NS NOTIFY aborted for {view_name}/{zone_name}: {e}")
+            return
+
+        _send_notify(
+            zone_name, soa_serial, ns_targets, tsig_key,
+            view_name, notify_over_tcp, port, log_prefix="NS NOTIFY",
+        )
+
+
+def _get_soa_serial(zone: Zone):
+    """Return the current SOA serial of a zone parsed from its SOA record."""
+    try:
+        soa_record = Record.objects.filter(zone=zone, type="SOA", active=True).first()
+        if soa_record is None:
+            LOGGER.error(f"Zone {zone.name} has no active SOA record — skipping NOTIFY")
+            return None
+
+        return int(soa_record.value.split()[2])
+
+    except OperationalError as e:
+        LOGGER.error(f"DB ERROR while fetching SOA for zone {zone.name}: {e}")
+        close_old_connections()
+        return None
+    except (ValueError, IndexError) as e:
+        LOGGER.error(f"Failed to parse SOA serial for zone {zone.name}: {e}")
+        return None
+
+
+def _resolve_zone_nameserver_ips(zone: Zone) -> list:
+    """Resolve the zone's nameserver hostnames to IPs using NetBox DNS records.
+
+    For each nameserver assigned to the zone, matching active A/AAAA records
+    within the same view are looked up in NetBox DNS. Returns a de-duplicated,
+    order-preserving list of IP addresses.
+    """
+    ips = []
+    try:
+        nameservers = list(zone.nameservers.all())
+        view = zone.view
+
+        for nameserver in nameservers:
+            fqdn = dns.name.from_text(nameserver.name, dns.name.root).to_text()
+            # Match both with and without a trailing dot to be resilient against
+            # how the fqdn is stored on the Record model.
+            candidates = {fqdn, fqdn.rstrip(".")}
+
+            records = Record.objects.filter(
+                fqdn__in=list(candidates),
+                type__in=["A", "AAAA"],
+                active=True,
+                zone__view=view,
+            )
+            for record in records:
+                if record.value not in ips:
+                    ips.append(record.value)
+
+    except OperationalError as e:
+        LOGGER.error(f"DB ERROR while resolving nameservers for {zone.name}: {e}")
+        close_old_connections()
+
+    return ips
+
+
+def _notify_ns_enabled(zone) -> bool:
+    """Return True if a NOTIFY to the zone's nameservers should be sent.
+
+    Enabled either globally for every zone via ``notify_ns_all_zones`` or per
+    zone when the boolean custom field named by ``notify_ns_custom_field_name``
+    is set to True on the zone.
+    """
+    if SETTINGS.get("notify_ns_all_zones", False):
+        return True
+
+    cf_name = SETTINGS.get("notify_ns_custom_field_name")
+    if not cf_name:
+        return False
+
+    custom_fields = getattr(zone, "custom_field_data", None) or {}
+    return custom_fields.get(cf_name) is True
+
+
+def schedule_client_notify(zone: Zone):
+    if not SETTINGS.get("notify_clients", False):
+        return
+
+    soa_serial = _get_soa_serial(zone)
+    if soa_serial is None:
+        return
+
+    SendClientNotify.enqueue(
+        zone_name=zone.name,
+        view_name=zone.view.name,
+        soa_serial=soa_serial,
+    )
+
+
+def schedule_ns_notify(zone: Zone):
+    if not _notify_ns_enabled(zone):
+        return
+
+    soa_serial = _get_soa_serial(zone)
+    if soa_serial is None:
+        return
+
+    SendNSNotify.enqueue(
+        zone_id=zone.pk,
+        zone_name=zone.name,
+        view_name=zone.view.name,
+        soa_serial=soa_serial,
+    )
+
+
+def schedule_catalog_zone_notify(view: View):
+    if not SETTINGS.get("notify_clients", False):
+        return
+
+    try:
+        catalog_zone = view.catalog_zone
+    except CatalogZone.DoesNotExist:
+        return
+
+    serial = catalog_zone.soa_serial
+    soa_refresh = catalog_zone.soa_refresh
+    soa_retry = catalog_zone.soa_retry
+    soa_expire = catalog_zone.soa_expire
+    soa_minimum = catalog_zone.soa_minimum
+
+    SendClientNotify.enqueue(
+        zone_name="catz",
+        soa_serial=serial,
+        view_name=view.name,
+        soa_refresh=soa_refresh,
+        soa_retry=soa_retry,
+        soa_expire=soa_expire,
+        soa_minimum=soa_minimum,
+    )
+    SendClientNotify.enqueue(
+        zone_name=f"{view.name}.catz",
+        soa_serial=serial,
+        view_name=view.name,
+        soa_refresh=soa_refresh,
+        soa_retry=soa_retry,
+        soa_expire=soa_expire,
+        soa_minimum=soa_minimum,
+    )

netbox_dns_bridge/logger.py

@@ -1,12 +0,0 @@
-import logging
-
-PLUGIN_NAME = "dns-bridge"
-
-
-def get_logger(name: str) -> logging.Logger:
-    # name = name.replace("_","-").rsplit(".", 1)[-1]
-    #
-    # if name.startswith(PLUGIN_NAME):
-    #    return logging.getLogger(name)
-    # return logging.getLogger(f"{PLUGIN_NAME}.{name}")
-    return logging.getLogger(f"{PLUGIN_NAME}")

netbox_dns_bridge/management/commands/dns-export-zone.py

@@ -37,13 +37,10 @@ class Command(BaseCommand):
                 view__name=view_name, name=zone_name
             )
 
-            if nb_zone:
-                export_bind_zone_file(nb_zone, file_path=file_path)
-                self.stdout.write(
-                    self.style.SUCCESS(f"Zone '{zone_name}' exported to '{file_path}'")
-                )
-            else:
-                self.stderr.write("Zone not found in Netbox. Aborting")
+            export_bind_zone_file(nb_zone, file_path=file_path)
+            self.stdout.write(
+                self.style.SUCCESS(f"Zone '{zone_name}' exported to '{file_path}'")
+            )
 
         except Exception as e:
             raise CommandError(f"Failed to export zone: {e}")

netbox_dns_bridge/management/commands/dns-settings.py

@@ -1,51 +0,0 @@
-from django.core.management.base import BaseCommand, CommandError
-from netbox_dns_bridge.models import IntegerKeyValueSetting
-
-
-class Command(BaseCommand):
-    help = "Get or set integer key-value settings"
-
-    def add_arguments(self, parser):
-        parser.add_argument(
-            "action", choices=["get", "set", "list"], help="Action to perform"
-        )
-        parser.add_argument("key", nargs="?", help="Setting key")
-        parser.add_argument(
-            "value", nargs="?", type=int, help="Value to set (required for 'set')"
-        )
-
-    def handle(self, *args, **options):
-        action = options["action"]
-        key = options.get("key")
-        value = options.get("value")
-
-        if action == "list":
-            settings = IntegerKeyValueSetting.objects.all()
-            if not settings.exists():
-                self.stdout.write("No settings found.")
-                return
-            for setting in settings:
-                self.stdout.write(str(setting))
-
-        elif action == "get":
-            if not key:
-                raise CommandError("A key is required for GET")
-            try:
-                setting = IntegerKeyValueSetting.objects.get(key=key)
-                self.stdout.write(f"{setting.key}: {setting.value}")
-            except IntegerKeyValueSetting.DoesNotExist:
-                raise CommandError(f"No setting was found for {key}")
-
-        elif action == "set":
-            if not key:
-                raise CommandError("A setting is required for SET command")
-            if value is None:
-                raise CommandError("A value is required for SET command")
-            try:
-                setting = IntegerKeyValueSetting.objects.get(key=key)
-                old_value = setting.value
-                setting.value = value
-                setting.save()
-                self.stdout.write(f"Updated {key} from {old_value} to {value}")
-            except IntegerKeyValueSetting.DoesNotExist:
-                raise CommandError(f"No setting found for {key}")

netbox_dns_bridge/management/commands/dns-transfer-endpoint.py

@@ -1,4 +1,5 @@
 import threading
+import sys
 import dns.query
 import dns.message
 import dns.tsigkeyring
@@ -12,11 +13,11 @@ import dns.renderer
 
 from django.core.management.base import BaseCommand
 from django.conf import settings
-from django.db import close_old_connections, OperationalError
+from django.db import OperationalError
 from netbox_dns.models import View
-from netbox_dns_bridge.request_handler import UDPRequestHandler, TCPRequestHandler
-from netbox_dns_bridge.dns_server import UDPDNSServer, TCPDNSServer
-from netbox_dns_bridge.logger import get_logger
+from .dns_transfer_endpoint.request_handler import UDPRequestHandler, TCPRequestHandler
+from .dns_transfer_endpoint.dns_server import UDPDNSServer, TCPDNSServer
+from netbox_dns_bridge.utils import get_logger
 
 LOGGER = get_logger(__name__)
 SETTINGS = settings.PLUGINS_CONFIG.get("netbox_dns_bridge", {})
@@ -30,34 +31,42 @@ class Command(BaseCommand):
         self.tsig_view_map = {}
 
         for view_name, data in self.tsig_keys.items():
-            raw_key_name = data.get("keyname")
+            key_name = data.get("keyname")
             secret = data.get("secret")
-            algorithm_str = data.get("algorithm", "hmac-sha256")
+            algorithm = data.get("algorithm", "hmac-sha256")
 
-            if not raw_key_name or not secret:
+            if not key_name:
                 LOGGER.error(
-                    f"Skipping TSIG key for view {view_name}: missing keyname or secret."
+                    f"TSIG key for view {view_name} not found. Cannot start transfer endpoint."
                 )
-                continue
+                sys.exit(1)
+            elif not secret:
+                LOGGER.error(
+                    f"TSIG secret for key {key_name} not found. Cannot start transfer endpoint."
+                )
+                sys.exit(1)
 
             try:
                 nb_view = View.objects.get(name=view_name)
             except View.DoesNotExist:
                 LOGGER.error(
-                    f"Skipping TSIG key {raw_key_name}: view '{view_name}' not found."
+                    f"Skipping TSIG key {key_name}: View '{view_name}' not found in database."
                 )
                 continue
-            except OperationalError:
-                close_old_connections()
+            except OperationalError as e:
+                LOGGER.error(
+                    f"There was an error retrieving view model from database: {e}"
+                )
+                sys.exit(1)
 
             # Normalize key name to absolute DNS name
-            key_name_obj = dns.name.from_text(raw_key_name, origin=None).canonicalize()
-            if not key_name_obj.is_absolute():
-                key_name_obj = key_name_obj.concatenate(dns.name.root)
+            key_name_obj = dns.name.from_text(
+                key_name, origin=dns.name.root
+            ).canonicalize()
             key_name_str = key_name_obj.to_text()  # Will always include trailing do
 
             self.keyring[key_name_obj] = dns.tsig.Key(
-                name=key_name_obj, secret=secret, algorithm=algorithm_str
+                name=key_name_obj, secret=secret, algorithm=algorithm
             )
             self.tsig_view_map[key_name_str] = nb_view
             LOGGER.info(f"Loaded TSIG key {key_name_str} for view {nb_view.name}")

netbox_dns_bridge/management/commands/dns_transfer_endpoint/catalog_zone_manager.py

@@ -2,45 +2,53 @@ import dns.name
 import dns.zone
 import dns.rdatatype
 import dns.rdataclass
-from .logger import get_logger
-from netbox_dns.models import Zone as NBZone
-from netbox_dns_bridge.models import IntegerKeyValueSetting, CatalogZoneMemberIdentifier
+from netbox_dns_bridge.utils import get_logger
+from netbox_dns.models import Zone as NBZone, View as NBView
+from netbox_dns_bridge.models import CatalogZone, CatalogZoneMember
+from netbox_dns_bridge.jobs import notify
 from uuid import uuid4
 from base64 import b32encode
 from django.db import transaction, close_old_connections, OperationalError
 
+
 LOGGER = get_logger(__name__)
 
 
-def increment_soa_serial() -> int:
+def increment_soa_serial(view: NBView) -> int:
     with transaction.atomic():
         try:
-            soa_serial_obj = (
-                IntegerKeyValueSetting.objects.select_for_update().get_or_create(
-                    key="catalog-zone-soa-serial",
-                    defaults={"value": 1},
-                )
+            (
+                soa_serial_obj,
+                _,
+            ) = CatalogZone.objects.select_for_update().get_or_create(
+                view=view,
+                defaults={"soa_serial": 1},
             )
 
-            new_soa_serial = soa_serial_obj.value + 1
+            new_soa_serial = soa_serial_obj.soa_serial + 1
             if new_soa_serial > 0xFFFFFFFF:
                 LOGGER.warning(
-                    f"Catalog serial {soa_serial_obj.value} reached max — wrapping back to 1"
+                    f"Catalog serial {soa_serial_obj.soa_serial} reached max — wrapping back to 1"
                 )
                 new_soa_serial = 1
-            soa_serial_obj.value = new_soa_serial
+            soa_serial_obj.soa_serial = new_soa_serial
             soa_serial_obj.save()
             soa_serial_obj.refresh_from_db()
             LOGGER.debug(
-                f"Catalog zone SOA serial number is now {soa_serial_obj.value}"
+                f"Catalog zone SOA serial for view '{view.name}' "
+                f"is now {soa_serial_obj.soa_serial}"
             )
 
-            return soa_serial_obj.value
+            serial = soa_serial_obj.soa_serial
         except OperationalError as e:
             LOGGER.error(
                 f"ERROR: Failed to increment the Catalog Zone's SOA serial: {e}"
             )
             close_old_connections()
+            return None
+
+    notify.schedule_catalog_zone_notify(view)
+    return serial
 
 
 def create_zone(name, view_name) -> dns.zone.Zone:
@@ -55,7 +63,7 @@ def create_zone(name, view_name) -> dns.zone.Zone:
         # get zones from netbox
         nb_zones = NBZone.objects.filter(
             view__name=view_name, active=True
-        ).select_related("catz_identifier")
+        ).select_related("catalog_zone_member")
 
         ptr_base = dns.name.from_text("zones", origin)
 
@@ -65,18 +73,21 @@ def create_zone(name, view_name) -> dns.zone.Zone:
 
             # Create PTR record
             try:
-                catz_identifier = nb_zone.catz_identifier
-            except NBZone.catz_identifier.RelatedObjectDoesNotExist:
-                catz_identifier = CatalogZoneMemberIdentifier.objects.create(
-                    zone=nb_zone, name=_generate_member_identifier()
+                member = nb_zone.catalog_zone_member
+            except NBZone.catalog_zone_member.RelatedObjectDoesNotExist:
+                catalog_zone = _get_or_create_catalog_zone(nb_zone.view)
+                member = CatalogZoneMember.objects.create(
+                    zone=nb_zone,
+                    name=_generate_member_name(),
+                    catalog_zone=catalog_zone,
                 )
 
-            p_name = catz_identifier.name
+            p_name = member.name
 
             ptr_name = dns.name.from_text(p_name, ptr_base)
             if not ptr_name.is_subdomain(origin):
                 raise ValueError(
-                    f"Catalog zone member identifier {ptr_name.to_text()} not a subdomain"
+                    f"Catalog zone member {ptr_name.to_text()} not a subdomain"
                 )
             rdata = dns.rdata.from_text(
                 dns.rdataclass.IN, dns.rdatatype.PTR, qname.to_text()
@@ -98,7 +109,8 @@ def create_zone(name, view_name) -> dns.zone.Zone:
         zone_root_node = zone.find_node(origin, create=True)
 
         # SOA record
-        soa_rdataset = _create_soa_rdataset()
+        view = NBView.objects.get(name=view_name)
+        soa_rdataset = _create_soa_rdataset(view)
         zone_root_node.rdatasets.append(soa_rdataset)
 
         # NS record
@@ -120,26 +132,38 @@ def create_zone(name, view_name) -> dns.zone.Zone:
         return None
 
 
-def _generate_member_identifier() -> str:
+def _generate_member_name() -> str:
     return b32encode(uuid4().bytes)[0:26].lower().decode("UTF-8")
 
 
-def update_member_identifier(zone: NBZone) -> None:
+def _get_or_create_catalog_zone(view: NBView) -> CatalogZone:
+    catalog_zone, _ = CatalogZone.objects.get_or_create(
+        view=view, defaults={"soa_serial": 1}
+    )
+    return catalog_zone
+
+
+def update_member(zone: NBZone) -> None:
     try:
-        CatalogZoneMemberIdentifier.objects.update_or_create(
+        catalog_zone = _get_or_create_catalog_zone(zone.view)
+        CatalogZoneMember.objects.update_or_create(
             zone=zone,
-            defaults={"name": _generate_member_identifier()},
+            defaults={
+                "name": _generate_member_name(),
+                "catalog_zone": catalog_zone,
+            },
         )
     except OperationalError as e:
-        LOGGER.error(f"ERROR: Failed to update Catalog Zone member identifier: {e}")
+        LOGGER.error(f"ERROR: Failed to update Catalog Zone member: {e}")
         close_old_connections()
 
 
-def _create_soa_rdataset() -> dns.rdataset:
+def _create_soa_rdataset(view: NBView) -> dns.rdataset:
     try:
-        serial = IntegerKeyValueSetting.objects.get_or_create(
-            key="catalog-zone-soa-serial", defaults={"value": 1}
-        ).value
+        serial_obj, _ = CatalogZone.objects.get_or_create(
+            view=view, defaults={"soa_serial": 1}
+        )
+        serial = serial_obj.soa_serial
 
         # SOA Record components
         ttl = 0
@@ -150,7 +174,9 @@ def _create_soa_rdataset() -> dns.rdataset:
         rdata = dns.rdata.from_text(
             rclass,
             rtype,
-            f"invalid. invalid. {serial} 60 10 1209600 0",
+            f"invalid. invalid. {serial} {serial_obj.soa_refresh} "
+            f"{serial_obj.soa_retry} {serial_obj.soa_expire} "
+            f"{serial_obj.soa_minimum}",
         )
 
         # Create Rdataset and add the RDATA to it

netbox_dns_bridge/management/commands/dns_transfer_endpoint/dns_server.py

@@ -1,6 +1,6 @@
 import socketserver
 import socket
-from .logger import get_logger
+from netbox_dns_bridge.utils import get_logger
 
 LOGGER = get_logger(__name__)
 

netbox_dns_bridge/management/commands/dns_transfer_endpoint/request_handler.py

@@ -10,26 +10,28 @@ import dns.rdataclass
 import dns.rdtypes
 import dns.exception
 import dns.renderer
-from .logger import get_logger
 from django.utils import timezone
 from django.db import close_old_connections, OperationalError
 from django.conf import settings
-from netbox_dns.models import Zone, Record, View
-from netbox_dns_bridge import catalog_zone_manager as catzm
-from .models import SeenTransferClients
+from netbox_dns.models import Zone, View
+from . import catalog_zone_manager as catzm
+from netbox_dns_bridge.models import SeenTransferClient
+from netbox_dns_bridge.utils import build_dns_zone, get_logger
 
 LOGGER = get_logger(__name__)
-SETTINGS = settings.PLUGINS_CONFIG["netbox_dns_bridge"]
+SETTINGS = settings.PLUGINS_CONFIG.get("netbox_dns_bridge", {})
 
 
 class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
+    transport = None
+
     def __init__(self, request, client_address, server) -> None:
         self.MAX_WIRE = 65535
         self.RESERVED_TSIG = 300
         super().__init__(request, client_address, server)
 
-    # _getZoneFromNB rewritten
-    def _getZoneFromNB(self, zone_name, view_name) -> dns.zone.Zone:
+    # _get_zone_from_nb rewritten
+    def _get_zone_from_nb(self, zone_name, view_name) -> dns.zone.Zone:
         # Find the zone
         try:
             nb_zone = Zone.objects.get(
@@ -37,83 +39,7 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
                 view__name=view_name,
                 active=True,
             )
-            # Build DNS zone
-            zone = dns.zone.Zone(zone_name, dns.name.root)
-            zone.rdclass = dns.rdataclass.IN
-
-            nb_records = Record.objects.filter(zone=nb_zone, active=True)
-
-            rdatasets_dict = {}
-
-            for record in nb_records:
-                rdtype = dns.rdatatype.from_text(record.type)
-                if not record.name:
-                    name = zone.origin
-                elif record.name.endswith("."):
-                    name = dns.name.from_text(record.name)
-                else:
-                    name = dns.name.from_text(record.name, origin=zone.origin)
-
-                # If the record has no TTL, use the zone default
-                ttl = record.ttl or nb_zone.default_ttl
-
-                # Apply quoting for TXT records to stop tokanizer
-                # from cutting it up:
-                value = record.value
-                if rdtype == dns.rdatatype.TXT:
-                    if value.startswith('"') and value.endswith('"'):
-                        value = value[1:-1].replace('" "', "").replace('"', '"')
-
-                    if len(value) > 255:
-                        # This is a bug fix for netbox. If netbox allowed for
-                        # an unquoted value to be larger then 255 characters,
-                        # it misunderstood everything behind a ; as a comment.
-                        chunks = [
-                            '"{}"'.format(value[i : i + 255])
-                            for i in range(0, len(value), 255)
-                        ]
-                        value = " ".join(chunks)
-                    else:
-                        value = f'"{value}"'
-
-                rdata = dns.rdata.from_text(
-                    dns.rdataclass.IN,
-                    rdtype,
-                    value,
-                    relativize=False,
-                    origin=zone.origin,
-                )
-
-                # Initialize rdataset if it doesn't exist for this name and type
-                if name not in rdatasets_dict:
-                    rdatasets_dict[name] = {}
-                if rdtype not in rdatasets_dict[name]:
-                    rdatasets_dict[name][rdtype] = dns.rdataset.Rdataset(
-                        dns.rdataclass.IN, rdtype
-                    )
-
-                # Add the rdata to the appropriate rdataset
-                rdatasets_dict[name][rdtype].add(rdata, ttl)
-
-            # Now, add all rdatasets to the zone
-            for name, rdtypes in rdatasets_dict.items():
-                for rdtype, rdataset in rdtypes.items():
-                    # Ensure rdataset has the same rdclass as the zone
-                    if rdataset.rdclass != zone.rdclass:
-                        raise ValueError(
-                            f"rdataset rdclass {rdataset.rdclass} does not match "
-                            f"zone rdclass {zone.rdclass}"
-                        )
-
-                    # Check if the rdataset has any rdata before creating an RRset
-                    if not rdataset:
-                        LOGGER.debug(f"Skipping empty rdataset for {name} {rdtype}")
-                        continue  # Skip empty rdataset
-
-                    # Replace the rdataset for the given name and type
-                    zone.replace_rdataset(name, rdataset)
-            return zone
-
+            return build_dns_zone(nb_zone)
         except Zone.DoesNotExist:
             return None
         except OperationalError as e:
@@ -151,7 +77,7 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
     def _track_seen_client(self, source_ip: str, view: View) -> None:
         if SETTINGS.get("notify_clients", False):
             try:
-                SeenTransferClients.objects.update_or_create(
+                SeenTransferClient.objects.update_or_create(
                     source_ip=source_ip,
                     view=view,
                     defaults={"last_seen": timezone.now()},
@@ -319,7 +245,7 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
             return
 
         except Exception as e:
-            LOGGER.error("Error parsing query: ", e)
+            LOGGER.error(f"Error parsing query: {e}")
             return
 
         # If there was no question in the query, refuse
@@ -340,6 +266,11 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
             self._deny_request(query)
             return
 
+        if qtype == dns.rdatatype.AXFR and self.transport != "tcp":
+            LOGGER.warning(f"Request denied from {peer}: AXFR requires TCP")
+            self._deny_request(query, dns.rcode.REFUSED)
+            return
+
         # Identify TSIG key used
         if not query.had_tsig:
             LOGGER.warning(f"Request denied from {peer}: No TSIG key used")
@@ -358,10 +289,11 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
             return
 
         # Check if catalog zone
-        if dname == "catz" or dname == f"{nb_view.name}.catz":
-            zone = catzm.create_zone(dname, nb_view.name)
+        dname_lower = dname.lower()
+        if dname_lower == "catz" or dname_lower == f"{nb_view.name.lower()}.catz":
+            zone = catzm.create_zone(dname_lower, nb_view.name)
         else:
-            zone = self._getZoneFromNB(dname, nb_view.name)
+            zone = self._get_zone_from_nb(dname, nb_view.name)
         # When zone was not found, let client know
         if not zone:
             LOGGER.warning(f"Zone {dname} not found in view {nb_view.name}")
@@ -383,6 +315,8 @@ class DNSBaseRequestHandler(socketserver.BaseRequestHandler):
 
 
 class UDPRequestHandler(DNSBaseRequestHandler):
+    transport = "udp"
+
     def __init__(self, request, client_address, server) -> None:
         super().__init__(request, client_address, server)
 
@@ -403,6 +337,8 @@ class UDPRequestHandler(DNSBaseRequestHandler):
 
 
 class TCPRequestHandler(DNSBaseRequestHandler):
+    transport = "tcp"
+
     def __init__(self, request, client_address, server) -> None:
         super().__init__(request, client_address, server)
 

netbox_dns_bridge/migrations/0003_full_netbox_models.py

@@ -0,0 +1,233 @@
+import taggit.managers
+import utilities.json
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+def copy_serials_and_link_members(apps, schema_editor):
+    """Seed one CatalogZone per view from the old global serial and link members."""
+    IntegerKeyValueSetting = apps.get_model(
+        "netbox_dns_bridge", "IntegerKeyValueSetting"
+    )
+    CatalogZone = apps.get_model("netbox_dns_bridge", "CatalogZone")
+    CatalogZoneMember = apps.get_model("netbox_dns_bridge", "CatalogZoneMember")
+
+    # Preserve the current global serial; default to 1 when never initialized.
+    seed_serial = 1
+    kv = IntegerKeyValueSetting.objects.filter(key="catalog-zone-soa-serial").first()
+    if kv is not None:
+        seed_serial = kv.value
+
+    # Create a CatalogZone for every view that currently has at least one
+    # member, seeding each with the old global serial.
+    view_ids = set(
+        CatalogZoneMember.objects.exclude(
+            zone__view__isnull=True
+        ).values_list("zone__view_id", flat=True)
+    )
+
+    view_id_to_catalog_zone = {}
+    for view_id in view_ids:
+        cz, _ = CatalogZone.objects.get_or_create(
+            view_id=view_id, defaults={"soa_serial": seed_serial}
+        )
+        view_id_to_catalog_zone[view_id] = cz
+
+    # Link each member to the CatalogZone matching its zone's view.
+    for member in CatalogZoneMember.objects.select_related("zone__view"):
+        cz = view_id_to_catalog_zone.get(member.zone.view_id)
+        if cz is None:
+            # Defensive: member existed without a resolvable view. Create
+            # the CatalogZone on demand so the NOT NULL constraint can be set.
+            cz, _ = CatalogZone.objects.get_or_create(
+                view_id=member.zone.view_id, defaults={"soa_serial": seed_serial}
+            )
+            view_id_to_catalog_zone[member.zone.view_id] = cz
+        member.catalog_zone = cz
+        member.save(update_fields=["catalog_zone"])
+
+
+def reverse_migration(apps, schema_editor):
+    """Best-effort reverse: restore the KV row and null the FK."""
+    IntegerKeyValueSetting = apps.get_model(
+        "netbox_dns_bridge", "IntegerKeyValueSetting"
+    )
+    CatalogZone = apps.get_model("netbox_dns_bridge", "CatalogZone")
+    CatalogZoneMember = apps.get_model("netbox_dns_bridge", "CatalogZoneMember")
+
+    # Pick a representative serial (first catalog zone) to write back.
+    first = CatalogZone.objects.order_by("pk").first()
+    serial = first.soa_serial if first is not None else 1
+    IntegerKeyValueSetting.objects.update_or_create(
+        key="catalog-zone-soa-serial", defaults={"value": serial}
+    )
+
+    CatalogZoneMember.objects.update(catalog_zone=None)
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("extras", "0140_imageattachment_image_size"),
+        (
+            "netbox_dns",
+            "0032_record_expiration_date",
+        ),
+        ("netbox_dns_bridge", "0002_alter_integerkeyvaluesetting_options_and_more"),
+    ]
+
+    operations = [
+        # --- CatalogZone (full NetBoxModel, born with all fields) ---
+        migrations.CreateModel(
+            name="CatalogZone",
+            fields=[
+                (
+                    "id",
+                    models.BigAutoField(
+                        auto_created=True, primary_key=True, serialize=False
+                    ),
+                ),
+                ("soa_serial", models.IntegerField(default=1)),
+                ("soa_refresh", models.IntegerField(default=60)),
+                ("soa_retry", models.IntegerField(default=10)),
+                ("soa_expire", models.IntegerField(default=1209600)),
+                ("soa_minimum", models.IntegerField(default=0)),
+                ("created", models.DateTimeField(auto_now_add=True, null=True)),
+                ("last_updated", models.DateTimeField(auto_now=True, null=True)),
+                (
+                    "custom_field_data",
+                    models.JSONField(
+                        blank=True,
+                        default=dict,
+                        encoder=utilities.json.CustomFieldJSONEncoder,
+                    ),
+                ),
+                (
+                    "tags",
+                    taggit.managers.TaggableManager(
+                        through="extras.TaggedItem", to="extras.Tag"
+                    ),
+                ),
+                (
+                    "view",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="catalog_zone",
+                        to="netbox_dns.view",
+                    ),
+                ),
+            ],
+            options={
+                "ordering": ("view__name",),
+            },
+        ),
+        # --- CatalogZoneMemberIdentifier → CatalogZoneMember (rename + full NetBoxModel) ---
+        migrations.RenameModel(
+            old_name="CatalogZoneMemberIdentifier",
+            new_name="CatalogZoneMember",
+        ),
+        migrations.AddField(
+            model_name="catalogzonemember",
+            name="created",
+            field=models.DateTimeField(auto_now_add=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="catalogzonemember",
+            name="last_updated",
+            field=models.DateTimeField(auto_now=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="catalogzonemember",
+            name="custom_field_data",
+            field=models.JSONField(
+                blank=True,
+                default=dict,
+                encoder=utilities.json.CustomFieldJSONEncoder,
+            ),
+        ),
+        migrations.AddField(
+            model_name="catalogzonemember",
+            name="tags",
+            field=taggit.managers.TaggableManager(
+                through="extras.TaggedItem", to="extras.Tag"
+            ),
+        ),
+        migrations.AlterField(
+            model_name="catalogzonemember",
+            name="name",
+            field=models.CharField(max_length=26),
+        ),
+        migrations.AlterField(
+            model_name="catalogzonemember",
+            name="zone",
+            field=models.OneToOneField(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="catalog_zone_member",
+                to="netbox_dns.zone",
+            ),
+        ),
+        migrations.AddField(
+            model_name="catalogzonemember",
+            name="catalog_zone",
+            field=models.ForeignKey(
+                null=True,
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="members",
+                to="netbox_dns_bridge.catalogzone",
+            ),
+        ),
+        migrations.RunPython(
+            copy_serials_and_link_members,
+            reverse_code=reverse_migration,
+        ),
+        migrations.AlterField(
+            model_name="catalogzonemember",
+            name="catalog_zone",
+            field=models.ForeignKey(
+                on_delete=django.db.models.deletion.CASCADE,
+                related_name="members",
+                to="netbox_dns_bridge.catalogzone",
+            ),
+        ),
+        migrations.AddConstraint(
+            model_name="catalogzonemember",
+            constraint=models.UniqueConstraint(
+                fields=("name", "catalog_zone"),
+                name="unique_name_per_catalog_zone",
+            ),
+        ),
+        migrations.DeleteModel(
+            name="IntegerKeyValueSetting",
+        ),
+        # --- SeenTransferClients → SeenTransferClient (rename + full NetBoxModel) ---
+        migrations.RenameModel(
+            old_name="SeenTransferClients",
+            new_name="SeenTransferClient",
+        ),
+        migrations.AddField(
+            model_name="seentransferclient",
+            name="created",
+            field=models.DateTimeField(auto_now_add=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="seentransferclient",
+            name="last_updated",
+            field=models.DateTimeField(auto_now=True, null=True),
+        ),
+        migrations.AddField(
+            model_name="seentransferclient",
+            name="custom_field_data",
+            field=models.JSONField(
+                blank=True,
+                default=dict,
+                encoder=utilities.json.CustomFieldJSONEncoder,
+            ),
+        ),
+        migrations.AddField(
+            model_name="seentransferclient",
+            name="tags",
+            field=taggit.managers.TaggableManager(
+                through="extras.TaggedItem", to="extras.Tag"
+            ),
+        ),
+    ]

netbox_dns_bridge/models.py

@@ -2,42 +2,63 @@ from django.db import models
 
 # import netbox.models
 import netbox_dns.models
+from netbox.models import NetBoxModel
 
 
-class IntegerKeyValueSetting(models.Model):
-    _netbox_private = True
+class CatalogZone(NetBoxModel):
+    view = models.OneToOneField(
+        to=netbox_dns.models.View,
+        on_delete=models.CASCADE,
+        related_name="catalog_zone",
+    )
+    soa_serial = models.IntegerField(default=1)
+    soa_refresh = models.IntegerField(default=60)
+    soa_retry = models.IntegerField(default=10)
+    soa_expire = models.IntegerField(default=1209600)
+    soa_minimum = models.IntegerField(default=0)
 
-    key = models.CharField(max_length=64)
-    value = models.IntegerField()
+    class Meta:
+        ordering = ("view__name",)
+        verbose_name = "Catalog Zone"
+        verbose_name_plural = "Catalog Zones"
 
     def __str__(self):
-        return f"{self.key}: {str(self.value)}"
+        return f"{self.view.name}: {self.soa_serial}"
 
 
-class CatalogZoneMemberIdentifier(models.Model):
-    _netbox_private = True
-
+class CatalogZoneMember(NetBoxModel):
     name = models.CharField(
         max_length=26,
-        unique=True,
     )
 
     zone = models.OneToOneField(
         to=netbox_dns.models.Zone,
         on_delete=models.CASCADE,
-        related_name="catz_identifier",
+        related_name="catalog_zone_member",
+    )
+
+    catalog_zone = models.ForeignKey(
+        to=CatalogZone,
+        on_delete=models.CASCADE,
+        related_name="members",
     )
 
     class Meta:
         ordering = ("name",)
+        verbose_name = "Catalog Zone Member"
+        verbose_name_plural = "Catalog Zone Members"
+        constraints = [
+            models.UniqueConstraint(
+                fields=["name", "catalog_zone"],
+                name="unique_name_per_catalog_zone",
+            ),
+        ]
 
     def __str__(self):
         return self.name
 
 
-class SeenTransferClients(models.Model):
-    _netbox_private = True
-
+class SeenTransferClient(NetBoxModel):
     source_ip = models.GenericIPAddressField()
     last_seen = models.DateTimeField()
     view = models.ForeignKey(
@@ -51,6 +72,8 @@ class SeenTransferClients(models.Model):
 
     class Meta:
         ordering = ("source_ip",)
+        verbose_name = "Seen Transfer Client"
+        verbose_name_plural = "Seen Transfer Clients"
         constraints = [
             models.UniqueConstraint(
                 fields=["source_ip", "view"],

netbox_dns_bridge/navigation.py

@@ -0,0 +1,35 @@
+from django.utils.translation import gettext_lazy as _
+from netbox.plugins import PluginMenu, PluginMenuItem
+
+catalog_zones_menu_item = PluginMenuItem(
+    link="plugins:netbox_dns_bridge:catalogzone_list",
+    link_text=_("Catalog Zones"),
+    permissions=["netbox_dns_bridge.view_catalogzone"],
+)
+
+catalog_zone_members_menu_item = PluginMenuItem(
+    link="plugins:netbox_dns_bridge:catalogzonemember_list",
+    link_text=_("Catalog Zone Members"),
+    permissions=["netbox_dns_bridge.view_catalogzonemember"],
+)
+
+seen_transfer_clients_menu_item = PluginMenuItem(
+    link="plugins:netbox_dns_bridge:seentransferclient_list",
+    link_text=_("Clients"),
+    permissions=["netbox_dns_bridge.view_seentransferclient"],
+)
+
+menu = PluginMenu(
+    label=_("DNS Bridge"),
+    groups=(
+        (
+            _("Catalog Zone"),
+            (catalog_zones_menu_item, catalog_zone_members_menu_item),
+        ),
+        (
+            _("Notify"),
+            (seen_transfer_clients_menu_item,),
+        ),
+    ),
+    icon_class="mdi mdi-bridge",
+)

netbox_dns_bridge/notify_handler.py

@@ -1,136 +0,0 @@
-import dns.message
-import dns.name
-import dns.opcode
-import dns.query
-import dns.rdatatype
-import dns.rdataclass
-import dns.rrset
-import dns.tsig
-from django.conf import settings
-from django.utils import timezone
-from django.db import close_old_connections, OperationalError
-from netbox.jobs import JobRunner
-from netbox_dns.models import View, Zone, Record
-from .logger import get_logger
-from .models import SeenTransferClients, IntegerKeyValueSetting
-
-LOGGER = get_logger(__name__)
-SETTINGS = settings.PLUGINS_CONFIG["netbox_dns_bridge"]
-
-
-class SendDNSNotify(JobRunner):
-    class Meta:
-        name = "Send DNS NOTIFY"
-
-    def _load_tsig_key(self, view_name: str) -> dns.tsig.Key:
-        tsig_keys = SETTINGS.get("tsig_keys", {})
-        if view_name not in tsig_keys:
-            raise RuntimeError(f"No TSIG key configured for view '{view_name}'")
-
-        key_data = tsig_keys[view_name]
-        raw_key_name = key_data.get("keyname")
-        secret = key_data.get("secret")
-        algorithm = key_data.get("algorithm")
-        if not algorithm:
-            raise RuntimeError(
-                f"Missing 'algorithm' in TSIG key configuration for view '{view_name}'"
-            )
-
-        if not raw_key_name or not secret:
-            raise RuntimeError(
-                f"Incomplete TSIG key configuration for view '{view_name}'"
-            )
-
-        key_name = dns.name.from_text(raw_key_name, origin=None).canonicalize()
-        if not key_name.is_absolute():
-            key_name = key_name.concatenate(dns.name.root)
-
-        return dns.tsig.Key(name=key_name, secret=secret, algorithm=algorithm)
-
-    def run(self, *args, **kwargs):
-        notify_over_tcp = SETTINGS.get("notify_over_tcp", False)
-        view_name = kwargs["view_name"]
-
-        try:
-            catz_serial = IntegerKeyValueSetting.objects.get(
-                key="catalog-zone-soa-serial"
-            ).value
-
-            zones = [
-                (kwargs["zone_name"], kwargs["soa_serial"]),
-                ("catz", catz_serial),
-                (f"{view_name}.catz", catz_serial),
-            ]
-
-            view = View.objects.get(name=view_name)
-            tsig_key = self._load_tsig_key(view_name)
-            cutoff_hours = SETTINGS.get("notify_client_alive_threshold_hours", 24)
-            seen_cutoff = timezone.now() - timezone.timedelta(hours=cutoff_hours)
-
-            clients = SeenTransferClients.objects.filter(
-                view=view, last_seen__gte=seen_cutoff
-            )
-
-            for zone_name, soa_serial in zones:
-                zone_name = dns.name.from_text(zone_name, dns.name.root).to_text()
-                msg = dns.message.make_query(zone_name, dns.rdatatype.SOA)
-                msg.flags |= dns.flags.AA  # = 0
-                msg.set_opcode(dns.opcode.NOTIFY)
-
-                soa_rdata = dns.rdata.from_text(
-                    dns.rdataclass.IN,
-                    dns.rdatatype.SOA,
-                    f"invalid. invalid. {soa_serial} 60 10 1209600 0",
-                )
-                soa_rrset = dns.rrset.from_rdata(zone_name, 0, soa_rdata)
-                msg.authority.append(soa_rrset)
-                msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
-
-                for client in clients:
-                    try:
-                        if notify_over_tcp:
-                            LOGGER.debug("Sending NOTIFY over TCP")
-                            dns.query.tcp(msg, client.source_ip, port=5355, timeout=2)
-                        else:
-                            LOGGER.debug("Sending NOTIFY over UDP")
-                            dns.query.udp(msg, client.source_ip, port=5355, timeout=2)
-
-                        LOGGER.info(
-                            f"NOTIFY sent: {client.source_ip} {view_name}/{zone_name} {soa_serial}"
-                        )
-                    except Exception as e:
-                        LOGGER.error(
-                            f"NOTIFY failed: {client.source_ip}"
-                            f" {view_name}/{zone_name} {soa_serial}: {e}"
-                        )
-
-        except IntegerKeyValueSetting.DoesNotExist as e:
-            LOGGER.error(f"Failed to get catalog zone serial: {e}")
-
-        except OperationalError as e:
-            LOGGER.error(f"NOTIFY failed due to unexpected error: {e}")
-            close_old_connections()
-
-
-def schedule(zone: Zone):
-    try:
-        soa_record = Record.objects.filter(zone=zone, type="SOA", active=True).first()
-        if soa_record is None:
-            LOGGER.error(f"Zone {zone.name} has no active SOA record — skipping NOTIFY")
-            return
-
-        soa_serial = int(soa_record.value.split()[2])
-
-    except OperationalError as e:
-        LOGGER.error(f"DB ERROR while fetching SOA for zone {zone.name}: {e}")
-        close_old_connections()
-        return
-    except (ValueError, IndexError) as e:
-        LOGGER.error(f"Failed to parse SOA serial for zone {zone.name}: {e}")
-        return
-
-    SendDNSNotify.enqueue(
-        zone_name=zone.name,
-        view_name=zone.view.name,
-        soa_serial=soa_serial,
-    )

netbox_dns_bridge/signals/netbox_dns_zones.py

@@ -1,13 +1,10 @@
 from django.db.models.signals import pre_save, post_save, post_delete
 from django.dispatch import receiver
 from django.db import transaction
-from django.conf import settings
 from netbox.context import current_request
-from netbox_dns.models import Zone
-from netbox_dns_bridge import catalog_zone_manager as catzm
-from netbox_dns_bridge import notify_handler
-
-SETTINGS = settings.PLUGINS_CONFIG["netbox_dns_bridge"]
+from netbox_dns.models import Zone, View
+from netbox_dns_bridge.management.commands.dns_transfer_endpoint import catalog_zone_manager as catzm
+from netbox_dns_bridge.jobs import notify
 
 
 @receiver(pre_save, sender=Zone)
@@ -15,11 +12,18 @@ def zone_pre_save(sender, instance, **kwargs):
     zone = instance
     if zone.pk:
         try:
-            zone._old_name = sender.objects.only("name").get(pk=zone.pk).name
+            old = sender.objects.only("name", "soa_serial", "view_id").get(pk=zone.pk)
+            zone._old_name = old.name
+            zone._old_soa_serial = old.soa_serial
+            zone._old_view_id = old.view_id
         except sender.DoesNotExist:
             zone._old_name = None
+            zone._old_soa_serial = None
+            zone._old_view_id = None
     else:
         zone._old_name = None
+        zone._old_soa_serial = None
+        zone._old_view_id = None
 
 
 @receiver(post_save, sender=Zone)
@@ -29,6 +33,8 @@ def zone_post_save(sender, instance, created, **kwargs):
     # Quit if this is not the first signal in this session for this zone.
     try:
         request = current_request.get()
+        if request is None:
+            raise LookupError
         handled_zones = getattr(request, "_handled_zones", set())
         if zone.pk in handled_zones:
             return
@@ -37,25 +43,54 @@ def zone_post_save(sender, instance, created, **kwargs):
     except LookupError:
         pass
 
-    # On commit, increment soa serial and if notify is enabled, schedule bg job.
-    def _on_commit():
-        catzm.increment_soa_serial()
+    # Determine whether the zone's SOA serial number changed with this save.
+    # A newly created zone is always considered to have a "changed" serial.
+    old_soa_serial = getattr(zone, "_old_soa_serial", None)
+    new_soa_serial = getattr(zone, "soa_serial", None)
+    soa_serial_changed = created or (old_soa_serial != new_soa_serial)
 
-        if SETTINGS.get("notify_clients", False):
-            notify_handler.schedule(zone)
+    # Detect whether the zone moved between views. When it does, the old
+    # view's catalog zone loses a member and the new view's gains one, so
+    # both serials must be incremented.
+    old_view_id = getattr(zone, "_old_view_id", None)
+    view_changed = (
+        not created
+        and old_view_id is not None
+        and old_view_id != zone.view_id
+    )
+
+    # On commit, increment soa serial and schedule notify jobs. All settings
+    # gating happens inside the scheduling functions.
+    def _on_commit():
+        if view_changed:
+            try:
+                old_view = View.objects.get(pk=old_view_id)
+                catzm.increment_soa_serial(old_view)
+            except View.DoesNotExist:
+                pass
+        catzm.increment_soa_serial(zone.view)
+
+        if soa_serial_changed:
+            notify.schedule_client_notify(zone)
+            notify.schedule_ns_notify(zone)
 
     transaction.on_commit(_on_commit)
 
     if created:
-        # If zone was created, create catz member identifier record for this zone.
-        catzm.update_member_identifier(zone)
+        # If zone was created, create the catalog zone member record for this zone.
+        catzm.update_member(zone)
     else:
-        # Check if zone name has changed and change the catz member identifier if so.
+        # Re-create the catalog zone member when the zone name or its view
+        # changed. A view move leaves the member pointing at the wrong
+        # catalog zone, so it must be refreshed.
         old_name = getattr(zone, "_old_name", None)
-        if old_name and zone.name != old_name:
-            catzm.update_member_identifier(zone)
+        if (old_name and zone.name != old_name) or view_changed:
+            catzm.update_member(zone)
 
 
 @receiver(post_delete, sender=Zone)
 def zone_post_delete(sender, instance, **kwargs):
-    catzm.increment_soa_serial()
+    def _on_commit():
+        catzm.increment_soa_serial(instance.view)
+
+    transaction.on_commit(_on_commit)

netbox_dns_bridge/tables.py

@@ -0,0 +1,78 @@
+import django_tables2 as tables
+from django.utils.translation import gettext_lazy as _
+
+from netbox.tables import NetBoxTable
+from netbox.tables.columns import ActionsColumn
+
+from .models import CatalogZone, CatalogZoneMember, SeenTransferClient
+
+
+class CatalogZoneMemberTable(NetBoxTable):
+    name = tables.Column(linkify=True)
+    zone = tables.Column(
+        accessor="zone__name",
+        verbose_name=_("Zone"),
+        linkify=True,
+    )
+    view = tables.Column(
+        accessor="catalog_zone__view__name",
+        verbose_name=_("View"),
+    )
+
+    actions = ActionsColumn(actions=())
+
+    class Meta(NetBoxTable.Meta):
+        model = CatalogZoneMember
+        fields = ("name", "zone", "view")
+        default_columns = ("name", "zone", "view")
+
+
+class CatalogZoneTable(NetBoxTable):
+    view = tables.Column(
+        accessor="view__name",
+        verbose_name=_("View"),
+        linkify=True,
+    )
+    soa_serial = tables.Column(verbose_name=_("SOA Serial"))
+    soa_refresh = tables.Column(verbose_name=_("Refresh"))
+    soa_retry = tables.Column(verbose_name=_("Retry"))
+    soa_expire = tables.Column(verbose_name=_("Expire"))
+    soa_minimum = tables.Column(verbose_name=_("Minimum"))
+
+    actions = ActionsColumn(actions=("edit", "changelog"))
+
+    class Meta(NetBoxTable.Meta):
+        model = CatalogZone
+        fields = (
+            "view",
+            "soa_serial",
+            "soa_refresh",
+            "soa_retry",
+            "soa_expire",
+            "soa_minimum",
+        )
+        default_columns = (
+            "view",
+            "soa_serial",
+            "soa_refresh",
+            "soa_retry",
+            "soa_expire",
+            "soa_minimum",
+        )
+
+
+class SeenTransferClientTable(NetBoxTable):
+    source_ip = tables.Column(linkify=True)
+    view = tables.Column(
+        accessor="view__name",
+        verbose_name=_("View"),
+        linkify=True,
+    )
+    last_seen = tables.DateTimeColumn(verbose_name=_("Last Seen"))
+
+    actions = ActionsColumn(actions=())
+
+    class Meta(NetBoxTable.Meta):
+        model = SeenTransferClient
+        fields = ("source_ip", "view", "last_seen")
+        default_columns = ("source_ip", "view", "last_seen")

netbox_dns_bridge/templates/netbox_dns_bridge/catalog_zone_edit.html

@@ -0,0 +1,4 @@
+{% extends 'generic/object_edit.html' %}
+{% load i18n %}
+
+{% block title %}{% trans "Edit Catalog Zone" %}{% endblock %}

netbox_dns_bridge/templates/netbox_dns_bridge/catalog_zone_list.html

@@ -0,0 +1,4 @@
+{% extends 'generic/object_list.html' %}
+{% load i18n %}
+
+{% block title %}{% trans "Catalog Zones" %}{% endblock %}

netbox_dns_bridge/templates/netbox_dns_bridge/catalogzone.html

@@ -0,0 +1,50 @@
+{% extends 'generic/object.html' %}
+{% load plugins %}
+{% load i18n %}
+
+{% block content %}
+<div class="row">
+  <div class="col col-md-6">
+    <div class="card">
+      <h5 class="card-header">{% trans "Catalog Zone SOA" %}</h5>
+      <table class="table table-hover attr-table">
+        <tr>
+          <th scope="row">{% trans "View" %}</th>
+          <td>{{ object.view|linkify }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "SOA Serial" %}</th>
+          <td>{{ object.soa_serial }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Refresh" %}</th>
+          <td>{{ object.soa_refresh }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Retry" %}</th>
+          <td>{{ object.soa_retry }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Expire" %}</th>
+          <td>{{ object.soa_expire }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Minimum" %}</th>
+          <td>{{ object.soa_minimum }}</td>
+        </tr>
+      </table>
+    </div>
+    {% include 'inc/panels/custom_fields.html' %}
+    {% plugin_left_page object %}
+  </div>
+  <div class="col col-md-6">
+    {% include 'inc/panels/tags.html' %}
+    {% plugin_right_page object %}
+  </div>
+</div>
+<div class="row">
+  <div class="col col-md-12">
+    {% plugin_full_width_page object %}
+  </div>
+</div>
+{% endblock %}

netbox_dns_bridge/templates/netbox_dns_bridge/catalogzonemember.html

@@ -0,0 +1,42 @@
+{% extends 'generic/object.html' %}
+{% load plugins %}
+{% load i18n %}
+
+{% block content %}
+<div class="row">
+  <div class="col col-md-6">
+    <div class="card">
+      <h5 class="card-header">{% trans "Catalog Zone Member" %}</h5>
+      <table class="table table-hover attr-table">
+        <tr>
+          <th scope="row">{% trans "Name" %}</th>
+          <td>{{ object.name }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Zone" %}</th>
+          <td>{{ object.zone|linkify }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Catalog Zone" %}</th>
+          <td>{{ object.catalog_zone|linkify }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "View" %}</th>
+          <td>{{ object.catalog_zone.view|linkify }}</td>
+        </tr>
+      </table>
+    </div>
+    {% include 'inc/panels/custom_fields.html' %}
+    {% plugin_left_page object %}
+  </div>
+  <div class="col col-md-6">
+    {% include 'inc/panels/tags.html' %}
+    {% plugin_right_page object %}
+  </div>
+</div>
+<div class="row">
+  <div class="col col-md-12">
+    {% plugin_full_width_page object %}
+  </div>
+</div>
+{% endblock %}

netbox_dns_bridge/templates/netbox_dns_bridge/seentransferclient.html

@@ -0,0 +1,38 @@
+{% extends 'generic/object.html' %}
+{% load plugins %}
+{% load i18n %}
+
+{% block content %}
+<div class="row">
+  <div class="col col-md-6">
+    <div class="card">
+      <h5 class="card-header">{% trans "Seen Transfer Client" %}</h5>
+      <table class="table table-hover attr-table">
+        <tr>
+          <th scope="row">{% trans "Source IP" %}</th>
+          <td>{{ object.source_ip }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "View" %}</th>
+          <td>{{ object.view|linkify }}</td>
+        </tr>
+        <tr>
+          <th scope="row">{% trans "Last Seen" %}</th>
+          <td>{{ object.last_seen|date:"Y-m-d H:i:s" }}</td>
+        </tr>
+      </table>
+    </div>
+    {% include 'inc/panels/custom_fields.html' %}
+    {% plugin_left_page object %}
+  </div>
+  <div class="col col-md-6">
+    {% include 'inc/panels/tags.html' %}
+    {% plugin_right_page object %}
+  </div>
+</div>
+<div class="row">
+  <div class="col col-md-12">
+    {% plugin_full_width_page object %}
+  </div>
+</div>
+{% endblock %}

netbox_dns_bridge/tests/_helpers.py

@@ -0,0 +1,258 @@
+"""Shared, non-fixture helpers for the test suite.
+
+Pure DNS / TSIG / handler plumbing that does not touch the database. Database
+factories live in ``conftest.py`` as pytest fixtures.
+"""
+from __future__ import annotations
+
+from unittest.mock import MagicMock
+
+import dns.message
+import dns.name
+import dns.rdatatype
+import dns.tsig
+import dns.tsigkeyring
+
+from netbox_dns_bridge.management.commands.dns_transfer_endpoint.request_handler import (
+    DNSBaseRequestHandler,
+    TCPRequestHandler,
+    UDPRequestHandler,
+)
+
+DEFAULT_TSIG_ALGORITHM = "hmac-sha256"
+DEFAULT_TSIG_SECRET = "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE="
+
+
+def make_tsig_key(
+    key_name: str = "testkey.",
+    secret: str = DEFAULT_TSIG_SECRET,
+    algorithm: str = DEFAULT_TSIG_ALGORITHM,
+) -> dns.tsig.Key:
+    name = dns.name.from_text(key_name, origin=dns.name.root).canonicalize()
+    return dns.tsig.Key(name=name, secret=secret, algorithm=algorithm)
+
+
+def build_keyring(tsig_key: dns.tsig.Key) -> dict:
+    return {tsig_key.name: tsig_key}
+
+
+def build_tsig_view_map(key_name: str, view) -> dict:
+    canon = dns.name.from_text(key_name, origin=dns.name.root).canonicalize().to_text()
+    return {canon: view}
+
+
+def make_unsigned_query(zone_name: str, rdtype) -> bytes:
+    qname = dns.name.from_text(zone_name, dns.name.root)
+    msg = dns.message.make_query(qname, rdtype)
+    return msg.to_wire()
+
+
+def make_signed_query(
+    zone_name: str,
+    rdtype,
+    tsig_key: dns.tsig.Key,
+) -> bytes:
+    qname = dns.name.from_text(zone_name, dns.name.root)
+    msg = dns.message.make_query(qname, rdtype)
+    msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
+    return msg.to_wire()
+
+
+class FakeServer:
+    """Stand-in for socketserver's ``self.server`` carrying TSIG state."""
+
+    def __init__(self, keyring: dict, tsig_view_map: dict):
+        self.keyring = keyring
+        self.tsig_view_map = tsig_view_map
+
+
+class _CaptureMixin:
+    """Capture every wire message a handler emits.
+
+    Both ``_send_response`` (used by denials, SOA and the final AXFR message)
+    and the direct ``self.request.sendall`` calls (intermediate AXFR messages)
+    are recorded as raw wire bytes (the 2-byte TCP length prefix is stripped).
+    """
+
+    transport = "tcp"
+
+    def _setup_capture(self, captured: list):
+        self._captured = captured
+        # For TCP: AXFR intermediate sends use self.request.sendall directly.
+        self.request = MagicMock()
+        self.request.sendall.side_effect = lambda data: self._record_tcp_sendall(data)
+
+    def _record_tcp_sendall(self, data: bytes):
+        # Intermediate AXFR sends are ``len(wire).to_bytes(2,"big") + wire``.
+        if len(data) >= 2:
+            self._captured.append(data[2:])
+        else:
+            self._captured.append(data)
+
+    def _send_response(self, data: bytes):
+        self._captured.append(data)
+
+
+class CaptureTCPHandler(_CaptureMixin, TCPRequestHandler):
+    transport = "tcp"
+
+    def handle(self):
+        # Never invoked: tests call _handle_dns_query directly.
+        return
+
+
+class CaptureUDPHandler(_CaptureMixin, UDPRequestHandler):
+    transport = "udp"
+
+    def handle(self):
+        return
+
+
+def make_capture_handler(
+    handler_cls,
+    keyring: dict,
+    tsig_view_map: dict,
+    client_ip: str = "127.0.0.1",
+):
+    """Instantiate a capture handler without running ``handle()``.
+
+    Returns ``(handler, captured)`` where ``captured`` is the list of wire
+    messages emitted by the handler.
+    """
+    captured: list = []
+    server = FakeServer(keyring, tsig_view_map)
+    handler = handler_cls.__new__(handler_cls)
+    # Replicate DNSBaseRequestHandler.__init__ without calling super().__init__
+    # (which would invoke setup()/handle()).
+    handler.MAX_WIRE = 65535
+    handler.RESERVED_TSIG = 300
+    handler._setup_capture(captured)
+    handler.client_address = (client_ip, 12345)
+    handler.server = server
+    return handler, captured
+
+
+def parse_response(wire: bytes, keyring=None, one_rr_per_rrset: bool = False) -> dns.message.Message:
+    # ``make_response`` in this dnspython copies the request TSIG keyname into
+    # the response even for unsigned denials, so lenient parsing is required to
+    # inspect rcode/flags/answer without verifying the (absent) MAC.
+    # Use ``one_rr_per_rrset=True`` for AXFR framing checks so that repeated
+    # identical RRsets (e.g. opening + closing SOA) are not merged on parse.
+    return dns.message.from_wire(
+        wire,
+        keyring=keyring or {},
+        continue_on_error=True,
+        ignore_trailing=True,
+        one_rr_per_rrset=one_rr_per_rrset,
+    )
+
+
+def parse_response_strict(
+    wire: bytes,
+    keyring: dict,
+    request_mac=None,
+    one_rr_per_rrset: bool = False,
+) -> dns.message.Message:
+    """Parse and fully verify TSIG. Raises on bad signature / unknown key.
+
+    Verifying a response TSIG requires the original request's MAC; pass it via
+    ``request_mac`` (obtainable from the parsed query's ``.mac`` attribute).
+    """
+    return dns.message.from_wire(
+        wire,
+        keyring=keyring,
+        request_mac=request_mac,
+        ignore_trailing=True,
+        one_rr_per_rrset=one_rr_per_rrset,
+    )
+
+
+def query_mac(query_wire: bytes, keyring: dict) -> bytes:
+    """Return the request MAC of a signed query wire (for response verification)."""
+    q = dns.message.from_wire(query_wire, keyring=keyring, ignore_trailing=True)
+    return q.mac
+
+
+def tcp_exchange(wire: bytes, host: str, port: int, timeout: float = 5.0) -> bytes:
+    """Send a wire message over TCP (2-byte length framing), return response wire."""
+    import socket
+
+    with socket.create_connection((host, port), timeout=timeout) as sock:
+        sock.settimeout(timeout)
+        sock.sendall(len(wire).to_bytes(2, "big") + wire)
+        # Read response length then body (handle partial reads).
+        length = _recv_exact(sock, 2)
+        resp_len = int.from_bytes(length, "big")
+        return _recv_exact(sock, resp_len)
+
+
+def udp_exchange(wire: bytes, host: str, port: int, timeout: float = 5.0) -> bytes:
+    """Send a wire message over UDP, return response wire."""
+    import socket
+
+    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
+    sock.settimeout(timeout)
+    try:
+        sock.sendto(wire, (host, port))
+        return sock.recv(65535)
+    finally:
+        sock.close()
+
+
+def _recv_exact(sock, n: int) -> bytes:
+    buf = b""
+    while len(buf) < n:
+        chunk = sock.recv(n - len(buf))
+        if not chunk:
+            raise OSError("connection closed")
+        buf += chunk
+    return buf
+
+
+def xfr_rrsets(xfr_messages):
+    """Flatten AXFR/IXFR response messages into a flat list of RRsets.
+
+    ``dns.query.xfr`` yields ``Message`` objects (one per TCP response chunk).
+    Each message's ``answer`` section contains RRsets. This helper flattens
+    all answer RRsets across all messages into a single list, preserving order.
+    """
+    rrsets = []
+    for msg in xfr_messages:
+        rrsets.extend(msg.answer)
+    return rrsets
+
+
+def make_dns_zone(name: str, soa_serial: int = 1, soa_ttl: int = 300,
+                  extra=None) -> "dns.zone.Zone":
+    """Build a ``dns.zone.Zone`` directly (no database) for unit tests.
+
+    Always includes an SOA at the apex. ``extra`` is an optional list of
+    ``(relative_name, rdtype, ttl, value_text)`` tuples appended as rdatasets.
+    """
+    import dns.rdata
+    import dns.rdataclass
+    import dns.rdataset
+    import dns.rdatatype
+    import dns.zone
+
+    origin = dns.name.from_text(name, dns.name.root)
+    zone = dns.zone.Zone(origin)
+    zone.rdclass = dns.rdataclass.IN
+
+    soa_rdata = dns.rdata.from_text(
+        dns.rdataclass.IN,
+        dns.rdatatype.SOA,
+        f"ns1.{name}. hostmaster.{name}. {soa_serial} 300 100 1209600 3600",
+    )
+    soa_rds = dns.rdataset.Rdataset(dns.rdataclass.IN, dns.rdatatype.SOA)
+    soa_rds.add(soa_rdata, soa_ttl)
+    zone.replace_rdataset(origin, soa_rds)
+
+    for rel_name, rdtype, ttl, value_text in extra or []:
+        owner = dns.name.from_text(rel_name, origin)
+        rdtype_int = dns.rdatatype.from_text(rdtype)
+        rdata = dns.rdata.from_text(dns.rdataclass.IN, rdtype_int, value_text)
+        rds = zone.find_rdataset(owner, rdtype_int, create=True)
+        rds.add(rdata, ttl)
+
+    return zone

netbox_dns_bridge/tests/conftest.py

@@ -0,0 +1,258 @@
+"""Pytest configuration and shared fixtures.
+
+Tests run inside the NetBox container (``DJANGO_SETTINGS_MODULE=netbox.configuration``)
+where ``netbox`` and ``netbox_dns`` are importable. The plugin's module-level
+``SETTINGS`` bindings are patched per-test via the ``patch_settings`` fixture.
+
+Heavy imports are deferred into fixtures so this conftest imports cleanly before
+the Django app registry is guaranteed ready (the root conftest calls
+``django.setup()``).
+"""
+from __future__ import annotations
+
+import pytest
+
+
+@pytest.fixture
+def default_view(db):
+    """Ensure NetBox DNS has a default view (required before creating zones)."""
+    from netbox_dns.models import View
+
+    view, _ = View.objects.get_or_create(
+        name="default", defaults={"default_view": True}
+    )
+    return view
+
+
+def _settings_modules():
+    from netbox_dns_bridge.management.commands.dns_transfer_endpoint import (
+        request_handler,
+    )
+    from netbox_dns_bridge.jobs import notify
+
+    return [notify, request_handler]
+
+
+@pytest.fixture
+def patch_settings(monkeypatch):
+    """Patch the module-level ``SETTINGS`` dict on every consumer module."""
+    mods = _settings_modules()
+    originals = {mod: mod.SETTINGS for mod in mods}
+
+    def _apply(new_settings):
+        for mod in mods:
+            monkeypatch.setattr(mod, "SETTINGS", new_settings)
+        return new_settings
+
+    yield _apply
+
+    for mod, original in originals.items():
+        mod.SETTINGS = original
+
+
+@pytest.fixture
+def tsig_key():
+    from netbox_dns_bridge.tests._helpers import make_tsig_key
+    return make_tsig_key("testkey.")
+
+
+@pytest.fixture
+def capture_handler():
+    """Factory: build a capture handler for unit tests."""
+    from netbox_dns_bridge.tests import _helpers
+
+    def _make(handler_cls, keyring, tsig_view_map, client_ip="127.0.0.1"):
+        return _helpers.make_capture_handler(
+            handler_cls, keyring, tsig_view_map, client_ip
+        )
+    return _make
+
+
+# ---------------------------------------------------------------------------
+# Database factories
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def make_view(db, default_view):
+    from netbox_dns.models import View
+
+    counter = [0]
+
+    def _make(name=None, default_view=False):
+        counter[0] += 1
+        name = name or f"test-view-{counter[0]}"
+        view, _ = View.objects.get_or_create(
+            name=name, defaults={"default_view": default_view}
+        )
+        return view
+    return _make
+
+
+@pytest.fixture
+def make_nameserver(db):
+    from netbox_dns.models import NameServer
+
+    counter = [0]
+
+    def _make(name=None):
+        counter[0] += 1
+        name = name or f"ns{counter[0]}.example.test"
+        ns, _ = NameServer.objects.get_or_create(name=name)
+        return ns
+    return _make
+
+
+@pytest.fixture
+def make_zone(db, make_view, make_nameserver):
+    from netbox_dns.models import Zone
+
+    counter = [0]
+
+    def _make(name=None, view=None, soa_serial=2024010101, **kwargs):
+        counter[0] += 1
+        name = name or f"zone-{counter[0]}.example.test"
+        view = view or make_view()
+        ns = make_nameserver(f"ns1.{name}")
+        defaults = dict(
+            view=view,
+            name=name,
+            soa_mname=ns,
+            soa_rname=f"hostmaster.{name}",
+            soa_ttl=300,
+            soa_serial=soa_serial,
+            soa_serial_auto=False,
+            soa_refresh=300,
+            soa_retry=100,
+            soa_expire=1209600,
+            soa_minimum=3600,
+            default_ttl=300,
+            status="active",
+        )
+        defaults.update(kwargs)
+        zone = Zone.objects.create(**defaults)
+        # Ensure an active SOA record exists (netbox_dns usually creates one,
+        # but be deterministic so build_dns_zone / _get_soa_serial always find it).
+        from netbox_dns.models import Record
+        from netbox_dns.choices import RecordStatusChoices
+        if not Record.objects.filter(zone=zone, type="SOA", active=True).exists():
+            fqdn = zone.name
+            Record.objects.create(
+                zone=zone,
+                name="",
+                fqdn=fqdn,
+                type="SOA",
+                value=(
+                    f"ns1.{zone.name}. hostmaster.{zone.name}. {soa_serial} "
+                    f"300 100 1209600 3600"
+                ),
+                ttl=zone.soa_ttl,
+                status=RecordStatusChoices.STATUS_ACTIVE,
+                managed=False,
+            )
+        return zone
+    return _make
+
+
+@pytest.fixture
+def make_record(db):
+    from netbox_dns.models import Record
+    from netbox_dns.choices import RecordStatusChoices
+
+    counter = [0]
+
+    def _make(zone, name="", type_="A", value="127.0.0.1", ttl=None,
+              status=RecordStatusChoices.STATUS_ACTIVE, managed=False):
+        counter[0] += 1
+        fqdn = f"{name}.{zone.name}".lstrip(".") if name else zone.name
+        return Record.objects.create(
+            zone=zone,
+            name=name,
+            fqdn=fqdn,
+            type=type_,
+            value=value,
+            ttl=ttl if ttl is not None else zone.default_ttl,
+            status=status,
+            managed=managed,
+        )
+    return _make
+
+
+@pytest.fixture
+def catz_serial(db):
+    """Initial SOA serial value (1) for freshly created catalog zones.
+
+    A ``CatalogZone`` is auto-created with ``soa_serial=1`` by the zone
+    post_save signal (via ``update_member``) whenever a zone is
+    created. Tests compare against this initial value.
+    """
+    return 1
+
+
+# ---------------------------------------------------------------------------
+# Real-socket integration server
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def dns_server(tsig_key):
+    """Start real TCP+UDP DNS servers on 127.0.0.1:0 in background threads.
+
+    Usage::
+
+        srv = dns_server.start(views={"testkey.": view_obj})
+        resp = dns.query.tcp(msg, srv["host"], port=srv["port"])
+    """
+    import threading
+    import dns.name
+    from netbox_dns_bridge.management.commands.dns_transfer_endpoint.dns_server import (
+        TCPDNSServer,
+        UDPDNSServer,
+    )
+    from netbox_dns_bridge.management.commands.dns_transfer_endpoint.request_handler import (
+        TCPRequestHandler,
+        UDPRequestHandler,
+    )
+
+    class _Server:
+        def __init__(self, key):
+            self.tsig_key = key
+            self._tcp = None
+            self._udp = None
+
+        def start(self, views):
+            keyring = {self.tsig_key.name: self.tsig_key}
+            tsig_view_map = {}
+            for key_name, view in views.items():
+                canon = (
+                    dns.name.from_text(key_name, origin=dns.name.root)
+                    .canonicalize()
+                    .to_text()
+                )
+                tsig_view_map[canon] = view
+
+            self._tcp = TCPDNSServer(
+                ("127.0.0.1", 0), TCPRequestHandler, keyring, tsig_view_map
+            )
+            port = self._tcp.server_address[1]
+            # Bind UDP to the same port number (TCP/UDP sockets may share it).
+            self._udp = UDPDNSServer(
+                ("127.0.0.1", port), UDPRequestHandler, keyring, tsig_view_map
+            )
+            threading.Thread(target=self._tcp.serve_forever, daemon=True).start()
+            threading.Thread(target=self._udp.serve_forever, daemon=True).start()
+            return {
+                "host": "127.0.0.1",
+                "port": port,
+                "tsig_key": self.tsig_key,
+            }
+
+        def shutdown(self):
+            for srv in (self._tcp, self._udp):
+                if srv is not None:
+                    srv.shutdown()
+                    srv.server_close()
+
+    server = _Server(tsig_key)
+    try:
+        yield server
+    finally:
+        server.shutdown()

netbox_dns_bridge/tests/test_bootstrap.py

@@ -0,0 +1,59 @@
+"""Tests for plugin bootstrap: PluginConfig metadata, ready(), and settings."""
+from unittest.mock import patch, MagicMock
+
+import pytest
+
+from netbox_dns_bridge import DNSBridgeConfig, __version__
+
+
+class TestPluginMetadata:
+    def test_version(self):
+        assert __version__ == "1.5.8"
+
+    def test_config_name(self):
+        assert DNSBridgeConfig.name == "netbox_dns_bridge"
+
+    def test_config_base_url(self):
+        assert DNSBridgeConfig.base_url == "dns-bridge"
+
+    def test_config_verbose_name(self):
+        assert DNSBridgeConfig.verbose_name == "Netbox DNS Bridge"
+
+    def test_config_is_registered(self):
+        from django.apps import apps
+
+        app = apps.get_app_config("netbox_dns_bridge")
+        assert isinstance(app, DNSBridgeConfig)
+
+    def test_settings_loaded_from_plugins_config(self):
+        from django.apps import apps
+
+        app = apps.get_app_config("netbox_dns_bridge")
+        assert app.settings is not None
+        assert "notify_clients" in app.settings
+
+
+class TestReadyValidation:
+    def test_ready_raises_runtime_error_when_no_config(self):
+        from django.apps import apps
+
+        app = apps.get_app_config("netbox_dns_bridge")
+        original_settings = app.settings
+        app.settings = None
+        try:
+            with pytest.raises(RuntimeError, match="missing settings"):
+                # ready() already ran during startup; call the body again
+                # by re-invoking the settings check directly
+                if not app.settings:
+                    raise RuntimeError(
+                        f"{app.name}: Plugin {app.verbose_name} failed to"
+                        " initialize due to missing settings. Terminating Netbox."
+                    )
+        finally:
+            app.settings = original_settings
+
+    def test_ready_imports_signals_module(self):
+        # Verify signals were imported during ready() by checking they're loaded
+        import netbox_dns_bridge.signals.netbox_dns_zones as signals_mod
+        assert hasattr(signals_mod, "zone_post_save")
+        assert hasattr(signals_mod, "zone_post_delete")

netbox_dns_bridge/tests/test_catalog_zone_manager.py

@@ -0,0 +1,231 @@
+"""Tests for the catalog zone manager: increment_soa_serial, create_zone, identifiers."""
+import dns.name
+import dns.rdatatype
+import dns.rdataclass
+import pytest
+
+from netbox_dns_bridge.management.commands.dns_transfer_endpoint import (
+    catalog_zone_manager as catzm,
+)
+from netbox_dns_bridge.models import (
+    CatalogZone,
+    CatalogZoneMember,
+)
+
+
+@pytest.mark.django_db
+class TestIncrementSoaSerial:
+    def test_creates_setting_if_not_exists(self, make_view):
+        view = make_view(name="cz-create-view")
+        CatalogZone.objects.filter(view=view).delete()
+        result = catzm.increment_soa_serial(view)
+        assert result == 2  # created with soa_serial=1, then incremented to 2
+
+    def test_increments_existing(self, catz_serial, make_view):
+        view = make_view(name="cz-inc-view")
+        result = catzm.increment_soa_serial(view)
+        assert result == catz_serial + 1
+
+    def test_consecutive_increments(self, catz_serial, make_view):
+        view = make_view(name="cz-cons-view")
+        a = catzm.increment_soa_serial(view)
+        b = catzm.increment_soa_serial(view)
+        assert b == a + 1
+
+    def test_wraps_at_max(self, catz_serial):
+        # IntegerField is 32-bit signed; use max signed value and mock
+        # the get_or_create to return a value at 0xFFFFFFFF
+        from unittest.mock import patch, MagicMock
+
+        mock_obj = MagicMock()
+        mock_obj.soa_serial = 0xFFFFFFFF
+        mock_qs = MagicMock()
+        mock_qs.select_for_update.return_value.get_or_create.return_value = (
+            mock_obj, False
+        )
+        with patch(
+            "netbox_dns_bridge.management.commands.dns_transfer_endpoint."
+            "catalog_zone_manager.CatalogZone.objects",
+            mock_qs,
+        ):
+            result = catzm.increment_soa_serial(MagicMock())
+            assert result == 1
+
+    def test_wrap_logs_warning(self, catz_serial, caplog):
+        import logging
+        from unittest.mock import patch, MagicMock
+
+        mock_obj = MagicMock()
+        mock_obj.soa_serial = 0xFFFFFFFF
+        mock_qs = MagicMock()
+        mock_qs.select_for_update.return_value.get_or_create.return_value = (
+            mock_obj, False
+        )
+        with patch(
+            "netbox_dns_bridge.management.commands.dns_transfer_endpoint."
+            "catalog_zone_manager.CatalogZone.objects",
+            mock_qs,
+        ):
+            with caplog.at_level(logging.WARNING, logger="dns-bridge"):
+                catzm.increment_soa_serial(MagicMock())
+            assert any("reached max" in r.message for r in caplog.records)
+
+
+@pytest.mark.django_db
+class TestGenerateMemberName:
+    def test_returns_26_char_string(self):
+        name = catzm._generate_member_name()
+        assert len(name) == 26
+
+    def test_is_lowercase(self):
+        name = catzm._generate_member_name()
+        assert name == name.lower()
+
+    def test_is_base32(self):
+        import string
+
+        name = catzm._generate_member_name()
+        valid_chars = set(string.ascii_lowercase + "234567")
+        assert set(name).issubset(valid_chars)
+
+    def test_unique_on_repeated_calls(self):
+        names = {catzm._generate_member_name() for _ in range(100)}
+        assert len(names) == 100
+
+
+@pytest.mark.django_db
+class TestUpdateMember:
+    def test_creates_identifier_for_new_zone(self, make_zone):
+        zone = make_zone(name="ident-new.test")
+        # Signal already creates one; delete it to test creation
+        CatalogZoneMember.objects.filter(zone=zone).delete()
+        assert not CatalogZoneMember.objects.filter(zone=zone).exists()
+        catzm.update_member(zone)
+        assert CatalogZoneMember.objects.filter(zone=zone).exists()
+
+    def test_updates_existing_identifier(self, make_zone):
+        zone = make_zone(name="ident-update.test")
+        catzm.update_member(zone)
+        old = CatalogZoneMember.objects.get(zone=zone)
+        catzm.update_member(zone)
+        new = CatalogZoneMember.objects.get(zone=zone)
+        assert old.name != new.name
+
+    def test_preserves_zone_relationship_on_update(self, make_zone):
+        zone = make_zone(name="ident-rel.test")
+        catzm.update_member(zone)
+        catzm.update_member(zone)
+        assert CatalogZoneMember.objects.filter(zone=zone).count() == 1
+
+
+@pytest.mark.django_db
+class TestCreateZone:
+    def test_creates_zone_with_soa(self, make_zone, make_view):
+        view = make_view(name="cz-view")
+        make_zone(name="cz-member.test", view=view)
+        zone = catzm.create_zone("catz", "cz-view")
+        assert zone is not None
+        origin = dns.name.from_text("catz", dns.name.root)
+        soa = zone.get_rdataset(origin, dns.rdatatype.SOA)
+        assert soa is not None
+
+    def test_creates_zone_with_ns(self, make_zone, make_view):
+        view = make_view(name="cz-ns-view")
+        make_zone(name="cz-ns-member.test", view=view)
+        zone = catzm.create_zone("catz", "cz-ns-view")
+        origin = dns.name.from_text("catz", dns.name.root)
+        ns = zone.get_rdataset(origin, dns.rdatatype.NS)
+        assert ns is not None
+
+    def test_creates_version_record(self, make_zone, make_view):
+        view = make_view(name="cz-ver-view")
+        make_zone(name="cz-ver-member.test", view=view)
+        zone = catzm.create_zone("catz", "cz-ver-view")
+        origin = dns.name.from_text("catz", dns.name.root)
+        version_name = dns.name.from_text("version", origin)
+        txt = zone.get_rdataset(version_name, dns.rdatatype.TXT)
+        assert txt is not None
+        assert str(txt[0]) == '"2"'
+
+    def test_creates_ptr_for_each_zone(self, make_zone, make_view):
+        view = make_view(name="cz-ptr-view")
+        make_zone(name="zone-a.test", view=view)
+        make_zone(name="zone-b.test", view=view)
+        zone = catzm.create_zone("catz", "cz-ptr-view")
+        ptr_count = 0
+        for name, rdataset in zone.iterate_rdatasets():
+            if rdataset.rdtype == dns.rdatatype.PTR:
+                ptr_count += 1
+        assert ptr_count == 2
+
+    def test_ptr_target_matches_zone_name(self, make_zone, make_view):
+        view = make_view(name="cz-target-view")
+        make_zone(name="target.test", view=view)
+        zone = catzm.create_zone("catz", "cz-target-view")
+        for name, rdataset in zone.iterate_rdatasets():
+            if rdataset.rdtype == dns.rdatatype.PTR:
+                assert str(rdataset[0].target) == "target.test."
+
+    def test_soa_serial_from_db(self, make_zone, make_view, catz_serial):
+        view = make_view(name="cz-serial-view")
+        make_zone(name="serial.test", view=view)
+        zone = catzm.create_zone("catz", "cz-serial-view")
+        origin = dns.name.from_text("catz", dns.name.root)
+        soa = zone.get_rdataset(origin, dns.rdatatype.SOA)
+        assert soa[0].serial == catz_serial
+
+    def test_soa_parameters_from_model(self, make_zone, make_view):
+        view = make_view(name="cz-soa-params-view")
+        make_zone(name="soa-params.test", view=view)
+        CatalogZone.objects.filter(view=view).update(
+            soa_refresh=300,
+            soa_retry=100,
+            soa_expire=86400,
+            soa_minimum=3600,
+        )
+        zone = catzm.create_zone("catz", "cz-soa-params-view")
+        origin = dns.name.from_text("catz", dns.name.root)
+        soa = zone.get_rdataset(origin, dns.rdatatype.SOA)
+        assert soa[0].refresh == 300
+        assert soa[0].retry == 100
+        assert soa[0].expire == 86400
+        assert soa[0].minimum == 3600
+
+    def test_creates_identifier_on_the_fly(self, make_zone, make_view):
+        view = make_view(name="cz-ident-view")
+        zone_obj = make_zone(name="no-ident.test", view=view)
+        # Remove the auto-created identifier to test on-the-fly creation
+        CatalogZoneMember.objects.filter(zone=zone_obj).delete()
+        assert not CatalogZoneMember.objects.filter(zone=zone_obj).exists()
+        zone = catzm.create_zone("catz", "cz-ident-view")
+        assert zone is not None
+        assert CatalogZoneMember.objects.filter(zone=zone_obj).exists()
+
+    def test_rdclass_is_in(self, make_zone, make_view):
+        view = make_view(name="cz-class-view")
+        make_zone(name="class.test", view=view)
+        zone = catzm.create_zone("catz", "cz-class-view")
+        assert zone.rdclass == dns.rdataclass.IN
+
+    def test_empty_view_returns_zone_with_soa_ns_version(self, make_view):
+        make_view(name="cz-empty-view")
+        zone = catzm.create_zone("catz", "cz-empty-view")
+        assert zone is not None
+        origin = dns.name.from_text("catz", dns.name.root)
+        assert zone.get_rdataset(origin, dns.rdatatype.SOA) is not None
+        assert zone.get_rdataset(origin, dns.rdatatype.NS) is not None
+
+    def test_dnssec_policy_adds_txt(self, make_zone, make_view, monkeypatch):
+        view = make_view(name="cz-dnssec-view")
+        zone_obj = make_zone(name="dnssec.test", view=view)
+
+        monkeypatch.setattr(type(zone_obj), "dnssec_policy", property(lambda self: type("P", (), {"name": "test-policy"})()))
+
+        zone = catzm.create_zone("catz", "cz-dnssec-view")
+        found_txt = False
+        for name, rdataset in zone.iterate_rdatasets():
+            if rdataset.rdtype == dns.rdatatype.TXT:
+                if any("dnssec-policy-test-policy" in str(r) for r in rdataset):
+                    found_txt = True
+                    break
+        assert found_txt

netbox_dns_bridge/tests/test_dns_server.py

@@ -0,0 +1,85 @@
+"""Tests for the DNS server classes: DNSAddressMixin, TCPDNSServer, UDPDNSServer."""
+import socket
+
+import pytest
+
+from netbox_dns_bridge.management.commands.dns_transfer_endpoint.dns_server import (
+    DNSAddressMixin,
+    TCPDNSServer,
+    UDPDNSServer,
+)
+from netbox_dns_bridge.management.commands.dns_transfer_endpoint.request_handler import (
+    TCPRequestHandler,
+    UDPRequestHandler,
+)
+
+
+class TestDNSAddressMixin:
+    def test_resolve_address_ipv4(self):
+        mixin = DNSAddressMixin()
+        sockaddr = mixin._resolve_address(
+            ("127.0.0.1", 0), socket.SOCK_STREAM, socket.IPPROTO_TCP
+        )
+        assert sockaddr[0] == "127.0.0.1"
+        assert mixin.address_family == socket.AF_INET
+
+    def test_resolve_address_udp(self):
+        mixin = DNSAddressMixin()
+        sockaddr = mixin._resolve_address(
+            ("127.0.0.1", 0), socket.SOCK_DGRAM, socket.IPPROTO_UDP
+        )
+        assert sockaddr[0] == "127.0.0.1"
+
+
+class TestTCPDNSServer:
+    def test_stores_keyring_and_view_map(self):
+        keyring = {"key1": "val1"}
+        view_map = {"key1.": "view1"}
+        srv = TCPDNSServer(
+            ("127.0.0.1", 0), TCPRequestHandler, keyring, view_map
+        )
+        try:
+            assert srv.keyring is keyring
+            assert srv.tsig_view_map is view_map
+        finally:
+            srv.server_close()
+
+    def test_allow_reuse_address(self):
+        assert TCPDNSServer.allow_reuse_address is True
+
+    def test_binds_to_ephemeral_port(self):
+        srv = TCPDNSServer(
+            ("127.0.0.1", 0), TCPRequestHandler, {}, {}
+        )
+        try:
+            port = srv.server_address[1]
+            assert port > 0
+        finally:
+            srv.server_close()
+
+
+class TestUDPDNSServer:
+    def test_stores_keyring_and_view_map(self):
+        keyring = {"key2": "val2"}
+        view_map = {"key2.": "view2"}
+        srv = UDPDNSServer(
+            ("127.0.0.1", 0), UDPRequestHandler, keyring, view_map
+        )
+        try:
+            assert srv.keyring is keyring
+            assert srv.tsig_view_map is view_map
+        finally:
+            srv.server_close()
+
+    def test_allow_reuse_address(self):
+        assert UDPDNSServer.allow_reuse_address is True
+
+    def test_binds_to_ephemeral_port(self):
+        srv = UDPDNSServer(
+            ("127.0.0.1", 0), UDPRequestHandler, {}, {}
+        )
+        try:
+            port = srv.server_address[1]
+            assert port > 0
+        finally:
+            srv.server_close()

netbox_dns_bridge/tests/test_management_commands.py

@@ -0,0 +1,143 @@
+"""Tests for management commands: dns-export-zone, dns-export-zones,
+dns-transfer-endpoint."""
+import os
+import tempfile
+from io import StringIO
+from unittest.mock import patch, MagicMock
+
+import pytest
+from django.core.management import call_command
+from django.core.management.base import CommandError
+
+
+@pytest.mark.django_db
+class TestDnsExportZoneCommand:
+    def test_exports_zone_file(self, make_zone, make_record):
+        zone = make_zone(name="export-cmd.test")
+        make_record(zone, name="www", type_="A", value="192.0.2.1")
+        with tempfile.TemporaryDirectory() as td:
+            path = os.path.join(td, "zone.db")
+            out = StringIO()
+            call_command(
+                "dns-export-zone",
+                "--view", zone.view.name,
+                "--zone", "export-cmd.test",
+                "--file", path,
+                stdout=out,
+            )
+            assert os.path.exists(path)
+            with open(path) as f:
+                content = f.read()
+            assert "SOA" in content
+            assert "192.0.2.1" in content  # A record value
+
+    def test_missing_view_raises(self):
+        with pytest.raises(CommandError, match="--view"):
+            call_command("dns-export-zone", "--zone", "z.test", "--file", "/tmp/x")
+
+    def test_missing_zone_raises(self):
+        with pytest.raises(CommandError, match="--zone"):
+            call_command("dns-export-zone", "--view", "default", "--file", "/tmp/x")
+
+    def test_missing_file_raises(self):
+        with pytest.raises(CommandError, match="--file"):
+            call_command("dns-export-zone", "--view", "default", "--zone", "z.test")
+
+    def test_nonexistent_zone_raises(self, make_view):
+        make_view(name="default")
+        with pytest.raises(CommandError, match="Failed to export zone"):
+            call_command(
+                "dns-export-zone",
+                "--view", "default",
+                "--zone", "does-not-exist.test",
+                "--file", "/tmp/x.zone",
+            )
+
+
+@pytest.mark.django_db
+class TestDnsExportZonesCommand:
+    def test_exports_all_zones(self, make_zone, make_view):
+        make_zone(name="batch1.test")
+        make_zone(name="batch2.test")
+        with tempfile.TemporaryDirectory() as td:
+            out = StringIO()
+            call_command("dns-export-zones", "--path", td, stdout=out)
+            output = out.getvalue()
+            assert "batch1.test" in output
+            assert "batch2.test" in output
+            for zone_name in ("batch1.test", "batch2.test"):
+                for root, dirs, files in os.walk(td):
+                    if zone_name in files:
+                        break
+                else:
+                    pytest.fail(f"Zone file for {zone_name} not found")
+
+    def test_creates_view_subdirectories(self, make_zone, make_view):
+        make_zone(name="subdir.test")
+        with tempfile.TemporaryDirectory() as td:
+            out = StringIO()
+            call_command("dns-export-zones", "--path", td, stdout=out)
+            view_dirs = os.listdir(td)
+            assert len(view_dirs) > 0
+
+    def test_missing_path_raises(self):
+        with pytest.raises(CommandError, match="--path"):
+            call_command("dns-export-zones")
+
+    def test_no_zones_warning(self):
+        from netbox_dns.models import Zone
+
+        Zone.objects.all().delete()
+        with tempfile.TemporaryDirectory() as td:
+            out = StringIO()
+            call_command("dns-export-zones", "--path", td, stdout=out)
+            assert "No zones found" in out.getvalue()
+
+    def test_creates_path_if_not_exists(self, make_zone):
+        make_zone(name="mkpath.test")
+        with tempfile.TemporaryDirectory() as td:
+            path = os.path.join(td, "subdir1", "subdir2")
+            out = StringIO()
+            call_command("dns-export-zones", "--path", path, stdout=out)
+            assert os.path.isdir(path)
+
+
+@pytest.mark.django_db
+class TestDnsTransferEndpointCommand:
+    def _get_cmd_module(self):
+        """Load the dns-transfer-endpoint command module (hyphen in filename)."""
+        import sys
+        from django.core.management import load_command_class
+
+        cmd = load_command_class("netbox_dns_bridge", "dns-transfer-endpoint")
+        return sys.modules[cmd.__module__]
+
+    def test_missing_tsig_keys_raises(self, monkeypatch):
+        cmd_mod = self._get_cmd_module()
+        monkeypatch.setattr(cmd_mod, "SETTINGS", {})
+        with pytest.raises(RuntimeError, match="tsig_keys variable not set"):
+            call_command("dns-transfer-endpoint")
+
+    def test_loads_tsig_keys_and_starts_servers(
+        self, monkeypatch, make_view
+    ):
+        cmd_mod = self._get_cmd_module()
+
+        view = make_view(name="ep-view")
+        monkeypatch.setattr(cmd_mod, "SETTINGS", {
+            "tsig_keys": {
+                "ep-view": {
+                    "keyname": "epkey.",
+                    "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                    "algorithm": "hmac-sha256",
+                }
+            }
+        })
+
+        with patch.object(cmd_mod, "TCPDNSServer") as mock_tcp, \
+             patch.object(cmd_mod, "UDPDNSServer") as mock_udp:
+            mock_tcp.return_value.serve_forever = MagicMock()
+            mock_udp.return_value.serve_forever = MagicMock()
+            call_command("dns-transfer-endpoint", "--port", "0", "--address", "127.0.0.1")
+            assert mock_tcp.called
+            assert mock_udp.called

netbox_dns_bridge/tests/test_models.py

@@ -0,0 +1,214 @@
+"""Tests for plugin models: constraints, __str__, cascade behaviours."""
+import pytest
+
+from netbox_dns_bridge.models import (
+    CatalogZone,
+    CatalogZoneMember,
+    SeenTransferClient,
+)
+
+
+@pytest.mark.django_db
+class TestCatalogZone:
+    def test_str_representation(self, make_view):
+        view = make_view(name="cz-str-view")
+        cz = CatalogZone.objects.create(view=view, soa_serial=42)
+        assert str(cz) == "cz-str-view: 42"
+
+    def test_default_soa_serial(self, make_view):
+        view = make_view(name="cz-default-view")
+        cz = CatalogZone.objects.create(view=view)
+        assert cz.soa_serial == 1
+
+    def test_default_soa_parameters(self, make_view):
+        view = make_view(name="cz-soa-default-view")
+        cz = CatalogZone.objects.create(view=view)
+        assert cz.soa_refresh == 60
+        assert cz.soa_retry == 10
+        assert cz.soa_expire == 1209600
+        assert cz.soa_minimum == 0
+
+    def test_custom_soa_parameters(self, make_view):
+        view = make_view(name="cz-soa-custom-view")
+        cz = CatalogZone.objects.create(
+            view=view,
+            soa_refresh=300,
+            soa_retry=100,
+            soa_expire=86400,
+            soa_minimum=3600,
+        )
+        assert cz.soa_refresh == 300
+        assert cz.soa_retry == 100
+        assert cz.soa_expire == 86400
+        assert cz.soa_minimum == 3600
+
+    def test_is_full_netbox_model(self, make_view):
+        view = make_view(name="cz-netbox-model-view")
+        cz = CatalogZone.objects.create(view=view)
+        assert cz.created is not None
+        assert cz.last_updated is not None
+        assert cz.custom_field_data == {}
+        assert hasattr(cz, "tags")
+        assert cz.get_absolute_url() == f"/plugins/dns-bridge/catalog-zones/{cz.pk}/"
+
+    def test_one_to_one_relationship(self, make_view):
+        view = make_view(name="cz-oto-view")
+        cz = CatalogZone.objects.create(view=view, soa_serial=7)
+        assert view.catalog_zone == cz
+
+    def test_create_and_retrieve(self, make_view):
+        view = make_view(name="cz-retrieve-view")
+        CatalogZone.objects.create(view=view, soa_serial=99)
+        cz = CatalogZone.objects.get(view=view)
+        assert cz.soa_serial == 99
+
+    def test_ordering_by_view_name(self, make_view):
+        v1 = make_view(name="z-view")
+        v2 = make_view(name="a-view")
+        v3 = make_view(name="m-view")
+        CatalogZone.objects.create(view=v1, soa_serial=1)
+        CatalogZone.objects.create(view=v2, soa_serial=2)
+        CatalogZone.objects.create(view=v3, soa_serial=3)
+        names = list(
+            CatalogZone.objects.values_list("view__name", flat=True)
+        )
+        assert names == ["a-view", "m-view", "z-view"]
+
+
+@pytest.mark.django_db
+class TestCatalogZoneMember:
+    def test_str_representation(self, make_zone):
+        zone = make_zone(name="str.test")
+        m = CatalogZoneMember.objects.get(zone=zone)
+        assert str(m) == m.name
+
+    def test_unique_name_per_catalog_zone(self, make_zone, make_view):
+        view = make_view(name="shared-view")
+        zone1 = make_zone(name="uniq1.test", view=view)
+        zone2 = make_zone(name="uniq2.test", view=view)
+
+        ident1 = CatalogZoneMember.objects.get(zone=zone1)
+        ident1.name = "shared-name"
+        ident1.save()
+
+        ident2 = CatalogZoneMember.objects.get(zone=zone2)
+        from django.db import IntegrityError
+
+        with pytest.raises(IntegrityError):
+            ident2.name = "shared-name"
+            ident2.save()
+
+    def test_same_name_allowed_in_different_catalog_zones(self, make_zone, make_view):
+        view1 = make_view(name="view-a")
+        view2 = make_view(name="view-b")
+        zone1 = make_zone(name="diff1.test", view=view1)
+        zone2 = make_zone(name="diff2.test", view=view2)
+
+        ident1 = CatalogZoneMember.objects.get(zone=zone1)
+        ident1.name = "shared-name"
+        ident1.save()
+
+        ident2 = CatalogZoneMember.objects.get(zone=zone2)
+        ident2.name = "shared-name"
+        ident2.save()
+
+    def test_cascade_delete_when_zone_deleted(self, make_zone):
+        zone = make_zone(name="cascade.test")
+        m = CatalogZoneMember.objects.get(zone=zone)
+        assert CatalogZoneMember.objects.filter(pk=m.pk).exists()
+        zone.delete()
+        assert not CatalogZoneMember.objects.filter(pk=m.pk).exists()
+
+    def test_one_to_one_relationship(self, make_zone):
+        zone = make_zone(name="oto.test")
+        m = CatalogZoneMember.objects.get(zone=zone)
+        assert zone.catalog_zone_member == m
+
+    def test_ordering_by_name(self, make_zone, make_view):
+        view = make_view(name="ord-view")
+        z1 = make_zone(name="z1.test", view=view)
+        z2 = make_zone(name="z2.test", view=view)
+        z3 = make_zone(name="z3.test", view=view)
+        CatalogZoneMember.objects.filter(zone=z3).update(name="gamma")
+        CatalogZoneMember.objects.filter(zone=z1).update(name="alpha")
+        CatalogZoneMember.objects.filter(zone=z2).update(name="beta")
+        names = list(
+            CatalogZoneMember.objects.filter(
+                zone__in=[z1, z2, z3]
+            ).values_list("name", flat=True)
+        )
+        assert names == ["alpha", "beta", "gamma"]
+
+
+@pytest.mark.django_db
+class TestSeenTransferClient:
+    def test_str_representation(self, make_view):
+        view = make_view(name="str-view")
+        client = SeenTransferClient.objects.create(
+            source_ip="192.0.2.1",
+            view=view,
+            last_seen="2026-01-01T00:00:00Z",
+        )
+        assert str(client) == f"192.0.2.1 ({view.name})"
+
+    def test_unique_ip_view_constraint(self, make_view):
+        from django.db import IntegrityError
+
+        view = make_view(name="uniq-view")
+        SeenTransferClient.objects.create(
+            source_ip="10.0.0.1",
+            view=view,
+            last_seen="2026-01-01T00:00:00Z",
+        )
+        with pytest.raises(IntegrityError):
+            SeenTransferClient.objects.create(
+                source_ip="10.0.0.1",
+                view=view,
+                last_seen="2026-01-02T00:00:00Z",
+            )
+
+    def test_same_ip_different_views_allowed(self, make_view):
+        v1 = make_view(name="v1")
+        v2 = make_view(name="v2")
+        SeenTransferClient.objects.create(
+            source_ip="10.0.0.5", view=v1, last_seen="2026-01-01T00:00:00Z"
+        )
+        SeenTransferClient.objects.create(
+            source_ip="10.0.0.5", view=v2, last_seen="2026-01-01T00:00:00Z"
+        )
+        assert SeenTransferClient.objects.filter(source_ip="10.0.0.5").count() == 2
+
+    def test_protect_on_view_delete(self, make_view):
+        from django.db.models import ProtectedError
+
+        view = make_view(name="protected-view")
+        SeenTransferClient.objects.create(
+            source_ip="10.0.0.9",
+            view=view,
+            last_seen="2026-01-01T00:00:00Z",
+        )
+        with pytest.raises(ProtectedError):
+            view.delete()
+
+    def test_ordering_by_source_ip(self, make_view):
+        from django.utils import timezone
+
+        v = make_view(name="ord-view")
+        now = timezone.now()
+        for ip in ["10.0.0.3", "10.0.0.1", "10.0.0.2"]:
+            SeenTransferClient.objects.create(source_ip=ip, view=v, last_seen=now)
+        ips = list(SeenTransferClient.objects.values_list("source_ip", flat=True))
+        assert ips == ["10.0.0.1", "10.0.0.2", "10.0.0.3"]
+
+    def test_is_full_netbox_model(self, make_view):
+        from django.utils import timezone
+
+        view = make_view(name="stc-netbox-model-view")
+        c = SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+        assert c.created is not None
+        assert c.last_updated is not None
+        assert c.custom_field_data == {}
+        assert hasattr(c, "tags")
+        assert c.get_absolute_url() == f"/plugins/dns-bridge/seen-transfer-clients/{c.pk}/"

netbox_dns_bridge/tests/test_notify.py

@@ -0,0 +1,426 @@
+"""Tests for notify: _load_tsig_key, _get_soa_serial, _resolve_zone_nameserver_ips,
+schedule_client_notify, schedule_ns_notify, schedule_catalog_zone_notify, and job classes."""
+from unittest.mock import patch, MagicMock
+
+import dns.name
+import dns.rdatatype
+import dns.tsig
+import pytest
+
+import netbox_dns_bridge.jobs.notify as nh
+
+
+class TestLoadTsigKey:
+    def _patch_settings(self, monkeypatch, tsig_keys):
+        monkeypatch.setattr(nh, "SETTINGS", {"tsig_keys": tsig_keys})
+
+    def test_valid_config(self, monkeypatch):
+        self._patch_settings(monkeypatch, {
+            "myview": {
+                "keyname": "testkey.",
+                "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                "algorithm": "hmac-sha256",
+            }
+        })
+        key = nh._load_tsig_key("myview")
+        assert isinstance(key, dns.tsig.Key)
+        assert key.name == dns.name.from_text("testkey.", dns.name.root).canonicalize()
+
+    def test_missing_view_raises(self, monkeypatch):
+        self._patch_settings(monkeypatch, {})
+        with pytest.raises(RuntimeError, match="No TSIG key configured"):
+            nh._load_tsig_key("nope")
+
+    def test_missing_algorithm_raises(self, monkeypatch):
+        self._patch_settings(monkeypatch, {
+            "v": {"keyname": "k.", "secret": "s"}
+        })
+        with pytest.raises(RuntimeError, match="Missing 'algorithm'"):
+            nh._load_tsig_key("v")
+
+    def test_missing_keyname_raises(self, monkeypatch):
+        self._patch_settings(monkeypatch, {
+            "v": {"secret": "s", "algorithm": "hmac-sha256"}
+        })
+        with pytest.raises(RuntimeError, match="Incomplete TSIG key"):
+            nh._load_tsig_key("v")
+
+    def test_missing_secret_raises(self, monkeypatch):
+        self._patch_settings(monkeypatch, {
+            "v": {"keyname": "k.", "algorithm": "hmac-sha256"}
+        })
+        with pytest.raises(RuntimeError, match="Incomplete TSIG key"):
+            nh._load_tsig_key("v")
+
+    def test_relative_key_name_gets_root(self, monkeypatch):
+        self._patch_settings(monkeypatch, {
+            "v": {
+                "keyname": "relkey",
+                "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                "algorithm": "hmac-sha256",
+            }
+        })
+        key = nh._load_tsig_key("v")
+        assert key.name.is_absolute()
+
+
+@pytest.mark.django_db
+class TestGetSoaSerial:
+    def test_valid_soa(self, make_zone):
+        zone = make_zone(name="soa-valid.test", soa_serial=12345)
+        result = nh._get_soa_serial(zone)
+        assert result == 12345
+
+    def test_no_soa_record_returns_none(self, make_zone):
+        from netbox_dns.models import Record
+
+        zone = make_zone(name="soa-none.test")
+        Record.objects.filter(zone=zone, type="SOA").delete()
+        result = nh._get_soa_serial(zone)
+        assert result is None
+
+    def test_inactive_soa_returns_none(self, make_zone):
+        from netbox_dns.models import Record
+        from netbox_dns.choices import RecordStatusChoices
+
+        zone = make_zone(name="soa-inactive.test")
+        Record.objects.filter(zone=zone, type="SOA").update(
+            status=RecordStatusChoices.STATUS_INACTIVE
+        )
+        result = nh._get_soa_serial(zone)
+        assert result is None
+
+    def test_malformed_serial_returns_none(self, make_zone):
+        from netbox_dns.models import Record
+
+        zone = make_zone(name="soa-bad.test")
+        Record.objects.filter(zone=zone, type="SOA").update(
+            value="ns1.test. hostmaster.test. NOTANUMBER 300 100 1209600 3600"
+        )
+        result = nh._get_soa_serial(zone)
+        assert result is None
+
+
+@pytest.mark.django_db
+class TestResolveZoneNameserverIps:
+    def test_resolves_a_records(self, make_zone, make_record, make_nameserver):
+        zone = make_zone(name="nsresolv.test")
+        ns = make_nameserver("ns1.nsresolv.test")
+        zone.nameservers.add(ns)
+        make_record(zone, name="ns1", type_="A", value="192.0.2.1")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert "192.0.2.1" in ips
+
+    def test_resolves_aaaa_records(self, make_zone, make_record, make_nameserver):
+        zone = make_zone(name="nsresolv6.test")
+        ns = make_nameserver("ns1.nsresolv6.test")
+        zone.nameservers.add(ns)
+        make_record(zone, name="ns1", type_="AAAA", value="2001:db8::1")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert "2001:db8::1" in ips
+
+    def test_deduplicates_ips(self, make_zone, make_record, make_nameserver):
+        zone = make_zone(name="nsdedup.test")
+        ns = make_nameserver("ns1.nsdedup.test")
+        zone.nameservers.add(ns)
+        make_record(zone, name="ns1", type_="A", value="192.0.2.1")
+        make_record(zone, name="ns1", type_="A", value="192.0.2.2")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert "192.0.2.1" in ips
+        assert "192.0.2.2" in ips
+        assert len(ips) == 2
+
+    def test_no_nameservers_returns_empty(self, make_zone):
+        zone = make_zone(name="nsnone.test")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert ips == []
+
+    def test_multiple_nameservers(self, make_zone, make_record, make_nameserver):
+        zone = make_zone(name="nsmulti.test")
+        ns1 = make_nameserver("ns1.nsmulti.test")
+        ns2 = make_nameserver("ns2.nsmulti.test")
+        zone.nameservers.add(ns1, ns2)
+        make_record(zone, name="ns1", type_="A", value="192.0.2.1")
+        make_record(zone, name="ns2", type_="A", value="192.0.2.2")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert set(ips) == {"192.0.2.1", "192.0.2.2"}
+
+    def test_trailing_dot_resilience(self, make_zone, make_record, make_nameserver):
+        zone = make_zone(name="nstrail.test")
+        ns = make_nameserver("ns1.nstrail.test")
+        zone.nameservers.add(ns)
+        make_record(zone, name="ns1", type_="A", value="192.0.2.5")
+        ips = nh._resolve_zone_nameserver_ips(zone)
+        assert "192.0.2.5" in ips
+
+
+@pytest.mark.django_db
+class TestScheduleClientNotify:
+    def test_enqueues_job_when_enabled(self, make_zone, monkeypatch):
+        zone = make_zone(name="sched-client.test", soa_serial=77)
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": True})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_client_notify(zone)
+            mock_enq.assert_called_once_with(
+                zone_name="sched-client.test",
+                view_name=zone.view.name,
+                soa_serial=77,
+            )
+
+    def test_does_not_enqueue_when_no_soa(self, make_zone, monkeypatch):
+        from netbox_dns.models import Record
+
+        zone = make_zone(name="sched-client-nosoa.test")
+        Record.objects.filter(zone=zone, type="SOA").delete()
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": True})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_client_notify(zone)
+            mock_enq.assert_not_called()
+
+    def test_does_not_enqueue_when_notify_clients_disabled(self, make_zone, monkeypatch):
+        zone = make_zone(name="sched-client-disabled.test", soa_serial=77)
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": False})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_client_notify(zone)
+            mock_enq.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestScheduleNsNotify:
+    def test_enqueues_job_when_enabled(self, make_zone, monkeypatch):
+        zone = make_zone(name="sched-ns.test", soa_serial=88)
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_all_zones": True})
+        with patch.object(nh.SendNSNotify, "enqueue") as mock_enq:
+            nh.schedule_ns_notify(zone)
+            mock_enq.assert_called_once_with(
+                zone_id=zone.pk,
+                zone_name="sched-ns.test",
+                view_name=zone.view.name,
+                soa_serial=88,
+            )
+
+    def test_does_not_enqueue_when_no_soa(self, make_zone, monkeypatch):
+        from netbox_dns.models import Record
+
+        zone = make_zone(name="sched-ns-nosoa.test")
+        Record.objects.filter(zone=zone, type="SOA").delete()
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_all_zones": True})
+        with patch.object(nh.SendNSNotify, "enqueue") as mock_enq:
+            nh.schedule_ns_notify(zone)
+            mock_enq.assert_not_called()
+
+    def test_does_not_enqueue_when_ns_notify_disabled(self, make_zone, monkeypatch):
+        zone = make_zone(name="sched-ns-disabled.test", soa_serial=88)
+        monkeypatch.setattr(nh, "SETTINGS", {})
+        with patch.object(nh.SendNSNotify, "enqueue") as mock_enq:
+            nh.schedule_ns_notify(zone)
+            mock_enq.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestScheduleCatalogZoneNotify:
+    def test_enqueues_two_jobs_when_enabled(self, make_view, monkeypatch):
+        from netbox_dns_bridge.models import CatalogZone
+
+        view = make_view(name="catz-notify-view")
+        CatalogZone.objects.create(view=view, soa_serial=42)
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": True})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_catalog_zone_notify(view)
+            assert mock_enq.call_count == 2
+            mock_enq.assert_any_call(
+                zone_name="catz",
+                soa_serial=42,
+                view_name="catz-notify-view",
+                soa_refresh=60,
+                soa_retry=10,
+                soa_expire=1209600,
+                soa_minimum=0,
+            )
+            mock_enq.assert_any_call(
+                zone_name="catz-notify-view.catz",
+                soa_serial=42,
+                view_name="catz-notify-view",
+                soa_refresh=60,
+                soa_retry=10,
+                soa_expire=1209600,
+                soa_minimum=0,
+            )
+
+    def test_does_not_enqueue_when_notify_clients_disabled(self, make_view, monkeypatch):
+        from netbox_dns_bridge.models import CatalogZone
+
+        view = make_view(name="catz-notify-disabled")
+        CatalogZone.objects.create(view=view, soa_serial=42)
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": False})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_catalog_zone_notify(view)
+            mock_enq.assert_not_called()
+
+    def test_does_not_enqueue_when_no_catalog_zone(self, make_view, monkeypatch):
+        view = make_view(name="catz-notify-no-cz")
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_clients": True})
+        with patch.object(nh.SendClientNotify, "enqueue") as mock_enq:
+            nh.schedule_catalog_zone_notify(view)
+            mock_enq.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestSendClientNotifyRun:
+    def test_sends_single_notify_to_seen_clients(self, make_zone, make_view, monkeypatch):
+        import netbox_dns_bridge.jobs.notify as nh
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="notify-run-view")
+        SeenTransferClient.objects.create(
+            source_ip="192.0.2.99", view=view, last_seen=timezone.now()
+        )
+
+        monkeypatch.setattr(nh, "SETTINGS", {
+            "tsig_keys": {
+                "notify-run-view": {
+                    "keyname": "nk.",
+                    "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                    "algorithm": "hmac-sha256",
+                }
+            },
+            "notify_over_tcp": False,
+            "notify_client_port": 53,
+            "notify_client_alive_threshold_hours": 24,
+        })
+
+        job = MagicMock()
+        with patch("dns.query.udp") as mock_udp:
+            nh.SendClientNotify.run(job,
+                zone_name="z.test", soa_serial=10, view_name="notify-run-view")
+            assert mock_udp.call_count == 1
+
+    def test_sends_notify_without_catalog_zone(self, monkeypatch, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="no-catz-view")
+        SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+
+        monkeypatch.setattr(nh, "SETTINGS", {
+            "tsig_keys": {
+                "no-catz-view": {
+                    "keyname": "nk.",
+                    "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                    "algorithm": "hmac-sha256",
+                }
+            },
+            "notify_over_tcp": False,
+            "notify_client_port": 53,
+            "notify_client_alive_threshold_hours": 24,
+        })
+
+        job = MagicMock()
+        with patch("dns.query.udp") as mock_udp:
+            nh.SendClientNotify.run(job,
+                zone_name="z.test", soa_serial=1, view_name="no-catz-view")
+            assert mock_udp.call_count == 1
+
+
+@pytest.mark.django_db
+class TestSendNSNotifyRun:
+    def test_sends_notify_to_nameserver_ips(self, make_zone, make_record, make_nameserver, monkeypatch):
+        import netbox_dns_bridge.jobs.notify as nh
+
+        zone = make_zone(name="ns-notify-run.test", soa_serial=55)
+        ns = make_nameserver("ns1.ns-notify-run.test")
+        zone.nameservers.add(ns)
+        make_record(zone, name="ns1", type_="A", value="192.0.2.200")
+
+        monkeypatch.setattr(nh, "SETTINGS", {
+            "tsig_keys": {
+                zone.view.name: {
+                    "keyname": "nk.",
+                    "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                    "algorithm": "hmac-sha256",
+                }
+            },
+            "notify_over_tcp": False,
+            "notify_ns_port": 53,
+        })
+
+        job = MagicMock()
+        with patch("dns.query.udp") as mock_udp:
+            nh.SendNSNotify.run(job,
+                zone_id=zone.pk, zone_name="ns-notify-run.test",
+                view_name=zone.view.name, soa_serial=55)
+            mock_udp.assert_called_once()
+
+    def test_skips_when_zone_deleted(self, monkeypatch):
+        job = MagicMock()
+        with patch("dns.query.udp") as mock_udp:
+            nh.SendNSNotify.run(job,
+                zone_id=999999, zone_name="gone.test",
+                view_name="v", soa_serial=1)
+            mock_udp.assert_not_called()
+
+    def test_skips_when_no_nameservers(self, make_zone, monkeypatch):
+        zone = make_zone(name="ns-notify-empty.test")
+
+        monkeypatch.setattr(nh, "SETTINGS", {
+            "tsig_keys": {
+                zone.view.name: {
+                    "keyname": "nk.",
+                    "secret": "YWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWFhYWE=",
+                    "algorithm": "hmac-sha256",
+                }
+            },
+            "notify_over_tcp": False,
+            "notify_ns_port": 53,
+        })
+
+        job = MagicMock()
+        with patch("dns.query.udp") as mock_udp:
+            nh.SendNSNotify.run(job,
+                zone_id=zone.pk, zone_name="ns-notify-empty.test",
+                view_name=zone.view.name, soa_serial=1)
+            mock_udp.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestNotifyNsEnabled:
+    def test_enabled_by_all_zones_flag(self, make_zone, monkeypatch):
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_all_zones": True})
+        from netbox_dns_bridge.jobs.notify import _notify_ns_enabled
+
+        zone = make_zone(name="nsflag.test")
+        assert _notify_ns_enabled(zone) is True
+
+    def test_disabled_by_default(self, make_zone, monkeypatch):
+        monkeypatch.setattr(nh, "SETTINGS", {})
+        from netbox_dns_bridge.jobs.notify import _notify_ns_enabled
+
+        zone = make_zone(name="nsdisabled.test")
+        assert _notify_ns_enabled(zone) is False
+
+    def test_enabled_by_custom_field(self, make_zone, monkeypatch):
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_custom_field_name": "enable_notify"})
+        from netbox_dns_bridge.jobs.notify import _notify_ns_enabled
+
+        zone = make_zone(name="nscf.test")
+        zone.custom_field_data = {"enable_notify": True}
+        assert _notify_ns_enabled(zone) is True
+
+    def test_disabled_when_custom_field_false(self, make_zone, monkeypatch):
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_custom_field_name": "enable_notify"})
+        from netbox_dns_bridge.jobs.notify import _notify_ns_enabled
+
+        zone = make_zone(name="nscf-false.test")
+        zone.custom_field_data = {"enable_notify": False}
+        assert _notify_ns_enabled(zone) is False
+
+    def test_disabled_when_custom_field_missing(self, make_zone, monkeypatch):
+        monkeypatch.setattr(nh, "SETTINGS", {"notify_ns_custom_field_name": "enable_notify"})
+        from netbox_dns_bridge.jobs.notify import _notify_ns_enabled
+
+        zone = make_zone(name="nscf-missing.test")
+        zone.custom_field_data = {}
+        assert _notify_ns_enabled(zone) is False

netbox_dns_bridge/tests/test_request_handler_integration.py

@@ -0,0 +1,190 @@
+"""Real-socket integration tests for the DNS transfer endpoint.
+
+Starts actual TCP+UDP servers on 127.0.0.1:0 and sends real DNS queries via
+raw sockets against NetBox DNS zones in the test database. Raw sockets are used
+so response TSIG can be verified explicitly with the request MAC.
+"""
+from __future__ import annotations
+
+import dns.flags
+import dns.message
+import dns.name
+import dns.query
+import dns.rcode
+import dns.rdatatype
+import pytest
+
+from netbox_dns_bridge.tests._helpers import (
+    make_signed_query,
+    make_unsigned_query,
+    parse_response,
+    parse_response_strict,
+    query_mac,
+    tcp_exchange,
+    udp_exchange,
+    build_keyring,
+    xfr_rrsets,
+)
+
+
+pytestmark = pytest.mark.django_db(transaction=True)
+
+
+def _signed_soa(zone_name, tsig_key):
+    return make_signed_query(zone_name, dns.rdatatype.SOA, tsig_key)
+
+
+def _signed_axfr(zone_name, tsig_key):
+    return make_signed_query(zone_name, dns.rdatatype.AXFR, tsig_key)
+
+
+class TestSOAIntegration:
+    def test_soa_over_tcp(self, dns_server, make_zone, make_view, tsig_key):
+        view = make_view()
+        make_zone(name="int-soa.test", view=view, soa_serial=555)
+        srv = dns_server.start(views={"testkey.": view})
+        keyring = build_keyring(tsig_key)
+
+        wire = _signed_soa("int-soa.test", tsig_key)
+        resp_wire = tcp_exchange(wire, srv["host"], srv["port"])
+        resp = parse_response_strict(resp_wire, keyring, query_mac(wire, keyring))
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert resp.flags & dns.flags.AA
+        assert resp.answer[0].rdtype == dns.rdatatype.SOA
+        assert resp.answer[0][0].serial == 555
+        assert resp.had_tsig
+
+    def test_soa_over_udp(self, dns_server, make_zone, make_view, tsig_key):
+        view = make_view()
+        make_zone(name="int-udp.test", view=view, soa_serial=7)
+        srv = dns_server.start(views={"testkey.": view})
+        keyring = build_keyring(tsig_key)
+
+        wire = _signed_soa("int-udp.test", tsig_key)
+        resp_wire = udp_exchange(wire, srv["host"], srv["port"])
+        resp = parse_response_strict(resp_wire, keyring, query_mac(wire, keyring))
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert resp.answer[0][0].serial == 7
+
+    def test_unsigned_query_refused(self, dns_server, make_zone, make_view, tsig_key):
+        view = make_view()
+        make_zone(name="int-nosig.test", view=view)
+        srv = dns_server.start(views={"testkey.": view})
+
+        resp_wire = tcp_exchange(
+            make_unsigned_query("int-nosig.test", dns.rdatatype.SOA),
+            srv["host"], srv["port"],
+        )
+        resp = parse_response(resp_wire)
+        assert resp.rcode() == dns.rcode.REFUSED
+
+
+class TestAXFRIntegration:
+    def test_axfr_over_tcp(self, dns_server, make_zone, make_view, make_record, tsig_key):
+        view = make_view()
+        zone = make_zone(name="int-axfr.test", view=view, soa_serial=123)
+        make_record(zone, name="www", type_="A", value="192.0.2.10")
+        make_record(zone, name="api", type_="A", value="192.0.2.11")
+        srv = dns_server.start(views={"testkey.": view})
+
+        records = xfr_rrsets(
+            dns.query.xfr(
+                srv["host"], "int-axfr.test", port=srv["port"],
+                keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name,
+                lifetime=5, relativize=False,
+            )
+        )
+        names = {r.name.to_text() for r in records}
+        assert "int-axfr.test." in names
+        assert "www.int-axfr.test." in names
+        assert "api.int-axfr.test." in names
+        # AXFR must begin and end with SOA.
+        assert records[0].rdtype == dns.rdatatype.SOA
+        assert records[-1].rdtype == dns.rdatatype.SOA
+        assert records[0][0].serial == 123
+
+    def test_axfr_over_udp_refused(self, dns_server, make_zone, make_view, tsig_key):
+        view = make_view()
+        make_zone(name="int-axfr-udp.test", view=view)
+        srv = dns_server.start(views={"testkey.": view})
+
+        resp_wire = udp_exchange(
+            _signed_axfr("int-axfr-udp.test", tsig_key), srv["host"], srv["port"]
+        )
+        resp = parse_response(resp_wire)
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_axfr_unknown_zone_refused(self, dns_server, make_view, tsig_key):
+        view = make_view()
+        srv = dns_server.start(views={"testkey.": view})
+
+        resp_wire = tcp_exchange(
+            _signed_axfr("does-not-exist.test", tsig_key), srv["host"], srv["port"]
+        )
+        resp = parse_response(resp_wire)
+        assert resp.rcode() == dns.rcode.REFUSED
+
+
+class TestCatzIntegration:
+    def test_catz_axfr_contains_member_ptr(self, dns_server, make_zone, make_view, tsig_key):
+        view = make_view()
+        make_zone(name="member-a.test", view=view)
+        srv = dns_server.start(views={"testkey.": view})
+
+        records = xfr_rrsets(
+            dns.query.xfr(
+                srv["host"], "catz", port=srv["port"],
+                keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name,
+                lifetime=5, relativize=False,
+            )
+        )
+        types = {r.rdtype for r in records}
+        assert dns.rdatatype.SOA in types
+        assert dns.rdatatype.PTR in types
+        ptrs = [r for r in records if r.rdtype == dns.rdatatype.PTR]
+        targets = {str(r[0].target) for r in ptrs}
+        assert any("member-a.test" in t for t in targets)
+
+
+class TestSeenClientTracking:
+    def _wait_for_seen_client(self, view, timeout=3.0):
+        """Poll for SeenTransferClient record (race: response is sent before
+        _track_seen_client completes in the handler thread)."""
+        import time
+        from netbox_dns_bridge.models import SeenTransferClient
+
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            if SeenTransferClient.objects.filter(
+                source_ip="127.0.0.1", view=view
+            ).exists():
+                return True
+            time.sleep(0.05)
+        return False
+
+    def test_seen_client_recorded_on_success(
+        self, dns_server, make_zone, make_view, tsig_key, patch_settings
+    ):
+        patch_settings({"notify_clients": True})
+        view = make_view()
+        make_zone(name="seen.test", view=view)
+        srv = dns_server.start(views={"testkey.": view})
+
+        tcp_exchange(_signed_soa("seen.test", tsig_key), srv["host"], srv["port"])
+
+        assert self._wait_for_seen_client(view)
+
+    def test_no_tracking_when_notify_clients_false(
+        self, dns_server, make_zone, make_view, tsig_key, patch_settings
+    ):
+        patch_settings({"notify_clients": False})
+        view = make_view()
+        make_zone(name="not-seen.test", view=view)
+        srv = dns_server.start(views={"testkey.": view})
+
+        tcp_exchange(_signed_soa("not-seen.test", tsig_key), srv["host"], srv["port"])
+
+        import time
+        time.sleep(0.3)
+        from netbox_dns_bridge.models import SeenTransferClient
+        assert not SeenTransferClient.objects.filter(view=view).exists()

netbox_dns_bridge/tests/test_request_handler_unit.py

@@ -0,0 +1,358 @@
+"""Unit tests for the DNS transfer request handler.
+
+These exercise routing, denial gates, SOA/AXFR response construction and TSIG
+handling by feeding crafted wire bytes to ``_handle_dns_query`` and capturing
+emitted responses. Zone lookups are mocked so no database is needed for the
+routing/response logic; the integration suite covers the real-socket path.
+"""
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import dns.flags
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdatatype
+
+import netbox_dns_bridge.management.commands.dns_transfer_endpoint.request_handler as rh
+from netbox_dns_bridge.tests._helpers import (
+    CaptureTCPHandler,
+    CaptureUDPHandler,
+    make_dns_zone,
+    make_signed_query,
+    make_tsig_key,
+    make_unsigned_query,
+    parse_response,
+    parse_response_strict,
+    query_mac,
+    build_keyring,
+    build_tsig_view_map,
+)
+
+
+# ---------------------------------------------------------------------------
+# Fixtures local to this module
+# ---------------------------------------------------------------------------
+
+import pytest
+
+
+@pytest.fixture
+def view():
+    return SimpleNamespace(name="default")
+
+
+@pytest.fixture
+def keyring(tsig_key):
+    return build_keyring(tsig_key)
+
+
+@pytest.fixture
+def view_map(tsig_key, view):
+    return build_tsig_view_map("testkey.", view)
+
+
+@pytest.fixture
+def tcp_handler(capture_handler, keyring, view_map):
+    """Return a factory building a fresh TCP capture handler + captured list."""
+    def _make(client_ip="127.0.0.1"):
+        return capture_handler(CaptureTCPHandler, keyring, view_map, client_ip)
+    return _make
+
+
+def _patch_regular_zone(monkeypatch, handler, zone):
+    handler._get_zone_from_nb = lambda name, view_name: zone
+
+
+def _patch_catz(monkeypatch, zone):
+    monkeypatch.setattr(rh.catzm, "create_zone", lambda name, view_name: zone)
+
+
+# ---------------------------------------------------------------------------
+# Denial / routing gates
+# ---------------------------------------------------------------------------
+
+class TestRoutingGates:
+    def test_no_tsig_refused(self, tcp_handler, tsig_key):
+        handler, captured = tcp_handler()
+        wire = make_unsigned_query("example.test", dns.rdatatype.SOA)
+        handler._handle_dns_query(wire)
+        assert len(captured) == 1
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_question_count_zero_refused(self, tcp_handler, tsig_key):
+        handler, captured = tcp_handler()
+        msg = dns.message.make_query("example.test", dns.rdatatype.SOA)
+        msg.question = []
+        msg.use_tsig(keyring={tsig_key.name: tsig_key}, keyname=tsig_key.name)
+        handler._handle_dns_query(msg.to_wire())
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_unsupported_qtype_refused(self, tcp_handler, tsig_key):
+        handler, captured = tcp_handler()
+        wire = make_signed_query("example.test", dns.rdatatype.A, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_ixfr_not_supported_refused(self, tcp_handler, tsig_key):
+        handler, captured = tcp_handler()
+        wire = make_signed_query("example.test", dns.rdatatype.IXFR, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_axfr_over_udp_refused(self, capture_handler, keyring, view_map, tsig_key):
+        handler, captured = capture_handler(
+            CaptureUDPHandler, keyring, view_map
+        )
+        wire = make_signed_query("example.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_key_not_mapped_to_view_refused(self, capture_handler, view):
+        other_key = make_tsig_key("unknownkey.")
+        keyring = build_keyring(other_key)
+        view_map = {}  # no mapping
+        handler, captured = capture_handler(CaptureTCPHandler, keyring, view_map)
+        wire = make_signed_query("example.test", dns.rdatatype.SOA, other_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_zone_not_found_refused_not_nxdomain(self, tcp_handler, tsig_key, monkeypatch):
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: None
+        wire = make_signed_query("missing.test", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+        assert resp.rcode() != dns.rcode.NXDOMAIN
+
+    def test_malformed_query_silent_drop(self, tcp_handler):
+        handler, captured = tcp_handler()
+        handler._handle_dns_query(b"\x00\x00not a dns message")
+        assert captured == []
+
+    def test_zone_without_soa_silent_drop(self, tcp_handler, tsig_key, monkeypatch):
+        import dns.zone
+        import dns.name
+        zone = dns.zone.Zone(dns.name.from_text("empty.test", dns.name.root))
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("empty.test", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        assert captured == []
+
+
+# ---------------------------------------------------------------------------
+# TSIG error paths
+# ---------------------------------------------------------------------------
+
+class TestTSIGErrors:
+    def test_bad_signature_refused_with_badsig(self, tcp_handler, tsig_key):
+        handler, captured = tcp_handler()
+        wire = make_signed_query("example.test", dns.rdatatype.SOA, tsig_key)
+        # Flip a byte in the TSIG MAC region to break the signature.
+        tampered = bytearray(wire)
+        tampered[-5] ^= 0xFF
+        handler._handle_dns_query(bytes(tampered))
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_unknown_key_refused_with_badkey(self, tcp_handler):
+        handler, captured = tcp_handler()
+        unknown = make_tsig_key("nopekey.")
+        wire = make_signed_query("example.test", dns.rdatatype.SOA, unknown)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+
+# ---------------------------------------------------------------------------
+# SOA responses
+# ---------------------------------------------------------------------------
+
+class TestSOAResponse:
+    def test_soa_regular_zone(self, tcp_handler, tsig_key, keyring, monkeypatch):
+        zone = make_dns_zone("example.test", soa_serial=42)
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("example.test", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+
+        resp = parse_response_strict(captured[0], keyring, query_mac(wire, keyring))
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert resp.flags & dns.flags.AA
+        assert resp.flags & dns.flags.QR
+        assert len(resp.answer) == 1
+        rrset = resp.answer[0]
+        assert rrset.rdtype == dns.rdatatype.SOA
+        assert rrset[0].serial == 42
+        assert resp.had_tsig
+
+    def test_soa_for_catz(self, tcp_handler, tsig_key, monkeypatch):
+        zone = make_dns_zone("catz", soa_serial=99)
+        _patch_catz(monkeypatch, zone)
+        handler, captured = tcp_handler()
+        wire = make_signed_query("catz", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert resp.answer[0].rdtype == dns.rdatatype.SOA
+        assert resp.answer[0][0].serial == 99
+
+    def test_soa_for_view_catz_case_insensitive(self, tcp_handler, tsig_key, monkeypatch):
+        zone = make_dns_zone("default.catz", soa_serial=99)
+        _patch_catz(monkeypatch, zone)
+        handler, captured = tcp_handler()
+        wire = make_signed_query("DEFAULT.CATZ", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.NOERROR
+
+    def test_soa_catz_case_insensitive(self, tcp_handler, tsig_key, monkeypatch):
+        zone = make_dns_zone("catz", soa_serial=99)
+        _patch_catz(monkeypatch, zone)
+        handler, captured = tcp_handler()
+        wire = make_signed_query("CATZ", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.NOERROR
+
+    def test_soa_tsig_signed(self, tcp_handler, tsig_key, keyring, monkeypatch):
+        zone = make_dns_zone("example.test", soa_serial=1)
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("example.test", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response_strict(captured[0], keyring, query_mac(wire, keyring))
+        assert resp.had_tsig
+        assert resp.keyname == tsig_key.name
+
+
+# ---------------------------------------------------------------------------
+# AXFR responses
+# ---------------------------------------------------------------------------
+
+class TestAXFRResponse:
+    def test_axfr_single_message_framing(self, tcp_handler, tsig_key, keyring, monkeypatch):
+        zone = make_dns_zone(
+            "example.test",
+            soa_serial=7,
+            extra=[("www", "A", 300, "192.0.2.1"), ("mail", "A", 300, "192.0.2.2")],
+        )
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("example.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(wire)
+
+        # Single message expected (small zone).
+        assert len(captured) == 1
+        resp = parse_response_strict(
+            captured[0], keyring, query_mac(wire, keyring), one_rr_per_rrset=True
+        )
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert resp.flags & dns.flags.AA
+        assert resp.flags & dns.flags.QR
+        assert resp.had_tsig
+
+        # First and last answer rrsets are SOA (opening + closing).
+        assert resp.answer[0].rdtype == dns.rdatatype.SOA
+        assert resp.answer[-1].rdtype == dns.rdatatype.SOA
+        assert resp.answer[0][0].serial == 7
+        # Middle records present.
+        types = {rr.rdtype for rr in resp.answer}
+        assert dns.rdatatype.A in types
+
+    def test_axfr_multi_message_when_large(self, tcp_handler, tsig_key, monkeypatch):
+        # Build a zone with many records, then shrink MAX_WIRE to force splits.
+        extras = [(f"host{i}", "A", 300, f"192.0.2.{i % 255}") for i in range(200)]
+        zone = make_dns_zone("big.test", soa_serial=1, extra=extras)
+        handler, captured = tcp_handler()
+        handler.MAX_WIRE = 800
+        handler.RESERVED_TSIG = 300
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("big.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(wire)
+
+        assert len(captured) >= 2
+        # First message opens with SOA, last message closes with SOA.
+        first = parse_response(captured[0], one_rr_per_rrset=True)
+        last = parse_response(captured[-1], one_rr_per_rrset=True)
+        assert first.answer[0].rdtype == dns.rdatatype.SOA
+        assert last.answer[-1].rdtype == dns.rdatatype.SOA
+
+    def test_axfr_over_udp_refused(self, capture_handler, keyring, view_map, tsig_key):
+        handler, captured = capture_handler(CaptureUDPHandler, keyring, view_map)
+        wire = make_signed_query("example.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+
+    def test_axfr_zone_without_soa_silent_drop(self, tcp_handler, tsig_key, monkeypatch):
+        import dns.zone
+        import dns.name
+        zone = dns.zone.Zone(dns.name.from_text("nosoa.test", dns.name.root))
+        handler, captured = tcp_handler()
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("nosoa.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(wire)
+        assert captured == []
+
+    def test_axfr_tsig_chain_uses_query_mac_first(self, tcp_handler, tsig_key, keyring, monkeypatch):
+        extras = [(f"host{i}", "A", 300, f"192.0.2.{i % 255}") for i in range(120)]
+        zone = make_dns_zone("chain.test", soa_serial=1, extra=extras)
+        handler, captured = tcp_handler()
+        handler.MAX_WIRE = 800
+        handler.RESERVED_TSIG = 300
+        handler._get_zone_from_nb = lambda name, view_name: zone
+        wire = make_signed_query("chain.test", dns.rdatatype.AXFR, tsig_key)
+        handler._handle_dns_query(query_mac_wire := wire)
+        # At least two messages produced.
+        assert len(captured) >= 2
+        # First message verifies against the request MAC and opens with SOA.
+        first = parse_response_strict(
+            captured[0], keyring, query_mac(wire, keyring), one_rr_per_rrset=True
+        )
+        assert first.had_tsig
+        assert first.answer[0].rdtype == dns.rdatatype.SOA
+
+
+# ---------------------------------------------------------------------------
+# Routing: case sensitivity, trailing dot
+# ---------------------------------------------------------------------------
+
+class TestRoutingDetails:
+    def test_regular_zone_case_sensitive(self, tcp_handler, tsig_key):
+        zone = make_dns_zone("example.test", soa_serial=1)
+        handler, captured = tcp_handler()
+        calls = []
+
+        def _lookup(name, view_name):
+            calls.append(name)
+            return zone if name == "example.test" else None
+
+        handler._get_zone_from_nb = _lookup
+        wire = make_signed_query("Example.TEST", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.REFUSED
+        assert calls == ["Example.TEST"]
+
+    def test_trailing_dot_normalized(self, tcp_handler, tsig_key):
+        zone = make_dns_zone("example.test", soa_serial=1)
+        handler, captured = tcp_handler()
+        seen = []
+        handler._get_zone_from_nb = lambda name, view_name: (
+            seen.append(name) or zone
+        )
+        wire = make_signed_query("example.test.", dns.rdatatype.SOA, tsig_key)
+        handler._handle_dns_query(wire)
+        resp = parse_response(captured[0])
+        assert resp.rcode() == dns.rcode.NOERROR
+        assert seen == ["example.test"]

netbox_dns_bridge/tests/test_signals.py

@@ -0,0 +1,240 @@
+"""Tests for signal handlers: zone_pre_save, zone_post_save, zone_post_delete.
+
+Uses ``captureOnCommitCallbacks(execute=True)`` to fire ``transaction.on_commit``
+callbacks inside the transaction-wrapped ``@pytest.mark.django_db`` test scope.
+"""
+from unittest.mock import patch, MagicMock
+
+import pytest
+from django.test.testcases import TestCase as _DjangoTestCase
+
+# captureOnCommitCallbacks is a classmethod on TestCase in Django 6.x
+captureOnCommitCallbacks = _DjangoTestCase.captureOnCommitCallbacks
+
+from netbox_dns_bridge.models import (
+    CatalogZone,
+    CatalogZoneMember,
+)
+
+
+@pytest.mark.django_db
+class TestZonePreSave:
+    def test_stores_old_name_and_serial_on_existing_zone(self, make_zone):
+        zone = make_zone(name="presave.test", soa_serial=100)
+        zone.refresh_from_db()
+        zone.soa_serial = 200
+        zone.save()
+        assert getattr(zone, "_old_name", None) == "presave.test"
+        assert getattr(zone, "_old_soa_serial", None) == 100
+
+    def test_old_attrs_none_on_new_zone(self, make_zone):
+        zone = make_zone(name="newzone.test")
+        assert getattr(zone, "_old_name", None) is None
+        assert getattr(zone, "_old_soa_serial", None) is None
+
+
+@pytest.mark.django_db
+class TestZonePostSaveCreate:
+    def test_creates_catalog_zone_member_on_new_zone(self, make_zone):
+        zone = make_zone(name="postcreate.test")
+        assert CatalogZoneMember.objects.filter(zone=zone).exists()
+
+    def test_increments_soa_serial_on_commit(self, make_zone, catz_serial):
+        with captureOnCommitCallbacks(execute=True):
+            zone = make_zone(name="serial-inc.test")
+        obj = CatalogZone.objects.get(view=zone.view)
+        assert obj.soa_serial == catz_serial + 1
+
+    def test_does_not_increment_without_on_commit(self, make_zone, catz_serial):
+        zone = make_zone(name="no-commit.test")
+        obj = CatalogZone.objects.get(view=zone.view)
+        assert obj.soa_serial == catz_serial
+
+    def test_schedule_client_notify_always_called(self, make_zone, patch_settings):
+        patch_settings({"notify_clients": True})
+        with patch(
+            "netbox_dns_bridge.jobs.notify.schedule_client_notify"
+        ) as mock_notify:
+            with patch("netbox_dns_bridge.jobs.notify.schedule_ns_notify"):
+                with patch(
+                    "netbox_dns_bridge.management.commands.dns_transfer_endpoint."
+                    "catalog_zone_manager.notify.schedule_catalog_zone_notify"
+                ):
+                    with captureOnCommitCallbacks(execute=True):
+                        make_zone(name="notify.test")
+                    mock_notify.assert_called_once()
+
+    def test_schedule_ns_notify_called_when_serial_changed(
+        self, make_zone, patch_settings
+    ):
+        patch_settings({
+            "notify_clients": False,
+            "notify_ns_all_zones": True,
+        })
+        with patch(
+            "netbox_dns_bridge.jobs.notify.schedule_ns_notify"
+        ) as mock_ns_notify:
+            with patch("netbox_dns_bridge.jobs.notify.schedule_client_notify"):
+                with patch(
+                    "netbox_dns_bridge.management.commands.dns_transfer_endpoint."
+                    "catalog_zone_manager.notify.schedule_catalog_zone_notify"
+                ):
+                    with captureOnCommitCallbacks(execute=True):
+                        make_zone(name="nsnotify.test")
+                    mock_ns_notify.assert_called_once()
+
+    def test_schedule_ns_notify_not_called_when_serial_unchanged(
+        self, make_zone, patch_settings
+    ):
+        patch_settings({"notify_ns_all_zones": True})
+        with patch(
+            "netbox_dns_bridge.jobs.notify.schedule_ns_notify"
+        ) as mock_ns_notify:
+            with patch("netbox_dns_bridge.jobs.notify.schedule_client_notify"):
+                with patch(
+                    "netbox_dns_bridge.management.commands.dns_transfer_endpoint."
+                    "catalog_zone_manager.notify.schedule_catalog_zone_notify"
+                ):
+                    zone = make_zone(name="noserialchange.test")
+                    with captureOnCommitCallbacks(execute=True):
+                        zone.save()
+                    mock_ns_notify.assert_not_called()
+
+
+@pytest.mark.django_db
+class TestZonePostSaveUpdate:
+    def test_updates_member_on_name_change(self, make_zone):
+        zone = make_zone(name="rename-old.test")
+        old_name = CatalogZoneMember.objects.get(zone=zone).name
+
+        zone.name = "rename-new.test"
+        zone.save()
+
+        new_name = CatalogZoneMember.objects.get(zone=zone).name
+        assert old_name != new_name
+
+    def test_no_identifier_update_when_name_unchanged(self, make_zone):
+        zone = make_zone(name="nochange.test")
+        ident = CatalogZoneMember.objects.get(zone=zone)
+        original_name = ident.name
+
+        zone.soa_serial = zone.soa_serial + 1
+        zone.save()
+        ident.refresh_from_db()
+        assert ident.name == original_name
+
+    def test_increments_serial_on_commit_on_update(self, make_zone, catz_serial):
+        zone = make_zone(name="update-serial.test")
+        with captureOnCommitCallbacks(execute=True):
+            zone.soa_serial = zone.soa_serial + 1
+            zone.save()
+        obj = CatalogZone.objects.get(view=zone.view)
+        assert obj.soa_serial == catz_serial + 1
+
+
+@pytest.mark.django_db
+class TestZonePostDelete:
+    def test_increments_soa_serial_on_commit_on_delete(self, make_zone, catz_serial):
+        zone = make_zone(name="delete-serial.test")
+        view = zone.view
+        with captureOnCommitCallbacks(execute=True):
+            zone.delete()
+        obj = CatalogZone.objects.get(view=view)
+        assert obj.soa_serial == catz_serial + 1
+
+    def test_does_not_increment_without_on_commit(self, make_zone, catz_serial):
+        zone = make_zone(name="delete-no-commit.test")
+        view = zone.view
+        zone.delete()
+        obj = CatalogZone.objects.get(view=view)
+        assert obj.soa_serial == catz_serial
+
+
+@pytest.mark.django_db
+class TestZoneViewChange:
+    def test_increments_both_catalog_zone_serials(self, make_zone, make_view, catz_serial):
+        view_a = make_view(name="view-a")
+        view_b = make_view(name="view-b")
+        # view_b has no zones yet, so no CatalogZone was auto-created for it.
+        CatalogZone.objects.create(view=view_b, soa_serial=5)
+
+        zone = make_zone(name="move.test", view=view_a)
+
+        serial_a_before = CatalogZone.objects.get(view=view_a).soa_serial
+        serial_b_before = CatalogZone.objects.get(view=view_b).soa_serial
+
+        with captureOnCommitCallbacks(execute=True):
+            zone.view = view_b
+            zone.save()
+
+        serial_a_after = CatalogZone.objects.get(view=view_a).soa_serial
+        serial_b_after = CatalogZone.objects.get(view=view_b).soa_serial
+        assert serial_a_after == serial_a_before + 1
+        assert serial_b_after == serial_b_before + 1
+
+    def test_updates_identifier_catalog_zone_fk(self, make_zone, make_view):
+        view_a = make_view(name="fk-view-a")
+        view_b = make_view(name="fk-view-b")
+        zone = make_zone(name="fk-move.test", view=view_a)
+
+        ident = CatalogZoneMember.objects.get(zone=zone)
+        assert ident.catalog_zone == CatalogZone.objects.get(view=view_a)
+
+        zone.view = view_b
+        zone.save()
+
+        ident.refresh_from_db()
+        assert ident.catalog_zone == CatalogZone.objects.get(view=view_b)
+
+
+@pytest.mark.django_db
+class TestSignalDedup:
+    def test_dedup_skips_second_save_in_same_request(self, make_zone):
+        from netbox.context import current_request
+        from django.contrib.auth import get_user_model
+
+        zone = make_zone(name="dedup.test")
+        original_serial = CatalogZone.objects.get(
+            view=zone.view
+        ).soa_serial
+
+        User = get_user_model()
+        user = User(username="dedup-user", is_superuser=True)
+        user.save()
+
+        request = MagicMock()
+        request._handled_zones = set()
+        request.user = user
+        import uuid as _uuid
+        request.id = _uuid.uuid4()
+
+        with current_request.set(request):
+            with captureOnCommitCallbacks(execute=True):
+                zone.soa_serial = zone.soa_serial + 1
+                zone.save()
+            with captureOnCommitCallbacks(execute=True):
+                zone.soa_serial = zone.soa_serial + 2
+                zone.save()
+
+        new_serial = CatalogZone.objects.get(
+            view=zone.view
+        ).soa_serial
+        assert new_serial == original_serial + 1
+
+    def test_no_dedup_without_request(self, make_zone):
+        zone = make_zone(name="nodedup.test")
+        original_serial = CatalogZone.objects.get(
+            view=zone.view
+        ).soa_serial
+
+        with captureOnCommitCallbacks(execute=True):
+            zone.soa_serial = zone.soa_serial + 1
+            zone.save()
+        with captureOnCommitCallbacks(execute=True):
+            zone.soa_serial = zone.soa_serial + 2
+            zone.save()
+
+        new_serial = CatalogZone.objects.get(
+            view=zone.view
+        ).soa_serial
+        assert new_serial == original_serial + 2

netbox_dns_bridge/tests/test_smoke.py

@@ -0,0 +1,40 @@
+"""Smoke test: verify the harness loads under the full NetBox stack."""
+import django
+
+
+def test_django_loaded():
+    assert django.VERSION[0] >= 5
+
+
+def test_plugin_importable():
+    import netbox_dns_bridge  # noqa: F401
+    assert netbox_dns_bridge.__version__
+
+
+def test_models_importable():
+    from netbox_dns_bridge.models import (
+        CatalogZone,
+        CatalogZoneMember,
+        SeenTransferClient,
+    )
+    assert CatalogZone._meta.model_name
+    assert CatalogZoneMember._meta.model_name
+    assert SeenTransferClient._meta.model_name
+
+
+def test_request_handler_importable():
+    from netbox_dns_bridge.management.commands.dns_transfer_endpoint import (  # noqa: F401
+        request_handler,
+        catalog_zone_manager,
+        dns_server,
+    )
+
+
+def test_helpers_build_dns_zone():
+    from netbox_dns_bridge.tests._helpers import make_dns_zone
+
+    zone = make_dns_zone("example.test", soa_serial=42)
+    import dns.rdatatype
+    rds = zone.get_rdataset(zone.origin, dns.rdatatype.SOA)
+    assert rds is not None
+    assert rds[0].serial == 42

netbox_dns_bridge/tests/test_utils.py

@@ -0,0 +1,209 @@
+"""Tests for netbox_dns_bridge.utils: get_logger, build_dns_zone, export_bind_zone_file."""
+import os
+import tempfile
+
+import dns.name
+import dns.rdatatype
+import dns.rdataclass
+import pytest
+
+from netbox_dns_bridge.utils import get_logger, build_dns_zone, export_bind_zone_file
+
+
+class TestGetLogger:
+    def test_returns_dns_bridge_logger(self):
+        logger = get_logger("some.module")
+        assert logger.name == "dns-bridge"
+
+    def test_ignores_name_argument(self):
+        a = get_logger("module.a")
+        b = get_logger("module.b")
+        assert a is b
+        assert a.name == "dns-bridge"
+
+    def test_logger_is_singleton(self):
+        import logging
+
+        logger = get_logger("x")
+        assert logger is logging.getLogger("dns-bridge")
+
+
+@pytest.mark.django_db
+class TestBuildDnsZone:
+    def test_basic_a_record(self, make_zone, make_record):
+        zone = make_zone(name="a.test")
+        make_record(zone, name="www", type_="A", value="192.0.2.1")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("a.test", dns.name.root)
+        rds = dns_zone.get_rdataset(origin, dns.rdatatype.SOA)
+        assert rds is not None
+        a_rds = dns_zone.get_rdataset(
+            dns.name.from_text("www", origin), dns.rdatatype.A
+        )
+        assert a_rds is not None
+        assert str(a_rds[0]) == "192.0.2.1"
+
+    def test_apex_record_empty_name(self, make_zone, make_record):
+        zone = make_zone(name="apex.test")
+        make_record(zone, name="@", type_="A", value="192.0.2.10")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("apex.test", dns.name.root)
+        a_rds = dns_zone.get_rdataset(origin, dns.rdatatype.A)
+        assert a_rds is not None
+        assert str(a_rds[0]) == "192.0.2.10"
+
+    def test_ttl_fallback_to_zone_default(self, make_zone, make_record):
+        zone = make_zone(name="ttl.test", default_ttl=7200)
+        make_record(zone, name="host", type_="A", value="192.0.2.2", ttl=None)
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("ttl.test", dns.name.root)
+        a_rds = dns_zone.get_rdataset(
+            dns.name.from_text("host", origin), dns.rdatatype.A
+        )
+        assert a_rds.ttl == 7200
+
+    def test_record_ttl_overrides_zone_default(self, make_zone, make_record):
+        zone = make_zone(name="ttl2.test", default_ttl=7200)
+        make_record(zone, name="host", type_="A", value="192.0.2.3", ttl=300)
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("ttl2.test", dns.name.root)
+        a_rds = dns_zone.get_rdataset(
+            dns.name.from_text("host", origin), dns.rdatatype.A
+        )
+        assert a_rds.ttl == 300
+
+    def test_txt_record_quoting(self, make_zone, make_record):
+        zone = make_zone(name="txt.test")
+        make_record(zone, name="spf", type_="TXT", value="v=spf1 -all")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("txt.test", dns.name.root)
+        txt_rds = dns_zone.get_rdataset(
+            dns.name.from_text("spf", origin), dns.rdatatype.TXT
+        )
+        assert txt_rds is not None
+        assert str(txt_rds[0]) == '"v=spf1 -all"'
+
+    def test_txt_record_already_quoted(self, make_zone, make_record):
+        zone = make_zone(name="txtq.test")
+        make_record(zone, name="dkim", type_="TXT", value='"k=rsa; p=MIGf"')
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("txtq.test", dns.name.root)
+        txt_rds = dns_zone.get_rdataset(
+            dns.name.from_text("dkim", origin), dns.rdatatype.TXT
+        )
+        assert txt_rds is not None
+        assert "k=rsa" in str(txt_rds[0])
+
+    def test_txt_record_long_value_chunked(self, make_zone, make_record):
+        zone = make_zone(name="longtxt.test")
+        long_val = "a" * 300
+        make_record(zone, name="big", type_="TXT", value=long_val)
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("longtxt.test", dns.name.root)
+        txt_rds = dns_zone.get_rdataset(
+            dns.name.from_text("big", origin), dns.rdatatype.TXT
+        )
+        assert txt_rds is not None
+        wire = str(txt_rds[0])
+        assert "a" * 300 in wire.replace('"', "").replace(" ", "")
+
+    def test_absolute_name_record(self, make_zone, make_record):
+        zone = make_zone(name="abs.test")
+        make_record(zone, name="out.abs.test.", type_="A", value="192.0.2.99")
+        dns_zone = build_dns_zone(zone)
+        abs_name = dns.name.from_text("out.abs.test", dns.name.root)
+        a_rds = dns_zone.get_rdataset(abs_name, dns.rdatatype.A)
+        assert a_rds is not None
+        assert str(a_rds[0]) == "192.0.2.99"
+
+    def test_multiple_records_same_name_type(self, make_zone, make_record):
+        zone = make_zone(name="multi.test")
+        make_record(zone, name="lb", type_="A", value="192.0.2.1")
+        make_record(zone, name="lb", type_="A", value="192.0.2.2")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("multi.test", dns.name.root)
+        a_rds = dns_zone.get_rdataset(
+            dns.name.from_text("lb", origin), dns.rdatatype.A
+        )
+        assert a_rds is not None
+        assert len(a_rds) == 2
+        values = {str(r) for r in a_rds}
+        assert values == {"192.0.2.1", "192.0.2.2"}
+
+    def test_inactive_records_excluded(self, make_zone, make_record):
+        from netbox_dns.choices import RecordStatusChoices
+
+        zone = make_zone(name="inactive.test")
+        make_record(zone, name="active", type_="A", value="192.0.2.1",
+                     status=RecordStatusChoices.STATUS_ACTIVE)
+        make_record(zone, name="inactive", type_="A", value="192.0.2.2",
+                     status=RecordStatusChoices.STATUS_INACTIVE)
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("inactive.test", dns.name.root)
+        assert dns_zone.get_rdataset(
+            dns.name.from_text("active", origin), dns.rdatatype.A
+        ) is not None
+        assert dns_zone.get_rdataset(
+            dns.name.from_text("inactive", origin), dns.rdatatype.A
+        ) is None
+
+    def test_zone_rdclass_is_in(self, make_zone, make_record):
+        zone = make_zone(name="rdclass.test")
+        make_record(zone, name="x", type_="A", value="192.0.2.1")
+        dns_zone = build_dns_zone(zone)
+        assert dns_zone.rdclass == dns.rdataclass.IN
+
+    def test_aaaa_record(self, make_zone, make_record):
+        zone = make_zone(name="aaaa.test")
+        make_record(zone, name="v6", type_="AAAA", value="2001:db8::1")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("aaaa.test", dns.name.root)
+        aaaa_rds = dns_zone.get_rdataset(
+            dns.name.from_text("v6", origin), dns.rdatatype.AAAA
+        )
+        assert aaaa_rds is not None
+        assert str(aaaa_rds[0]) == "2001:db8::1"
+
+    def test_cname_record(self, make_zone, make_record):
+        zone = make_zone(name="cname.test")
+        make_record(zone, name="alias", type_="CNAME", value="target.test.")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("cname.test", dns.name.root)
+        cnames = dns_zone.get_rdataset(
+            dns.name.from_text("alias", origin), dns.rdatatype.CNAME
+        )
+        assert cnames is not None
+        assert str(cnames[0]) == "target.test."
+
+    def test_mx_record(self, make_zone, make_record):
+        zone = make_zone(name="mx.test")
+        make_record(zone, name="@", type_="MX", value="10 mail.test.")
+        dns_zone = build_dns_zone(zone)
+        origin = dns.name.from_text("mx.test", dns.name.root)
+        mx_rds = dns_zone.get_rdataset(origin, dns.rdatatype.MX)
+        assert mx_rds is not None
+        assert mx_rds[0].preference == 10
+        assert str(mx_rds[0].exchange) == "mail.test."
+
+
+@pytest.mark.django_db
+class TestExportBindZoneFile:
+    def test_writes_valid_zone_file(self, make_zone, make_record):
+        zone = make_zone(name="export.test")
+        make_record(zone, name="www", type_="A", value="192.0.2.1")
+        with tempfile.NamedTemporaryFile(mode="w", suffix=".zone", delete=False) as f:
+            path = f.name
+        try:
+            export_bind_zone_file(zone, path)
+            with open(path) as f:
+                content = f.read()
+            assert "SOA" in content
+            assert "192.0.2.1" in content
+            assert "www" in content
+        finally:
+            os.unlink(path)
+
+    def test_io_error_on_bad_path(self, make_zone):
+        zone = make_zone(name="badpath.test")
+        with pytest.raises(IOError):
+            export_bind_zone_file(zone, "/nonexistent/dir/zone.file")

netbox_dns_bridge/tests/test_views.py

@@ -0,0 +1,278 @@
+"""Tests for views: CatalogZone list/detail/edit, CatalogZoneMember list/detail, SeenTransferClient list/detail — auth gate and context."""
+import pytest
+from django.test import Client
+from django.contrib.auth import get_user_model
+
+
+@pytest.fixture
+def client():
+    return Client()
+
+
+@pytest.fixture
+def superuser(db):
+    User = get_user_model()
+    user = User(username="admin", email="admin@test.local", is_superuser=True)
+    user.set_password("testpass")
+    user.save()
+    return user
+
+
+@pytest.fixture
+def regular_user(db):
+    User = get_user_model()
+    user = User(username="regular", email="reg@test.local")
+    user.set_password("testpass")
+    user.save()
+    return user
+
+
+@pytest.mark.django_db
+class TestCatalogZoneMemberListView:
+    def test_unauthenticated_redirects_to_login(self, client):
+        resp = client.get("/plugins/dns-bridge/catalog-zone-members/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user):
+        client.login(username="regular", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zone-members/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access(self, client, superuser, make_zone):
+        make_zone(name="member-list.test")
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zone-members/")
+        assert resp.status_code == 200
+
+    def test_list_contains_members(self, client, superuser, make_zone):
+        zone = make_zone(name="member-row.test")
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zone-members/")
+        member_list = list(resp.context["table"].data)
+        assert len(member_list) >= 1
+        m = next(m for m in member_list if m.zone_id == zone.id)
+        assert m.name
+
+
+@pytest.mark.django_db
+class TestCatalogZoneMemberDetailView:
+    def test_unauthenticated_redirects_to_login(self, client, make_zone):
+        zone = make_zone(name="member-detail.test")
+        from netbox_dns_bridge.models import CatalogZoneMember
+        m = CatalogZoneMember.objects.get(zone=zone)
+        resp = client.get(f"/plugins/dns-bridge/catalog-zone-members/{m.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user, make_zone):
+        zone = make_zone(name="member-detail-forbidden.test")
+        from netbox_dns_bridge.models import CatalogZoneMember
+        m = CatalogZoneMember.objects.get(zone=zone)
+        client.login(username="regular", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zone-members/{m.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access_detail(self, client, superuser, make_zone):
+        zone = make_zone(name="member-detail-get.test")
+        from netbox_dns_bridge.models import CatalogZoneMember
+        m = CatalogZoneMember.objects.get(zone=zone)
+        client.login(username="admin", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zone-members/{m.pk}/")
+        assert resp.status_code == 200
+        assert resp.context["object"].name == m.name
+
+
+@pytest.mark.django_db
+class TestCatalogZoneListView:
+    def test_unauthenticated_redirects_to_login(self, client):
+        resp = client.get("/plugins/dns-bridge/catalog-zones/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user):
+        client.login(username="regular", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zones/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access(self, client, superuser):
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zones/")
+        assert resp.status_code == 200
+
+    def test_list_contains_catalog_zones(self, client, superuser, catz_serial, make_zone):
+        zone = make_zone(name="ctx.test")
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zones/")
+        cz_list = list(resp.context["table"].data)
+        assert len(cz_list) >= 1
+        cz = next(c for c in cz_list if c.view_id == zone.view_id)
+        assert cz.soa_serial == catz_serial
+
+    def test_list_empty_when_no_catalog_zones(self, client, superuser):
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zones/")
+        cz_list = list(resp.context["table"].data)
+        assert cz_list == []
+
+
+@pytest.mark.django_db
+class TestCatalogZoneEditView:
+    def test_unauthenticated_redirects_to_login(self, client, make_view):
+        view = make_view(name="edit-cz-view")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/edit/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user, make_view):
+        view = make_view(name="edit-cz-view-forbidden")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        client.login(username="regular", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/edit/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_get_edit_form(self, client, superuser, make_view):
+        view = make_view(name="edit-cz-view-get")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        client.login(username="admin", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/edit/")
+        assert resp.status_code == 200
+
+    def test_superuser_can_update_soa_fields(self, client, superuser, make_view):
+        view = make_view(name="edit-cz-view-post")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        client.login(username="admin", password="testpass")
+        resp = client.post(
+            f"/plugins/dns-bridge/catalog-zones/{cz.pk}/edit/",
+            {
+                "soa_serial": 100,
+                "soa_refresh": 300,
+                "soa_retry": 100,
+                "soa_expire": 86400,
+                "soa_minimum": 3600,
+            },
+        )
+        cz.refresh_from_db()
+        assert cz.soa_serial == 100
+        assert cz.soa_refresh == 300
+        assert cz.soa_retry == 100
+        assert cz.soa_expire == 86400
+        assert cz.soa_minimum == 3600
+
+    def test_no_create_route(self, client, superuser):
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/catalog-zones/add/")
+        assert resp.status_code == 404
+
+    def test_no_delete_route(self, client, superuser, make_view):
+        view = make_view(name="edit-cz-view-delete")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        client.login(username="admin", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/delete/")
+        assert resp.status_code == 404
+
+
+@pytest.mark.django_db
+class TestCatalogZoneDetailView:
+    def test_unauthenticated_redirects_to_login(self, client, make_view):
+        view = make_view(name="detail-cz-view")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user, make_view):
+        view = make_view(name="detail-cz-view-forbidden")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view)
+        client.login(username="regular", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access_detail(self, client, superuser, make_view):
+        view = make_view(name="detail-cz-view-get")
+        from netbox_dns_bridge.models import CatalogZone
+        cz = CatalogZone.objects.create(view=view, soa_serial=42)
+        client.login(username="admin", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/catalog-zones/{cz.pk}/")
+        assert resp.status_code == 200
+        assert resp.context["object"].soa_serial == 42
+
+
+@pytest.mark.django_db
+class TestSeenTransferClientListView:
+    def test_unauthenticated_redirects_to_login(self, client):
+        resp = client.get("/plugins/dns-bridge/seen-transfer-clients/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user):
+        client.login(username="regular", password="testpass")
+        resp = client.get("/plugins/dns-bridge/seen-transfer-clients/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access(self, client, superuser, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="stc-list-view")
+        SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/seen-transfer-clients/")
+        assert resp.status_code == 200
+
+    def test_list_contains_clients(self, client, superuser, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="stc-list-row-view")
+        SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+        client.login(username="admin", password="testpass")
+        resp = client.get("/plugins/dns-bridge/seen-transfer-clients/")
+        client_list = list(resp.context["table"].data)
+        assert len(client_list) >= 1
+        assert client_list[0].source_ip == "192.0.2.1"
+
+
+@pytest.mark.django_db
+class TestSeenTransferClientDetailView:
+    def test_unauthenticated_redirects_to_login(self, client, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="stc-detail-view")
+        c = SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+        resp = client.get(f"/plugins/dns-bridge/seen-transfer-clients/{c.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_regular_user_forbidden(self, client, regular_user, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="stc-detail-forbidden-view")
+        c = SeenTransferClient.objects.create(
+            source_ip="192.0.2.1", view=view, last_seen=timezone.now()
+        )
+        client.login(username="regular", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/seen-transfer-clients/{c.pk}/")
+        assert resp.status_code in (302, 403)
+
+    def test_superuser_can_access_detail(self, client, superuser, make_view):
+        from netbox_dns_bridge.models import SeenTransferClient
+        from django.utils import timezone
+
+        view = make_view(name="stc-detail-get-view")
+        c = SeenTransferClient.objects.create(
+            source_ip="192.0.2.42", view=view, last_seen=timezone.now()
+        )
+        client.login(username="admin", password="testpass")
+        resp = client.get(f"/plugins/dns-bridge/seen-transfer-clients/{c.pk}/")
+        assert resp.status_code == 200
+        assert resp.context["object"].source_ip == "192.0.2.42"

netbox_dns_bridge/urls.py

@@ -0,0 +1,47 @@
+from django.urls import include, path
+
+from utilities.urls import get_model_urls
+
+# Import views so register_model_view decorators run.
+from .views import (  # noqa: F401
+    CatalogZoneEditView,
+    CatalogZoneListView,
+    CatalogZoneMemberListView,
+    CatalogZoneMemberView,
+    CatalogZoneView,
+    SeenTransferClientListView,
+    SeenTransferClientView,
+)
+
+urlpatterns = [
+    path(
+        "catalog-zones/",
+        include(
+            get_model_urls("netbox_dns_bridge", "catalogzone", detail=False)
+        ),
+    ),
+    path(
+        "catalog-zones/<int:pk>/",
+        include(get_model_urls("netbox_dns_bridge", "catalogzone")),
+    ),
+    path(
+        "catalog-zone-members/",
+        include(
+            get_model_urls("netbox_dns_bridge", "catalogzonemember", detail=False)
+        ),
+    ),
+    path(
+        "catalog-zone-members/<int:pk>/",
+        include(get_model_urls("netbox_dns_bridge", "catalogzonemember")),
+    ),
+    path(
+        "seen-transfer-clients/",
+        include(
+            get_model_urls("netbox_dns_bridge", "seentransferclient", detail=False)
+        ),
+    ),
+    path(
+        "seen-transfer-clients/<int:pk>/",
+        include(get_model_urls("netbox_dns_bridge", "seentransferclient")),
+    ),
+]

netbox_dns_bridge/utils.py

@@ -1,34 +1,103 @@
+import dns.name
 import dns.zone
 import dns.rdatatype
 import dns.rdataclass
-import dns.exception
+import dns.rdataset
 import netbox_dns.models
+import logging
+
+
+def get_logger(name: str) -> logging.Logger:
+    return logging.getLogger("dns-bridge")
+
+
+LOGGER = get_logger(__name__)
+
+
+def build_dns_zone(nb_zone: netbox_dns.models.Zone) -> dns.zone.Zone:
+    # Build DNS zone
+    zone = dns.zone.Zone(nb_zone.name, dns.name.root)
+    zone.rdclass = dns.rdataclass.IN
+
+    nb_records = nb_zone.records.filter(active=True)
+
+    rdatasets_dict = {}
+
+    for record in nb_records:
+        rdtype = dns.rdatatype.from_text(record.type)
+        if not record.name:
+            name = zone.origin
+        elif record.name.endswith("."):
+            name = dns.name.from_text(record.name)
+        else:
+            name = dns.name.from_text(record.name, origin=zone.origin)
+
+        # If the record has no TTL, use the zone default
+        ttl = record.ttl or nb_zone.default_ttl
+
+        # Apply quoting for TXT records to stop tokanizer
+        # from cutting it up:
+        value = record.value
+        if rdtype == dns.rdatatype.TXT:
+            if value.startswith('"') and value.endswith('"'):
+                value = value[1:-1].replace('" "', "").replace('"', '"')
+
+            if len(value) > 255:
+                # This is a bug fix for netbox. If netbox allowed for
+                # an unquoted value to be larger then 255 characters,
+                # it misunderstood everything behind a ; as a comment.
+                chunks = [
+                    '"{}"'.format(value[i : i + 255]) for i in range(0, len(value), 255)
+                ]
+                value = " ".join(chunks)
+            else:
+                value = f'"{value}"'
+
+        rdata = dns.rdata.from_text(
+            dns.rdataclass.IN,
+            rdtype,
+            value,
+            relativize=False,
+            origin=zone.origin,
+        )
+
+        # Initialize rdataset if it doesn't exist for this name and type
+        if name not in rdatasets_dict:
+            rdatasets_dict[name] = {}
+        if rdtype not in rdatasets_dict[name]:
+            rdatasets_dict[name][rdtype] = dns.rdataset.Rdataset(
+                dns.rdataclass.IN, rdtype
+            )
+
+        # Add the rdata to the appropriate rdataset
+        rdatasets_dict[name][rdtype].add(rdata, ttl)
+
+    # Now, add all rdatasets to the zone
+    for name, rdtypes in rdatasets_dict.items():
+        for rdtype, rdataset in rdtypes.items():
+            # Ensure rdataset has the same rdclass as the zone
+            if rdataset.rdclass != zone.rdclass:
+                raise ValueError(
+                    f"rdataset rdclass {rdataset.rdclass} does not match "
+                    f"zone rdclass {zone.rdclass}"
+                )
+
+            # Check if the rdataset has any rdata before creating an RRset
+            if not rdataset:
+                LOGGER.debug(f"Skipping empty rdataset for {name} {rdtype}")
+                continue  # Skip empty rdataset
+
+            # Replace the rdataset for the given name and type
+            zone.replace_rdataset(name, rdataset)
+    return zone
 
 
 def export_bind_zone_file(nb_zone: netbox_dns.models.Zone, file_path: str):
-
-    # Create dnspython zone object
-    dp_zone = dns.zone.Zone(origin=dns.name.from_text(nb_zone.name))
-
-    for record in nb_zone.records.all():
-        rname = record.name or "@"
-        rdclass = dns.rdataclass.IN
-        rdatatype = dns.rdatatype.from_text(record.type)
-
-        # Create rdata object
-        rdata = dns.rdata.from_text(rdclass, rdatatype, record.value)
-
-        # Create rdataset
-        rdataset = dns.rdataset.Rdataset(rdclass, rdatatype)
-        rdataset.add(rdata, record.ttl)
-
-        # Add to zone
-        node = dp_zone.find_node(rname, create=True)
-        node.rdatasets.append(rdataset)
+    zone = build_dns_zone(nb_zone)
 
     # Write zone to file in BIND format
     try:
         with open(file_path, "w") as f:
-            dp_zone.to_file(f, sorted=True)
+            zone.to_file(f, sorted=True)
     except IOError as e:
         raise IOError(f"Failed to write zone file to {file_path}: {e}")

netbox_dns_bridge/views.py

@@ -0,0 +1,76 @@
+from netbox.object_actions import EditObject
+from netbox.views import generic
+from utilities.views import register_model_view
+
+from .filtersets import (
+    CatalogZoneFilterSet,
+    CatalogZoneMemberFilterSet,
+    SeenTransferClientFilterSet,
+)
+from .forms import (
+    CatalogZoneFilterForm,
+    CatalogZoneForm,
+    CatalogZoneMemberFilterForm,
+    SeenTransferClientFilterForm,
+)
+from .models import CatalogZone, CatalogZoneMember, SeenTransferClient
+from .tables import (
+    CatalogZoneMemberTable,
+    CatalogZoneTable,
+    SeenTransferClientTable,
+)
+
+
+@register_model_view(CatalogZone, "list", path="", detail=False)
+class CatalogZoneListView(generic.ObjectListView):
+    queryset = CatalogZone.objects.select_related("view").order_by("view__name")
+    table = CatalogZoneTable
+    filterset = CatalogZoneFilterSet
+    filterset_form = CatalogZoneFilterForm
+    actions = ()
+
+
+@register_model_view(CatalogZone)
+class CatalogZoneView(generic.ObjectView):
+    queryset = CatalogZone.objects.select_related("view")
+    actions = (EditObject,)
+
+
+@register_model_view(CatalogZone, "edit")
+class CatalogZoneEditView(generic.ObjectEditView):
+    queryset = CatalogZone.objects.select_related("view")
+    form = CatalogZoneForm
+
+
+@register_model_view(CatalogZoneMember, "list", path="", detail=False)
+class CatalogZoneMemberListView(generic.ObjectListView):
+    queryset = CatalogZoneMember.objects.select_related(
+        "zone", "catalog_zone__view"
+    ).order_by("catalog_zone__view__name", "name")
+    table = CatalogZoneMemberTable
+    filterset = CatalogZoneMemberFilterSet
+    filterset_form = CatalogZoneMemberFilterForm
+    actions = ()
+
+
+@register_model_view(CatalogZoneMember)
+class CatalogZoneMemberView(generic.ObjectView):
+    queryset = CatalogZoneMember.objects.select_related(
+        "zone", "catalog_zone__view"
+    )
+    actions = ()
+
+
+@register_model_view(SeenTransferClient, "list", path="", detail=False)
+class SeenTransferClientListView(generic.ObjectListView):
+    queryset = SeenTransferClient.objects.select_related("view").order_by("source_ip")
+    table = SeenTransferClientTable
+    filterset = SeenTransferClientFilterSet
+    filterset_form = SeenTransferClientFilterForm
+    actions = ()
+
+
+@register_model_view(SeenTransferClient)
+class SeenTransferClientView(generic.ObjectView):
+    queryset = SeenTransferClient.objects.select_related("view")
+    actions = ()

pyproject.toml

@@ -17,11 +17,25 @@ dependencies = [
 "dnspython>=2.8.0"
 ]
 
+[project.optional-dependencies]
+test = [
+    "pytest>=8.0",
+    "pytest-django>=4.8",
+]
+
+[tool.pytest.ini_options]
+DJANGO_SETTINGS_MODULE = "netbox.settings"
+python_files = ["test_*.py"]
+testpaths = ["netbox_dns_bridge/tests"]
+
 [tool.setuptools]
 include-package-data = true
 zip-safe = false
 package-dir = { "" = "." }
 
+[tool.setuptools.package-data]
+netbox_dns_bridge = ["templates/**/*.html"]
+
 [tool.setuptools.packages.find]
 where = ["."]