DNS Management: SOA and NS record types are not opt-out (always pushed via RFC2136)

**Stalwart version:** 0.16.3 **Backend:** MySQL store **DNS Provider:** RFC2136 (Bind9 with TSIG) ### Problem Under **Settings → DNS Management → Option Record Types**, the multi-select for record types Stalwart will publish via the configured DNS provider does **not** include `SOA` or `NS`. As a result those two record types are sent unconditionally by Stalwart on every DNS update cycle for each managed domain. In a typical RFC2136 setup where the local DNS server (e.g. Bind9) is the authoritative master and a separate sync layer pushes mail-relevant records to a public registrar (here: GoDaddy), this causes: - Pollution of the local zone with SOA/NS rewrites originating from Stalwart - Spurious zone serial bumps that wake up watchers/listeners (`inotify` on `.jnl`) - Unnecessary risk if any downstream sync forwards SOA/NS upstream by mistake - No way to opt out without resorting to BIND-side `update-policy` filtering ### Expected `SOA` and `NS` should be selectable in the **Option Record Types** picker (default OFF), so administrators can choose explicitly whether Stalwart manages them or not. Most operators delegating zone authority to a registrar/upstream DNS will want them disabled. ### Workaround currently used Restrict BIND's `update-policy` to mail-relevant types only: ``` update-policy { grant <tsig-key> zonesub TXT MX A AAAA CNAME SRV CAA TLSA; }; ``` Stalwart's SOA/NS updates are then refused (`REFUSED`) by BIND, which logs noise but otherwise works. A native opt-out in Stalwart's UI/setting would be much cleaner. ### Suggested fix Either: - Add `SOA` and `NS` to the `Option Record Types` enum (default unchecked), or - Add a separate boolean setting like `dns.publish.skip-zone-records = true` (default true) that prevents Stalwart from touching SOA/NS regardless of the picker. Thank you!