{"id":"c32caa5592db0cad","repo":"mongodb/node-mongodb-native","slug":"server-record-does-not-have-at-least-one-more-doma","errorCode":null,"errorMessage":"Server record does not have at least one more domain level than parent URI","messagePattern":"Server record does not have at least one more domain level than parent URI","errorType":"exception","errorClass":"MongoAPIError","httpStatus":null,"severity":"error","filePath":"src/utils.ts","lineNumber":1181,"sourceCode":"  const allCharacterBeforeFirstDot = /^.*?\\./;\n  const srvIsLessThanThreeParts = normalizedSrvHost.split('.').length < 3;\n  // Remove all characters before first dot\n  // Add leading dot back to string so\n  //   an srvHostDomain = '.trusted.site'\n  //   will not satisfy an addressDomain that endsWith '.fake-trusted.site'\n  const addressDomain = `.${normalizedAddress.replace(allCharacterBeforeFirstDot, '')}`;\n  let srvHostDomain = srvIsLessThanThreeParts\n    ? normalizedSrvHost\n    : `.${normalizedSrvHost.replace(allCharacterBeforeFirstDot, '')}`;\n\n  if (!srvHostDomain.startsWith('.')) {\n    srvHostDomain = '.' + srvHostDomain;\n  }\n  if (\n    srvIsLessThanThreeParts &&\n    normalizedAddress.split('.').length <= normalizedSrvHost.split('.').length\n  ) {\n    throw new MongoAPIError(\n      'Server record does not have at least one more domain level than parent URI'\n    );\n  }\n  if (!addressDomain.endsWith(srvHostDomain)) {\n    throw new MongoAPIError('Server record does not share hostname with parent URI');\n  }\n}\n\n/**\n * Perform a get request that returns status and body.\n * @internal\n */\nexport function get(\n  url: URL | string,\n  options: http.RequestOptions = {}\n): Promise<{ body: string; status: number | undefined }> {\n  return new Promise((resolve, reject) => {\n    /* eslint-disable prefer-const */","sourceCodeStart":1163,"sourceCodeEnd":1199,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/utils.ts#L1163-L1199","documentation":"Thrown by checkParentDomainMatch() during SRV/TXT-record validation when the srvHost has fewer than three dot-separated parts AND the resolved record's host has the same or fewer parts than the srvHost. The driver requires SRV-returned hosts to live at least one DNS level below the srvHost to prevent a compromised DNS server from redirecting the client to arbitrary hosts. It surfaces as a MongoAPIError and originates from srv_polling.ts and connection_string.ts.","triggerScenarios":"Using `mongodb+srv://short.srv/` where short.srv has < 3 labels (e.g. a two-label host) and the SRV record returns a host that does not add a subdomain level. Also from TXT record hostname checks during initial connection-string resolution.","commonSituations":"Misconfigured Atlas/seedlist SRV records; using mongodb+srv:// with a custom short hostname that violates the cross-driver SRV rules; a private DNS setup where SRV target hostnames are siblings of (rather than children of) the srvHost.","solutions":["Use a srvHost with at least three labels (e.g. _mongodb._tcp.cluster.example.com) so children can be one level deeper.","Ensure every SRV target hostname is a proper subdomain of the srvHost.","If SRV is not required, switch to a standard mongodb:// seedlist connection string, which bypasses SRV hostname validation.","Work with your DNS/Atlas administrator to correct the published SRV records."],"exampleFix":"// before\nconst uri = 'mongodb+srv://db.srv/'; // two-label srvHost; SRV child not deeper => MongoAPIError\n\n// after\nconst uri = 'mongodb+srv://cluster0.example.com/'; // three-label srvHost with valid child targets","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (err) {\n  if (err instanceof MongoAPIError && /does not have at least one more domain level/.test(err.message)) {\n    throw new Error('srvHost must have >=3 labels and SRV targets must be deeper subdomains', { cause: err });\n  }\n  throw err;\n}","preventionTips":["Use a three-or-more-label srvHost for mongodb+srv:// connections.","Verify SRV targets with `dig SRV _mongodb._tcp.<srvHost>` before deploying.","Prefer the Atlas-generated connection string, which satisfies the rules by construction."],"tags":["dns","srv","security","connection-string"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}