chore(master): release 1.7.0 [skip-ci]

[github-actions]

🤖 I have created a release beep boop

1.7.0 (2026-07-21)

Features

• harden MX IP validation and reject null MX (RFC 7505) (39fb745)
• harden MX IP validation and reject null MX (RFC 7505) (84a33d5)
• skip TLSA lookups for non-DNSSEC zones per RFC 7672 Section 2.2.2 (1f2759a)
• skip TLSA lookups for non-DNSSEC zones per RFC 7672 Section 2.2.2 (a3bbd4f)

Bug Fixes

• extractSPKI() always returns null, silently breaking DANE/TLSA (4f7685d)
• dane: extractSPKI returned raw public key instead of SPKI DER (1bf0f1d)
• dane: handle JSON-deserialized Buffer in TLSA record cert field (d3b4ed9)
• dane: harden DNS error handling, pass cert chain, update docs (28bd488)
• dane: harden DNS error handling, verify TA chain linkage, drop verify opt-out (90865ab)
• dane: harden DNS error handling, verify TA chain linkage, drop verify opt-out (c111ee8)
• dns: unwrap IPv4-mapped IPv6 and narrow null MX rejection (b7836a3)
• dns: unwrap IPv4-mapped IPv6 and narrow null MX rejection (7f6d0ee)
• fixed linting (90d2af2)
• test: log unexpected errors in DANE SERVFAIL memory leak scenario (c534bf4)

---

This PR was generated with Release Please. See documentation.

[github-actions]

This PR is stale because it has been open 45 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[dragoangel]

Hi @andris9 can we merge this release + bump dependency in ZoneMTA please?
Ass well as add blockReservedNetworks section under zone settings like we have for blockLocalAddresses?