diff --git a/src/infra/widearea-dns.test.ts b/src/infra/widearea-dns.test.ts
index 409c5cc4283..7c8a894858d 100644
--- a/src/infra/widearea-dns.test.ts
+++ b/src/infra/widearea-dns.test.ts
@@ -1,5 +1,51 @@
 import { describe, expect, it } from "vitest";
-import { renderWideAreaGatewayZoneText } from "./widearea-dns.js";
+import {
+  normalizeWideAreaDomain,
+  renderWideAreaGatewayZoneText,
+  resolveWideAreaDiscoveryDomain,
+} from "./widearea-dns.js";
+
+describe("wide-area DNS discovery domain helpers", () => {
+  it.each([
+    { value: "openclaw.internal", expected: "openclaw.internal." },
+    { value: "openclaw.internal.", expected: "openclaw.internal." },
+    { value: "  openclaw.internal  ", expected: "openclaw.internal." },
+    { value: "", expected: null },
+    { value: "   ", expected: null },
+    { value: null, expected: null },
+    { value: undefined, expected: null },
+  ])("normalizes domains for %j", ({ value, expected }) => {
+    expect(normalizeWideAreaDomain(value)).toBe(expected);
+  });
+
+  it.each([
+    {
+      name: "prefers config domain over env",
+      params: {
+        env: { OPENCLAW_WIDE_AREA_DOMAIN: "env.internal" } as NodeJS.ProcessEnv,
+        configDomain: "config.internal",
+      },
+      expected: "config.internal.",
+    },
+    {
+      name: "falls back to env domain",
+      params: {
+        env: { OPENCLAW_WIDE_AREA_DOMAIN: "env.internal" } as NodeJS.ProcessEnv,
+      },
+      expected: "env.internal.",
+    },
+    {
+      name: "returns null when both sources are blank",
+      params: {
+        env: { OPENCLAW_WIDE_AREA_DOMAIN: "   " } as NodeJS.ProcessEnv,
+        configDomain: " ",
+      },
+      expected: null,
+    },
+  ])("$name", ({ params, expected }) => {
+    expect(resolveWideAreaDiscoveryDomain(params)).toBe(expected);
+  });
+});
 
 describe("wide-area DNS-SD zone rendering", () => {
   it("renders a zone with gateway PTR/SRV/TXT records", () => {
@@ -41,4 +87,29 @@ describe("wide-area DNS-SD zone rendering", () => {
 
     expect(txt).toContain(`tailnetDns=peters-mac-studio-1.sheep-coho.ts.net`);
   });
+
+  it("includes gateway TLS TXT fields and trims display metadata", () => {
+    const txt = renderWideAreaGatewayZoneText({
+      domain: "openclaw.internal",
+      serial: 2025121701,
+      gatewayPort: 18789,
+      displayName: "  Mac Studio (OpenClaw)  ",
+      tailnetIPv4: "100.123.224.76",
+      hostLabel: " Studio London ",
+      instanceLabel: " Studio London ",
+      gatewayTlsEnabled: true,
+      gatewayTlsFingerprintSha256: "abc123",
+      tailnetDns: " tailnet.ts.net ",
+      cliPath: " /opt/homebrew/bin/openclaw ",
+    });
+
+    expect(txt).toContain(`$ORIGIN openclaw.internal.`);
+    expect(txt).toContain(`studio-london IN A 100.123.224.76`);
+    expect(txt).toContain(`studio-london._openclaw-gw._tcp IN TXT`);
+    expect(txt).toContain(`displayName=Mac Studio (OpenClaw)`);
+    expect(txt).toContain(`gatewayTls=1`);
+    expect(txt).toContain(`gatewayTlsSha256=abc123`);
+    expect(txt).toContain(`tailnetDns=tailnet.ts.net`);
+    expect(txt).toContain(`cliPath=/opt/homebrew/bin/openclaw`);
+  });
 });