audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dmarc/ingest.go

@@ -26,6 +26,28 @@ var ErrRejected = errors.New("dmarc report rejected")
 
 func rejected(err error) error { return fmt.Errorf("%w: %w", ErrRejected, err) }
 
+// MaxMessage is the largest report message taken. One is refused, with that
+// reason, rather than cut at the limit and refused as damaged - before
+// 2.5.4 a cut message read as a broken attachment (audit 2026-10-12, stage
+// 4). Postfix hands over no more than its message_size_limit anyway.
+const MaxMessage = 10 << 20
+
+// errTooLarge is a read past its limit.
+var errTooLarge = errors.New("larger than its limit")
+
+// readAtMost reads all of r, or fails with errTooLarge once it holds more
+// than limit bytes.
+func readAtMost(r io.Reader, limit int64) ([]byte, error) {
+	data, err := io.ReadAll(io.LimitReader(r, limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > limit {
+		return nil, errTooLarge
+	}
+	return data, nil
+}
+
 // IngestMessage parses a raw RFC 5322 message from r and stores any DMARC
 // aggregate attachment it finds.
 //
@@ -38,7 +60,10 @@ func rejected(err error) error { return fmt.Errorf("%w: %w", ErrRejected, err) }
 // under someone else's domain, skew the panel's alignment figures, and push
 // genuine reports out through the retention cap.
 func IngestMessage(st *store.Store, r io.Reader, recipient string, receivedAt time.Time) error {
-	raw, err := io.ReadAll(io.LimitReader(r, 12<<20))
+	raw, err := readAtMost(r, MaxMessage)
+	if errors.Is(err, errTooLarge) {
+		return rejected(fmt.Errorf("the message is larger than %d MiB", MaxMessage>>20))
+	}
 	if err != nil {
 		return fmt.Errorf("read message: %w", err)
 	}

internal/dmarc/parse.go

@@ -5,8 +5,8 @@ import (
 	"bytes"
 	"compress/gzip"
 	"encoding/xml"
+	"errors"
 	"fmt"
-	"io"
 	"strconv"
 	"strings"
 	"time"
@@ -207,7 +207,10 @@ func gunzip(raw []byte) ([]byte, error) {
 		return nil, fmt.Errorf("dmarc gzip: %w", err)
 	}
 	defer zr.Close()
-	data, err := io.ReadAll(io.LimitReader(zr, maxAggregateXML))
+	data, err := readAtMost(zr, maxAggregateXML)
+	if errors.Is(err, errTooLarge) {
+		return nil, fmt.Errorf("dmarc gzip: the report is larger than %d MiB uncompressed", maxAggregateXML>>20)
+	}
 	if err != nil {
 		return nil, fmt.Errorf("dmarc gzip read: %w", err)
 	}
@@ -229,8 +232,11 @@ func unzip(raw []byte) ([]byte, error) {
 		if err != nil {
 			return nil, fmt.Errorf("dmarc zip open %q: %w", field(f.Name), err)
 		}
-		data, err := io.ReadAll(io.LimitReader(rc, maxAggregateXML))
+		data, err := readAtMost(rc, maxAggregateXML)
 		rc.Close()
+		if errors.Is(err, errTooLarge) {
+			return nil, fmt.Errorf("dmarc zip: the report is larger than %d MiB uncompressed", maxAggregateXML>>20)
+		}
 		if err != nil {
 			return nil, fmt.Errorf("dmarc zip read %q: %w", field(f.Name), err)
 		}

internal/dmarc/refusals_test.go

@@ -0,0 +1,122 @@
+package dmarc
+
+import (
+	"archive/zip"
+	"bytes"
+	"compress/gzip"
+	"encoding/base64"
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/mixeme/selfpost/internal/postfix"
+	"github.com/mixeme/selfpost/internal/store"
+)
+
+// Reports arrive by mail from anyone. One that is malformed, too large, or
+// compressed past what a report may hold is refused with its reason, and
+// nothing is stored (audit 2026-10-12, stage 4; rows of
+// review-2026-08-followups).
+func TestIngestRefusesWhatCannotBeAReport(t *testing.T) {
+	st, err := store.Open(t.TempDir() + "/test.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	if _, err := st.AddDomain("example.com", "selfpost"); err != nil {
+		t.Fatal(err)
+	}
+	attach := func(ctype string, payload []byte) string {
+		return "From: reporter@example.net\r\nMIME-Version: 1.0\r\nContent-Type: " + ctype +
+			"\r\nContent-Transfer-Encoding: base64\r\n\r\n" + base64.StdEncoding.EncodeToString(payload) + "\r\n"
+	}
+	// A gzip of nine MiB of zeroes is some nine KiB: small to send, past the
+	// eight MiB a report may hold once opened.
+	var bomb bytes.Buffer
+	zw := gzip.NewWriter(&bomb)
+	zw.Write(make([]byte, 9<<20))
+	zw.Close()
+	var zipBomb bytes.Buffer
+	zz := zip.NewWriter(&zipBomb)
+	f, _ := zz.Create("report.xml")
+	f.Write(make([]byte, 9<<20))
+	zz.Close()
+	var malformed bytes.Buffer
+	zw = gzip.NewWriter(&malformed)
+	zw.Write([]byte("<feedback><report_metadata><org_name>x</org_name>"))
+	zw.Close()
+
+	for _, c := range []struct {
+		name string
+		msg  string
+		want string
+	}{
+		{"malformed XML", attach("application/gzip", malformed.Bytes()), "xml"},
+		{"a gzip bomb", attach("application/gzip", bomb.Bytes()), "larger than 8 MiB uncompressed"},
+		{"a zip bomb", attach("application/zip", zipBomb.Bytes()), "larger than 8 MiB uncompressed"},
+		{"a message too large", "From: r@example.net\r\n\r\n" + strings.Repeat("x", MaxMessage), "larger than 10 MiB"},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			err := IngestMessage(st, strings.NewReader(c.msg), "dmarc-reports+example.com@mail.example.com", time.Now().UTC())
+			if !errors.Is(err, ErrRejected) || !strings.Contains(err.Error(), c.want) {
+				t.Fatalf("err = %v, want a refusal saying %q", err, c.want)
+			}
+			if reports, err := st.ListDMARCReportsForDomain("example.com", 10); err != nil || len(reports) != 0 {
+				t.Errorf("stored %d reports (%v)", len(reports), err)
+			}
+		})
+	}
+}
+
+// recordingMaps is Postfix as the service sees it: the maps a resync writes.
+type recordingMaps struct{ got []postfix.DMARCMapsConfig }
+
+func (m *recordingMaps) RebuildDMARCMaps(cfg postfix.DMARCMapsConfig) error {
+	m.got = append(m.got, cfg)
+	return nil
+}
+
+// A resync writes the addresses of the domains that report to this host, and
+// their domains; switched off, it writes empty maps, so Postfix accepts
+// nothing for reports. The hosted address is on this host and named after
+// the domain; one on another host is refused.
+func TestServiceResyncAndHostedAddress(t *testing.T) {
+	st, err := store.Open(t.TempDir() + "/test.db")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer st.Close()
+	d, _ := st.AddDomain("example.org", "sel")
+	maps := &recordingMaps{}
+	s := NewService(st, maps, " Mail.Example.COM ", true)
+	if got := s.HostedSuggestion("example.org"); got != "dmarc-reports+example.org@mail.example.com" {
+		t.Errorf("suggestion = %q", got)
+	}
+	if err := st.SetDomainDMARCAddress(d.ID, s.HostedSuggestion("example.org")); err != nil {
+		t.Fatal(err)
+	}
+	if err := s.Resync(); err != nil {
+		t.Fatal(err)
+	}
+	want := postfix.DMARCMapsConfig{Recipients: []string{"dmarc-reports+example.org@mail.example.com"}, Domains: []string{"mail.example.com"}}
+	if len(maps.got) != 1 || !reflect.DeepEqual(maps.got[0], want) {
+		t.Errorf("maps = %+v, want %+v", maps.got, want)
+	}
+
+	off := NewService(st, maps, "mail.example.com", false)
+	if err := off.Resync(); err != nil {
+		t.Fatal(err)
+	}
+	if last := maps.got[len(maps.got)-1]; len(last.Recipients) != 0 || len(last.Domains) != 0 {
+		t.Errorf("switched off, the maps hold %+v", last)
+	}
+
+	if err := s.ValidateHostedAddress("dmarc-reports+example.org@mail.example.com"); err != nil {
+		t.Errorf("the hosted address refused: %v", err)
+	}
+	if err := s.ValidateHostedAddress("reports@elsewhere.example"); err == nil {
+		t.Error("an address on another host passed as hosted")
+	}
+}