audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/inbound/service.go

@@ -70,12 +70,37 @@ func (s *Service) SetTransport(id int64, host, portRaw, tlsMode string) error {
 	if err := checkTLSMode(tlsMode); err != nil {
 		return err
 	}
+	if err := s.checkOneTLSModePerUpstream(id, host, port, tlsMode); err != nil {
+		return err
+	}
 	if err := s.store.UpdateInboundTransport(id, host, port, tlsMode); err != nil {
 		return err
 	}
 	return s.Resync()
 }
 
+// checkOneTLSModePerUpstream refuses an upstream another inbound domain
+// already forwards to with another TLS mode. Postfix's TLS policy is keyed by
+// the next hop, not by the domain (smtp_tls_policy_maps; Postfix 3.7.11,
+// README_FILES/TLS_README: the key is the verbatim next-hop), so two domains
+// to one [host]:port share one mode: the map held both keys, and the first by
+// domain name won with a warning - the form's choice for the second domain
+// was not what Postfix did (audit 2026-10-12, L5).
+func (s *Service) checkOneTLSModePerUpstream(id int64, host string, port int, tlsMode string) error {
+	domains, err := s.store.ListInboundDomains()
+	if err != nil {
+		return err
+	}
+	for _, d := range domains {
+		if d.ID == id || d.Port != port || normalizeHost(d.Host) != host || d.TLSMode == tlsMode {
+			continue
+		}
+		return invalid("[%s]:%d is already the upstream of %s, with TLS mode %s: an upstream has one TLS mode - choose %s here, or change it on %s first",
+			host, port, d.Name, d.TLSMode, d.TLSMode, d.Name)
+	}
+	return nil
+}
+
 // SetRecipients validates the mode and, in list mode, every address, then
 // rebuilds the maps.
 func (s *Service) SetRecipients(id int64, mode string, rawAddresses []string) error {

internal/inbound/service_test.go

@@ -2,110 +2,52 @@ package inbound
 
 import (
 	"errors"
-	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/mixeme/selfpost/internal/postfix"
 	"github.com/mixeme/selfpost/internal/store"
 )
 
-type fakeMaps struct {
-	routes  []postfix.InboundRoute
-	err     error
-	rebuild int
-}
+type nullMaps struct{}
 
-func (f *fakeMaps) RebuildInboundMaps(routes []postfix.InboundRoute) error {
-	f.rebuild++
-	f.routes = append([]postfix.InboundRoute(nil), routes...)
-	return f.err
-}
+func (nullMaps) RebuildInboundMaps([]postfix.InboundRoute) error { return nil }
 
-func testService(t *testing.T) (*Service, *store.Store, *fakeMaps) {
-	t.Helper()
-	st, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
+// An upstream has one TLS mode, since Postfix keys the policy by the next
+// hop: a second domain saved to the same [host]:port with another mode is
+// refused with the first domain's name and mode; the same mode is fine
+// (audit 2026-10-12, L5).
+func TestOneTLSModePerUpstream(t *testing.T) {
+	st, err := store.Open(t.TempDir() + "/test.db")
 	if err != nil {
 		t.Fatal(err)
 	}
-	t.Cleanup(func() { st.Close() })
-	m := &fakeMaps{}
-	return NewService(st, m), st, m
-}
-
-func TestAddAndSetTransport(t *testing.T) {
-	s, _, m := testService(t)
-	d, err := s.Add("Lists.Example.COM")
+	defer st.Close()
+	s := NewService(st, nullMaps{})
+	a, err := s.Add("a.example")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if d.Name != "lists.example.com" {
-		t.Fatalf("name = %q", d.Name)
-	}
-	if m.rebuild != 1 {
-		t.Fatalf("rebuild after add = %d", m.rebuild)
-	}
-	// Empty host is omitted from maps.
-	if len(m.routes) != 1 || m.routes[0].Host != "" {
-		t.Fatalf("routes after add: %+v", m.routes)
-	}
-
-	if err := s.SetTransport(d.ID, "10.0.0.8", "25", store.TLSModeEncrypt); err != nil {
-		t.Fatal(err)
-	}
-	if m.routes[0].Host != "10.0.0.8" || m.routes[0].TLSMode != store.TLSModeEncrypt {
-		t.Fatalf("routes after transport: %+v", m.routes[0])
-	}
-}
-
-func TestSetRecipientsValidatesDomain(t *testing.T) {
-	s, _, _ := testService(t)
-	d, err := s.Add("lists.example.com")
+	b, err := s.Add("b.example")
 	if err != nil {
 		t.Fatal(err)
 	}
-	err = s.SetRecipients(d.ID, store.RecipientModeList, []string{"staff@other.com"})
-	if err == nil {
-		t.Fatal("expected foreign-domain error")
-	}
-	err = s.SetRecipients(d.ID, store.RecipientModeList, nil)
-	if err == nil {
-		t.Fatal("expected empty-list error")
-	}
-	if err := s.SetRecipients(d.ID, store.RecipientModeList, []string{"staff@lists.example.com"}); err != nil {
+	if err := s.SetTransport(a.ID, "10.0.0.8", "25", "encrypt"); err != nil {
 		t.Fatal(err)
 	}
-}
-
-func TestRejectsUnsafeHost(t *testing.T) {
-	s, _, _ := testService(t)
-	d, err := s.Add("lists.example.com")
-	if err != nil {
-		t.Fatal(err)
+	err = s.SetTransport(b.ID, "[10.0.0.8]", "25", "may")
+	var verr *ValidationError
+	if !errors.As(err, &verr) || !strings.Contains(err.Error(), "[10.0.0.8]:25 is already the upstream of a.example, with TLS mode encrypt") {
+		t.Fatalf("a second mode for one upstream = %v", err)
 	}
-	if err := s.SetTransport(d.ID, "10.0.0.8; rm", "25", store.TLSModeMay); err == nil {
-		t.Fatal("expected unsafe host to be rejected")
+	if err := s.SetTransport(b.ID, "10.0.0.8", "25", "encrypt"); err != nil {
+		t.Errorf("the same mode refused: %v", err)
+	}
+	if err := s.SetTransport(b.ID, "10.0.0.8", "2525", "may"); err != nil {
+		t.Errorf("another port refused: %v", err)
+	}
+	// The domain itself may change its own mode.
+	if err := s.SetTransport(a.ID, "10.0.0.8", "25", "may"); err != nil {
+		t.Errorf("a domain changing its own mode refused: %v", err)
 	}
 }
-
-func TestDeleteResyncs(t *testing.T) {
-	s, _, m := testService(t)
-	d, err := s.Add("lists.example.com")
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := s.Delete(d.ID); err != nil {
-		t.Fatal(err)
-	}
-	if !errors.Is(mustGet(t, s, d.ID), store.ErrInboundDomainNotFound) {
-		t.Fatal("domain still present")
-	}
-	if len(m.routes) != 0 {
-		t.Fatalf("maps after delete: %+v", m.routes)
-	}
-}
-
-func mustGet(t *testing.T, s *Service, id int64) error {
-	t.Helper()
-	_, err := s.Get(id)
-	return err
-}