audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/notify/notify_test.go

@@ -619,3 +619,28 @@ func TestAUserAddedWhileASubjectIsOpenIsNotMailed(t *testing.T) {
 		t.Errorf("who the subject was owed to outlived it: %v", owed)
 	}
 }
+
+// A domain is reported broken on what is wrong, never on what is not known: a
+// check whose SPF lookup did not answer beside a wrong DKIM says DKIM only,
+// and one with SPF unknown alone says nothing (audit 2026-10-12, M14/M15).
+func TestDNSUnknownIsNeverReported(t *testing.T) {
+	b := newBench(t)
+	unknownSPF := good()
+	unknownSPF.SPF = dnscheck.Result{Status: health.StatusUnknown, Detail: "Could not check SPF: the DNS lookup failed (timed out)."}
+	b.dns["example.com"] = unknownSPF
+	want(t, "SPF unknown", b.hour())
+	want(t, "SPF unknown again", b.hour())
+	want(t, "SPF unknown a third time", b.hour())
+
+	mixed := badDKIM()
+	mixed.SPF = unknownSPF.SPF
+	b.dns["example.com"] = mixed
+	want(t, "first bad check", b.hour())
+	problem := "[SelfPost] example.com: DKIM does not match"
+	b.n.Check()
+	body := strings.Join(b.out.body, "")
+	want(t, "DKIM wrong, SPF unknown", b.out.take(), "mine@example.org|"+problem, "root@example.org|"+problem)
+	if body == "" || strings.Contains(body, "SPF") {
+		t.Errorf("the message speaks of SPF, which was not known:\n%s", body)
+	}
+}