audit 4: DNS outages unknown, DMARC limits said, typed Health, one TLS mode per upstream

M14, M15: queryEach gives each resolver 2 s within the check's context and
asks the one that answered last first; an address or PTR lookup not
answered is Unknown, an answered mismatch beside it still an error;
Checker.Server keeps the last answer's addresses, so SPF does not go Unknown
with it. Notifications report faults only, now tested with SPF unknown
alone and beside a wrong DKIM.

DMARC reports: tests of malformed XML, gzip and zip bombs, a message over
the limit, the service's Resync, hosted suggestion and validation. The
finding: both limits cut silently and an oversized report failed as
damaged; readAtMost refuses it for its size (MaxMessage 10 MiB, moved into
IngestMessage).

healthReadings replaces map[string]any for Health and Overview.

L5: an inbound upstream has one TLS mode - a second domain to the same
[host]:port with another mode is refused, naming the first; the TLS policy
map holds each next hop once.

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 631 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/postfix/inbound.go

@@ -66,6 +66,12 @@ func renderInboundMaps(routes []InboundRoute) (relay, transport, recipients, tls
 	sort.Slice(routes, func(i, j int) bool { return routes[i].Domain < routes[j].Domain })
 
 	var relayB, transportB, recipB, tlsB strings.Builder
+	// One TLS policy line per next hop: the map is keyed by it, and a key
+	// written twice was a warning from Postfix and the first line's mode
+	// (audit 2026-10-12, L5). The panel refuses two modes for one next hop
+	// (inbound.Service.SetTransport); rows saved before that keep the
+	// first by domain name, which is what Postfix did with them.
+	tlsFor := map[string]bool{}
 	for _, r := range routes {
 		if strings.TrimSpace(r.Host) == "" {
 			continue
@@ -76,7 +82,10 @@ func renderInboundMaps(routes []InboundRoute) (relay, transport, recipients, tls
 		nexthop := inboundNexthop(r.Host, r.Port)
 		fmt.Fprintf(&relayB, "%s OK\n", r.Domain)
 		fmt.Fprintf(&transportB, "%s smtp:%s\n", r.Domain, nexthop)
-		fmt.Fprintf(&tlsB, "%s %s\n", nexthop, r.TLSMode)
+		if !tlsFor[nexthop] {
+			tlsFor[nexthop] = true
+			fmt.Fprintf(&tlsB, "%s %s\n", nexthop, r.TLSMode)
+		}
 		switch r.RecipientMode {
 		case "any":
 			fmt.Fprintf(&recipB, "@%s OK\n", r.Domain)

internal/postfix/inbound_test.go

@@ -117,3 +117,22 @@ func TestRebuildInboundMapsEmptyOmitsPending(t *testing.T) {
 		}
 	}
 }
+
+// Two domains forwarded to one next hop share its TLS policy line: the map
+// holds the key once (audit 2026-10-12, L5).
+func TestRenderInboundMapsOneTLSLinePerNextHop(t *testing.T) {
+	routes := []InboundRoute{
+		{Domain: "b.example", Host: "10.0.0.8", Port: 25, TLSMode: "encrypt", RecipientMode: "any"},
+		{Domain: "a.example", Host: "10.0.0.8", Port: 25, TLSMode: "encrypt", RecipientMode: "any"},
+	}
+	_, transport, _, tlsPolicy, err := renderInboundMaps(routes)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(transport) != "a.example smtp:[10.0.0.8]:25\nb.example smtp:[10.0.0.8]:25\n" {
+		t.Errorf("transport = %q", transport)
+	}
+	if string(tlsPolicy) != "[10.0.0.8]:25 encrypt\n" {
+		t.Errorf("tls_policy = %q, want the next hop once", tlsPolicy)
+	}
+}