fix: port-25 milter chain, DMARC report validation, auto rate-limit window

Review pass over the 1.4.0-1.9.1 work.

Port 25 no longer inherits main.cf's submission milter chain: smtpd_milters
is always overridden on smtp/inet, to the antispam milter or to nothing.
Without that, OpenDKIM (strict, tempfail) gated relayed mail during a signing
outage, and the journal-milter filed inbound mail into the outbound send log
under the sender's domain -- so Deliveries showed other people's mail and a
forged From: consumed that domain's level-2 budget. architecture.md already
described the intended behaviour; the code now matches.

DMARC reports are checked before they are stored: the policy domain must be a
configured sending domain, and must match the +tag of a per-domain hosted
address. The rua address form is predictable, so anyone able to reach it could
file reports under any domain and evict genuine ones through the retention cap.
Zip attachments are now decompressed as well as gzip.

The auto level-2 ceiling is scaled to the level-1 window before the multiplier
is applied; any window other than 3600s shifted the allowance by window/3600.

Migration 0010 indexes send_log(app_login, created_at) -- both the per-MAIL
FROM rate-limit count and the per-application statistics were scanning the
created_at range.

e2e now regenerates the Postfix config in-container for all four port-25 flag
combinations and requires postfix check to pass; the 1.9.1 crash-loop shipped
in 1.4.0 and survived three releases because only the flags-off path was
exercised.

Migration 0009 stays as shipped -- its conversion branch only fires for a
database carrying application-scope allowed_ips from before 1.9.0. The schema
reference notes that the old list was permissive and the new column is
restrictive; the guide documents the allow-list as a sending control on a
fail-open path, not an authentication boundary.

Also: gofmt across cmd/ and internal/, unused duplicate validators dropped from
internal/web/validate, export no longer swallows store errors.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/store/applications.go

@@ -29,14 +29,14 @@ const (
 // hashed — so it can be shown exactly once at creation/regeneration
 // (security.md). Addresses is populated only in 'list' mode.
 type Application struct {
-	ID              int64
-	DomainID        int64
-	Login           string
-	AddressMode     string
-	CreatedAt       time.Time
-	Addresses       []string
-	AuthIPRestrict  bool     // when true, only AuthAllowedIPs may submit as this login
-	AuthAllowedIPs  []string // client IPs permitted when AuthIPRestrict is set
+	ID             int64
+	DomainID       int64
+	Login          string
+	AddressMode    string
+	CreatedAt      time.Time
+	Addresses      []string
+	AuthIPRestrict bool     // when true, only AuthAllowedIPs may submit as this login
+	AuthAllowedIPs []string // client IPs permitted when AuthIPRestrict is set
 }
 
 // AllowsAuthFromIP reports whether a client at ip may submit mail authenticated

internal/store/domains.go

@@ -4,6 +4,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"modernc.org/sqlite"
@@ -182,3 +183,17 @@ func (s *Store) UpdateDomainDMARCRua(id int64, rua sql.NullString) error {
 	}
 	return nil
 }
+
+// DomainExists reports whether a sending domain with this name is configured.
+// Used by the DMARC ingest path to refuse reports for domains this relay does
+// not send for (security.md: report XML is attacker-supplied input).
+func (s *Store) DomainExists(name string) (bool, error) {
+	var n int
+	err := s.db.QueryRow(
+		"SELECT COUNT(*) FROM domains WHERE name = ? COLLATE NOCASE", strings.TrimSpace(name),
+	).Scan(&n)
+	if err != nil {
+		return false, fmt.Errorf("domain exists %q: %w", name, err)
+	}
+	return n > 0, nil
+}

internal/store/migrations/0010_send_log_app_login_index.sql

@@ -0,0 +1,9 @@
+-- Send-log lookups by application login run on two hot paths: the journal
+-- milter counts messages for a level-2 rate limit on every MAIL FROM, and the
+-- domain page computes 30-day statistics per application on every render.
+-- 0001 indexed queue_id, domain and created_at, but not app_login, so both
+-- fell back to scanning the created_at range. The composite matches the shape
+-- of those queries (equality on app_login, range on created_at).
+
+CREATE INDEX IF NOT EXISTS idx_send_log_app_login_created_at
+    ON send_log (app_login, created_at);

internal/store/ratelimit_auto.go

@@ -116,7 +116,7 @@ func (s *Store) recalcAutoRateLimit(rl RateLimit, retentionDays, l1Max, l1Window
 		return fmt.Errorf("unknown scope %q", rl.Scope)
 	}
 
-	maxMsgs := computeAutoMaxMessages(stats, mult, l1Max)
+	maxMsgs := computeAutoMaxMessages(stats, mult, l1Max, l1Window)
 
 	rl.MaxMessages = maxMsgs
 	rl.WindowSeconds = l1Window
@@ -128,14 +128,26 @@ func (s *Store) recalcAutoRateLimit(rl RateLimit, retentionDays, l1Max, l1Window
 	return s.SetRateLimit(rl)
 }
 
-func computeAutoMaxMessages(stats SendStats, multiplier float64, l1Max int) int {
+// computeAutoMaxMessages turns an average send rate into a ceiling for one
+// level-1 window. AvgPerHour is per hour, the ceiling counts messages per
+// windowSeconds, so the rate is scaled to the window before the multiplier is
+// applied — otherwise a window other than the default 3600s would silently
+// shift the effective allowance by windowSeconds/3600. The result is never
+// below 1 for a domain that has sent anything, and never above level 1.
+func computeAutoMaxMessages(stats SendStats, multiplier float64, l1Max, windowSeconds int) int {
 	if stats.Total == 0 {
 		return 0
 	}
-	max := int(math.Ceil(stats.AvgPerHour * multiplier))
+	if windowSeconds <= 0 {
+		windowSeconds = 3600
+	}
+	perWindow := stats.AvgPerHour * float64(windowSeconds) / 3600
+	max := int(math.Ceil(perWindow * multiplier))
+	if max < 1 {
+		max = 1
+	}
 	if max > l1Max {
 		max = l1Max
 	}
 	return max
 }
-

internal/store/ratelimits_test.go

@@ -154,8 +154,8 @@ func TestRateLimitActive(t *testing.T) {
 	inactive := []RateLimit{
 		{},
 		{Scope: RateLimitScopeDomain, AllowedIPs: []string{"203.0.113.1"}}, // no ceiling
-		{Scope: RateLimitScopeDomain, MaxMessages: 5},                     // no window
-		{Scope: RateLimitScopeApp, MaxMessages: 5},                        // no window
+		{Scope: RateLimitScopeDomain, MaxMessages: 5},                      // no window
+		{Scope: RateLimitScopeApp, MaxMessages: 5},                         // no window
 	}
 	for i, rl := range inactive {
 		if rl.Active() {
@@ -261,3 +261,40 @@ func TestAutoRateLimitZeroTrafficInactive(t *testing.T) {
 		t.Fatalf("zero traffic auto should be inactive: %+v", rl)
 	}
 }
+
+// The auto ceiling counts messages per level-1 window, so the per-hour average
+// must be scaled to that window: half an hour of traffic, not a full hour's.
+func TestComputeAutoMaxMessagesScalesToWindow(t *testing.T) {
+	stats := SendStats{Total: 100, AvgPerHour: 10}
+	cases := []struct {
+		name          string
+		windowSeconds int
+		want          int
+	}{
+		{"one hour", 3600, 20},
+		{"half an hour", 1800, 10},
+		{"two hours", 7200, 40},
+		{"unset falls back to an hour", 0, 20},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			got := computeAutoMaxMessages(stats, 2.0, 1000, tc.windowSeconds)
+			if got != tc.want {
+				t.Fatalf("max = %d, want %d", got, tc.want)
+			}
+		})
+	}
+}
+
+func TestComputeAutoMaxMessagesBounds(t *testing.T) {
+	if got := computeAutoMaxMessages(SendStats{}, 2.0, 1000, 3600); got != 0 {
+		t.Fatalf("no traffic: max = %d, want 0 (inactive)", got)
+	}
+	// A trickle still has to leave room for one message.
+	if got := computeAutoMaxMessages(SendStats{Total: 1, AvgPerHour: 0.001}, 1.0, 1000, 3600); got != 1 {
+		t.Fatalf("trickle: max = %d, want 1", got)
+	}
+	if got := computeAutoMaxMessages(SendStats{Total: 100, AvgPerHour: 500}, 2.0, 100, 3600); got != 100 {
+		t.Fatalf("capped: max = %d, want the level-1 ceiling 100", got)
+	}
+}

internal/store/stats.go

@@ -15,7 +15,7 @@ type SendStats struct {
 	Total       int64
 	PeakPerHour int64
 	AvgPerHour  float64
-	WindowDays  int   // actual days queried (min(30, retention))
+	WindowDays  int     // actual days queried (min(30, retention))
 	WindowHours float64 // hours used for the average-rate denominator
 }