panel-notifications: the notifier, its mail and the server's own DKIM key

internal/notify applies the owner's rules. Each subject has a row of state,
so a thing is said once and a restart says nothing again:

- DNS of a sending domain: said after two hourly checks in a row found a
  record wrong, said to be over after two found it right. A lookup that did
  not answer moves nothing; a warning (no DMARC record) is not a subject.
- TLS certificate: at 14 days and at 3, per certificate.
- Queue: a message older than three days, once; once more when none is.
- Level-2 limit: from the rejected rows of the send log, every five minutes;
  at most once a day per domain and application.

Global users are told everything, domain users about their domains; one
message per recipient. With the instance switch off nothing is checked and no
state moves. A message that could not be handed to Postfix is tried again at
the next check.

Mail leaves by sendmail(1) as postmaster@<hostname>, addresses after "--",
no shell. For it to be believed the server's own name is signed like a
sending domain: domain.Service keeps a key for it and a line in OpenDKIM's
tables without a registry row, and non_smtpd_milters now names OpenDKIM. A
sending domain of the same name shares its key with the server.
dnscheck.ServerMail checks the name's DKIM and SPF records;
postfix.QueueMessages reads postqueue -j for arrival times.

The notifier is a sixth role of the panel process. Nothing in the panel
shows or switches it yet.

Checked on Windows: go vet clean; go test passes for notify, store, postfix,
dnscheck, cmd, and domain apart from TestWriteLoadPrivateKeyRoundtrip, which
fails there on file modes and always did. Not yet run in a container: whether
the unprivileged panel may submit is for the e2e step.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/dnscheck/servermail_test.go

@@ -0,0 +1,82 @@
+package dnscheck
+
+import (
+	"net"
+	"strings"
+	"testing"
+
+	"github.com/mixeme/selfpost/internal/health"
+)
+
+const serverDKIM = "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAserverkey"
+
+func serverMailQuery() Query {
+	return Query{
+		Name:         "mail.example.org",
+		Selector:     "sp",
+		ExpectedDKIM: serverDKIM,
+		Hostname:     "mail.example.org",
+		ServerIPs:    []string{"203.0.113.25"},
+	}
+}
+
+// The server's own name passes with its key published and "v=spf1 a -all":
+// the name's address record is this server.
+func TestServerMailPublished(t *testing.T) {
+	f := &fakeResolver{
+		txt: map[string][]string{
+			"sp._domainkey.mail.example.org": {serverDKIM},
+			"mail.example.org":               {ServerMailSPF},
+		},
+		addr: map[string][]net.IPAddr{"mail.example.org": ipAddrs("203.0.113.25")},
+	}
+	c := newTestChecker(f)
+
+	m := c.ServerMail(serverMailQuery(), false)
+	if m.DKIM.Status != health.StatusOK || m.SPF.Status != health.StatusOK || m.Overall != health.StatusOK {
+		t.Fatalf("DKIM %s (%s), SPF %s (%s), overall %s", m.DKIM.Status, m.DKIM.Detail, m.SPF.Status, m.SPF.Detail, m.Overall)
+	}
+
+	// Cached like a domain, and re-read when forced.
+	before := f.lookups
+	c.ServerMail(serverMailQuery(), false)
+	if f.lookups != before {
+		t.Errorf("a second reading looked DNS up again (%d lookups)", f.lookups-before)
+	}
+	c.ServerMail(serverMailQuery(), true)
+	if f.lookups == before {
+		t.Error("a forced reading used the cache")
+	}
+}
+
+// With nothing published both records are errors, and the SPF advice names the
+// record for a server's own name, not the one for a sending domain.
+func TestServerMailMissing(t *testing.T) {
+	c := newTestChecker(&fakeResolver{})
+
+	m := c.ServerMail(serverMailQuery(), false)
+	if m.DKIM.Status != health.StatusError || m.SPF.Status != health.StatusError || m.Overall != health.StatusError {
+		t.Fatalf("DKIM %s, SPF %s, overall %s; want errors", m.DKIM.Status, m.SPF.Status, m.Overall)
+	}
+	if !strings.Contains(m.SPF.Detail, ServerMailSPF) || strings.Contains(m.SPF.Detail, "a:mail.example.org") {
+		t.Errorf("SPF advice: %s", m.SPF.Detail)
+	}
+}
+
+// A sending domain of the same name does not share the cache entry.
+func TestServerMailCacheIsItsOwn(t *testing.T) {
+	f := &fakeResolver{
+		txt: map[string][]string{
+			"sp._domainkey.mail.example.org": {serverDKIM},
+			"mail.example.org":               {ServerMailSPF},
+		},
+		addr: map[string][]net.IPAddr{"mail.example.org": ipAddrs("203.0.113.25")},
+	}
+	c := newTestChecker(f)
+	c.Domain(serverMailQuery(), false)
+	before := f.lookups
+	c.ServerMail(serverMailQuery(), false)
+	if f.lookups == before {
+		t.Error("the server's mail check was answered from the domain's cache entry")
+	}
+}