mix/selfpost
1
0
Fork 0
Code Issues Pull Requests Actions 8 Packages Projects Releases Wiki Activity

dmarc: no custom report address on the server's own name (audit W1)

Browse Source 
Security audit 2026-10-17, finding W1, stage 1. HandleDomainDMARC took any
address validate.Email takes; AllowedRecipients opened every stored address
on the hostname, not only the domain's hosted one; checkReportDomain
cross-checked the claimed domain only against a dmarc-reports+<tag> local
part. So a domain user of tenant A could store ops@<hostname> and from then
on anyone could mail a report claiming tenant B's domain to it, stored and
shown under B and counted toward B's 500; or store B's hosted address and
open B's mailbox without B choosing hosted. TestAllowedRecipients asserted
ops@<host> was allowed - a choice, now reversed.

Now: a custom address on the hostname is refused on the form ("choose
SelfPost hosted"); AllowedRecipients adds a domain's address only when it
is that domain's own hosted address; checkReportDomain requires a tag and
the claimed domain to equal it. The live registry (checked 2026-10-17)
holds two hosted addresses and no custom one on the hostname, so nothing
there changes.

Tests: TestCustomReportAddressOnTheHostnameIsRefused (typed, another
domain's hosted, the domain's own hosted typed as custom; an address
elsewhere still saves); TestAllowedRecipientsFollowTheDomainAddresses
inverted plus another domain's hosted address stored; untagged addresses
rejected in TestIngestMessageRejectsTagMismatch; the ingest tests deliver
to tagged addresses.

Docs: security.md § Accepted risks (DMARC), guide § DMARC reports;
CHANGELOG; plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
mix
2026-10-17 21:47:34 +03:00
co-authored by Claude Opus 5.5
parent c50314fb4c
commit 626bd337be
10 changed files with 91 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/dmarc/ingest.go
+9 -3
View File
@@ -113,13 +113,19 @@ func IngestMessage(st *store.Store, r io.Reader, recipient string, receivedAt ti
}
// checkReportDomain refuses a report whose policy domain is not one of this
// relay's sending domains, or that contradicts the +tag of the address it was
// delivered to.
// relay's sending domains, or is not the +tag of the address it was delivered
// to. Every mailbox here is a hosted one, tagged with its domain
// (AllowedRecipients), so an address without a tag is no mailbox of a domain
// and its report belongs to none (security audit 2026-10-17, W1).
func checkReportDomain(st *store.Store, domain, recipient string) error {
if domain == "" {
return rejected(fmt.Errorf("no policy domain"))
}
if tagged := TaggedDomain(recipient); tagged != "" && tagged != domain {
tagged := TaggedDomain(recipient)
if tagged == "" {
return rejected(fmt.Errorf("the address it was sent to (%s) is tagged with no domain", recipient))
}
if tagged != domain {
return rejected(fmt.Errorf("domain %q does not match the address it was sent to (%s)", domain, recipient))
}
ok, err := st.DomainExists(domain)