panel: server status page, per-domain DNS checks, /domains move

Phase 13. Two new packages and one new screen.

internal/health owns the shared status vocabulary (ok/warn/error/unknown)
and the local checks: supervisord's process table, TLS certificate expiry
and the two milter sockets. Each check reports a problem as a status rather
than an error, so one broken component costs a line and not the page.

internal/dnscheck does the read-only lookups: forward-confirmed reverse DNS
for SELFPOST_HOSTNAME, and per-domain DKIM (compared against the key this
server actually signs with), SPF and DMARC. Every check is bounded by a
timeout and cached, and the resolver sits behind an interface so the tests
drive every branch without touching the network. The SPF check is
deliberately shallow: it looks for a mechanism literally covering the
server's address and does not follow include:/redirect=, so a record that
authorises us through an include is reported as "cannot tell" rather than
as a failure.

/status renders both, with the local checks in an HTMX-polled fragment and
the DNS lookups behind a Re-check button, and becomes the panel's landing
page: / now redirects there and the domain list lives at /domains. The
Reload button moves onto /status, where it reads as what it is — a
drift-recovery for the daemons — with text explaining what it regenerates.
A template test fails on any remaining href="/" so a stale link cannot
silently land on the wrong screen.

Also fixes a defect this made visible: the panel could never read the mail
queue in the documented deployment. postqueue relies on its setgid-postdrop
bit, which the compose file's no-new-privileges disables, so the Queue
screen always said "Could not read the mail queue" — including in the
released 1.0.0 image. The panel user is now a real member of postdrop,
which needs no setgid transition.

Verified in a container on the dev server against real DNS: PTR matching
(selfpost.example.com) and not matching (example.com), DKIM absent and
mismatched, SPF absent and via include:, DMARC p=quarantine/p=reject/absent,
and a resolver timeout degrading to "unknown" without hanging the page.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/handlers_apps.go

@@ -7,6 +7,8 @@ import (
 	"strconv"
 	"strings"
 
+	"codeberg.org/mix/selfpost/internal/dnscheck"
+	"codeberg.org/mix/selfpost/internal/domain"
 	"codeberg.org/mix/selfpost/internal/store"
 )
 
@@ -100,6 +102,10 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 		"Active": "domains",
 		"Domain": d,
 		"Record": record,
+		// What DNS actually publishes for the domain today, checked against the
+		// key this server signs with (phase 13.B). Cached by the checker, so
+		// re-rendering the page after a form post costs nothing.
+		"DNS": s.domainDNS(d, record, false),
 		// Client connection settings (the same for every domain on this
 		// instance): the hostname clients connect to, and whether the optional
 		// submission listener is enabled in this deployment.
@@ -122,6 +128,38 @@ func (s *Server) renderDomainDetail(w http.ResponseWriter, r *http.Request, stat
 	})
 }
 
+// domainDNS resolves what the world sees for a domain: its DKIM, SPF and DMARC
+// records (phase 13.B). The server's own address comes from the (separately
+// cached) hostname check, so the SPF heuristic knows which IP it is looking for
+// and no extra environment variable is needed. force bypasses the cache, for the
+// Re-check button.
+func (s *Server) domainDNS(d store.Domain, record domain.DKIMRecord, force bool) dnscheck.Domain {
+	srv := s.dns.Server(s.cfg.Hostname, false)
+	return s.dns.Domain(dnscheck.Query{
+		Name:         d.Name,
+		Selector:     d.DKIMSelector,
+		ExpectedDKIM: record.Value,
+		ServerIPs:    srv.IPs,
+	}, force)
+}
+
+// handleDomainDNSRecheck re-runs the domain's DNS checks ignoring the cache and
+// returns to its page, which then renders the fresh result.
+func (s *Server) handleDomainDNSRecheck(w http.ResponseWriter, r *http.Request) {
+	d, ok := s.lookupDomain(w, r)
+	if !ok {
+		return
+	}
+	record, err := s.domains.DKIMRecord(d)
+	if err != nil {
+		logf("panel: domain %d: dkim record: %v", d.ID, err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	s.domainDNS(d, record, true)
+	http.Redirect(w, r, fmt.Sprintf("/domains/%d?rechecked=1", d.ID), http.StatusSeeOther)
+}
+
 // intOrBlank renders a non-positive number as an empty string so an unset field
 // shows blank rather than "0".
 func intOrBlank(n int) string {
@@ -152,6 +190,8 @@ func detailFlash(r *http.Request) string {
 		return "Rate limit updated."
 	case r.URL.Query().Get("imported") != "":
 		return "Domain imported. Its DKIM DNS record is unchanged — no DNS update is needed."
+	case r.URL.Query().Get("rechecked") != "":
+		return "DNS re-checked."
 	default:
 		return ""
 	}

internal/web/handlers_domains.go

@@ -40,14 +40,10 @@ func (s *Server) renderDashboard(w http.ResponseWriter, r *http.Request, status
 // dashboardFlash maps a fixed redirect flag to a fixed message, so status text
 // after a redirect is never attacker-influenced.
 func dashboardFlash(r *http.Request) string {
-	switch {
-	case r.URL.Query().Get("reloaded") != "":
-		return "Configuration reloaded."
-	case r.URL.Query().Get("deleted") != "":
+	if r.URL.Query().Get("deleted") != "" {
 		return "Domain deleted."
-	default:
-		return ""
 	}
+	return ""
 }
 
 // handleAddDomain validates the submitted name, creates the domain (DKIM key +
@@ -101,6 +97,12 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 	if !ok {
 		return
 	}
+	// Drop any cached DNS verdict for the name while it is still resolvable, so
+	// re-adding the domain later starts from a fresh check instead of a stale
+	// one from before it was removed.
+	if d, err := s.domains.Get(id); err == nil {
+		defer s.dns.Forget(d.Name)
+	}
 	if err := s.domains.Delete(id); err != nil {
 		if errors.Is(err, store.ErrDomainNotFound) {
 			http.NotFound(w, r)
@@ -110,12 +112,15 @@ func (s *Server) handleDeleteDomain(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "internal error", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/?deleted=1", http.StatusSeeOther)
+	http.Redirect(w, r, "/domains?deleted=1", http.StatusSeeOther)
 }
 
 // handleReload re-applies both the OpenDKIM configuration and the Postfix
 // sender map on demand (spec 7.2.12). Each Resync regenerates its files from the
 // database and reloads its daemon, so the button doubles as a drift-recovery.
+// The button lives on the status page (phase 13.D): it is a "put the daemons
+// back in the state the database describes" action, which belongs with the rest
+// of the server-health screen rather than in the domain list's top bar.
 func (s *Server) handleReload(w http.ResponseWriter, r *http.Request) {
 	if err := s.domains.Resync(); err != nil {
 		logf("panel: manual reload (opendkim): %v", err)
@@ -127,7 +132,7 @@ func (s *Server) handleReload(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "reload failed", http.StatusInternalServerError)
 		return
 	}
-	http.Redirect(w, r, "/?reloaded=1", http.StatusSeeOther)
+	http.Redirect(w, r, "/status?reloaded=1", http.StatusSeeOther)
 }
 
 // lookupDomain resolves the {id} path value to a domain, writing a 404 for a

internal/web/handlers_status.go

@@ -0,0 +1,131 @@
+package web
+
+import (
+	"net/http"
+	"strings"
+
+	"codeberg.org/mix/selfpost/internal/health"
+)
+
+// handleStatus renders the server status page: the panel's landing page and the
+// one screen that answers "is the service healthy and will mail be accepted"
+// (phase 13.A). The cheap local checks live in the polled "status_body"
+// fragment; the hostname/PTR lookup and the configuration reload sit outside it,
+// because neither belongs on a five-second timer.
+func (s *Server) handleStatus(w http.ResponseWriter, r *http.Request) {
+	data := s.statusBody()
+	srv := s.dns.Server(s.cfg.Hostname, false)
+
+	data["Title"] = "SelfPost — status"
+	data["User"] = currentUser(r)
+	data["Active"] = "status"
+	data["Flash"] = statusFlash(r)
+	data["Hostname"] = s.cfg.Hostname
+	data["PTR"] = srv.PTR
+	s.render(w, http.StatusOK, "status", data)
+}
+
+// handleStatusFragment serves the HTMX polling fragment for the local checks
+// (spec 7.1: fragment endpoints return HTML, not JSON).
+func (s *Server) handleStatusFragment(w http.ResponseWriter, _ *http.Request) {
+	s.renderFragment(w, http.StatusOK, "status_body", s.statusBody())
+}
+
+// handleStatusRecheck forces a fresh hostname/PTR lookup, bypassing the cache,
+// and returns to the page. DNS is the one part of this screen that talks to the
+// network, so it refreshes on demand rather than with the poll.
+func (s *Server) handleStatusRecheck(w http.ResponseWriter, r *http.Request) {
+	s.dns.Server(s.cfg.Hostname, true)
+	http.Redirect(w, r, "/status?rechecked=1", http.StatusSeeOther)
+}
+
+// statusBody collects the four local checks the fragment renders. Each one
+// reports its own problem rather than failing the page, so a broken component
+// costs one line and not the whole screen.
+func (s *Server) statusBody() map[string]any {
+	procs, procErr := health.Processes()
+	procStatus := health.StatusUnknown
+	if procErr != nil {
+		// Outside the container (or if the control socket is gone) there is
+		// nothing to report — "unknown", not "everything is broken".
+		logf("panel: status: supervisorctl: %v", procErr)
+	} else {
+		for _, p := range procs {
+			procStatus = health.Worst(procStatus, p.Status)
+		}
+	}
+
+	queueText, queueErr := readQueue()
+	queueStatus := health.StatusOK
+	if queueErr != "" {
+		queueStatus = health.StatusWarn
+	}
+
+	cert := health.CheckCertificate(s.cfg.TLSCertFile)
+	sockets := []health.Socket{
+		// OpenDKIM signs every outgoing message and Postfix is configured to
+		// tempfail without it: a missing socket stops mail.
+		health.CheckSocket("OpenDKIM", s.cfg.OpenDKIMSocket, true),
+		// The journal-milter only records the send log and fails open.
+		health.CheckSocket("send-log", s.cfg.JournalSocket, false),
+	}
+	socketStatus := health.StatusUnknown
+	for _, sock := range sockets {
+		socketStatus = health.Worst(socketStatus, sock.Status)
+	}
+
+	overall := health.Worst(procStatus, queueStatus, cert.Status, socketStatus)
+	return map[string]any{
+		"Processes":      procs,
+		"ProcessError":   procErr != nil,
+		"ProcessStatus":  procStatus,
+		"QueueSummary":   queueSummary(queueText),
+		"QueueError":     queueErr,
+		"QueueStatus":    queueStatus,
+		"Cert":           cert,
+		"Sockets":        sockets,
+		"SocketStatus":   socketStatus,
+		"OverallStatus":  overall,
+		"OverallHeading": overallHeading(overall),
+	}
+}
+
+// queueSummary reduces postqueue's listing to the one line worth showing on the
+// status page; the full listing has its own screen (spec 7.2.11). postqueue
+// prints either "Mail queue is empty" or a trailing "-- N Kbytes in M Requests."
+func queueSummary(out string) string {
+	lines := strings.Split(strings.TrimSpace(out), "\n")
+	for i := len(lines) - 1; i >= 0; i-- {
+		if line := strings.TrimSpace(lines[i]); line != "" {
+			return strings.TrimSpace(strings.TrimPrefix(line, "--"))
+		}
+	}
+	return ""
+}
+
+// overallHeading turns the worst check into the page's one-line verdict.
+func overallHeading(worst health.Status) string {
+	switch worst {
+	case health.StatusError:
+		return "A component needs attention — see the details below."
+	case health.StatusWarn:
+		return "Running, with warnings below."
+	case health.StatusOK:
+		return "All components are running normally."
+	default:
+		return "Some checks could not be performed."
+	}
+}
+
+// statusFlash maps a fixed redirect flag to a fixed message, so status text
+// after a redirect is never attacker-influenced.
+func statusFlash(r *http.Request) string {
+	switch {
+	case r.URL.Query().Get("reloaded") != "":
+		return "Configuration regenerated from the database; OpenDKIM and Postfix have re-read it."
+	case r.URL.Query().Get("rechecked") != "":
+		return "DNS re-checked."
+	default:
+		return ""
+	}
+}

internal/web/templates.go

@@ -33,6 +33,7 @@ var pageFiles = map[string][]string{
 	"sendlog":       {"templates/sendlog.html", "templates/sendlog_rows.html"},
 	"queue":         {"templates/queue.html", "templates/queue_body.html"},
 	"logtail":       {"templates/logtail.html", "templates/logtail_body.html"},
+	"status":        {"templates/status.html", "templates/status_body.html"},
 }
 
 // fragmentFiles maps a fragment name (also its {{define}} block name) to its
@@ -41,6 +42,7 @@ var fragmentFiles = map[string]string{
 	"sendlog_rows": "templates/sendlog_rows.html",
 	"queue_body":   "templates/queue_body.html",
 	"logtail_body": "templates/logtail_body.html",
+	"status_body":  "templates/status_body.html",
 }
 
 func loadTemplates() (*templates, error) {

internal/web/templates/dashboard.html

@@ -1,12 +1,5 @@
 {{define "content"}}
-<div class="topbar">
-  <h1>SelfPost</h1>
-  <div class="actions muted">
-    <form class="inline" method="post" action="/reload">
-      <button type="submit">Reload</button>
-    </form>
-  </div>
-</div>
+<h1>Domains</h1>
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
 

internal/web/templates/domain_detail.html

@@ -1,7 +1,7 @@
 {{define "content"}}
 <h1>{{.Domain.Name}}</h1>
 
-<a class="back" href="/">&larr; All domains</a>
+<a class="back" href="/domains">&larr; All domains</a>
 
 {{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
 {{if .RateLimitErr}}<div class="flash error">{{.RateLimitErr}}</div>{{end}}
@@ -48,6 +48,36 @@
   documentation). Mail is signed with selector <strong>{{.Domain.DKIMSelector}}</strong>.</p>
 </div>
 
+<div class="card">
+  <h2>DNS status <span class="st st-{{.DNS.Overall}}">{{.DNS.Overall}}</span></h2>
+  <p class="muted">What DNS publishes for <strong>{{.Domain.Name}}</strong> right
+  now, checked against the key this server signs with. Results are cached for a
+  few minutes — after publishing a record, use <em>Re-check</em>.</p>
+
+  <label>DKIM <span class="st st-{{.DNS.DKIM.Status}}">{{.DNS.DKIM.Status}}</span></label>
+  <p class="{{if eq .DNS.DKIM.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DKIM.Detail}}</p>
+  {{if .DNS.DKIM.Records}}<span class="code">{{range .DNS.DKIM.Records}}{{.}}
+{{end}}</span>{{end}}
+
+  <label>SPF <span class="st st-{{.DNS.SPF.Status}}">{{.DNS.SPF.Status}}</span></label>
+  <p class="{{if eq .DNS.SPF.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.SPF.Detail}}</p>
+  {{if .DNS.SPF.Records}}<span class="code">{{range .DNS.SPF.Records}}{{.}}
+{{end}}</span>{{end}}
+  <p class="muted">The SPF check is deliberately shallow: it looks for a
+  mechanism that literally covers this server's address and does not follow
+  <code>include:</code> or <code>redirect=</code>, so a record that authorises
+  the server through an include is reported as “cannot tell”, not as a failure.</p>
+
+  <label>DMARC <span class="st st-{{.DNS.DMARC.Status}}">{{.DNS.DMARC.Status}}</span></label>
+  <p class="{{if eq .DNS.DMARC.Status "ok"}}muted{{else}}error{{end}}">{{.DNS.DMARC.Detail}}</p>
+  {{if .DNS.DMARC.Records}}<span class="code">{{range .DNS.DMARC.Records}}{{.}}
+{{end}}</span>{{end}}
+
+  <form class="inline" method="post" action="/domains/{{.Domain.ID}}/dns-recheck">
+    <button type="submit">Re-check</button>
+  </form>
+</div>
+
 <div class="card">
   <h2>Sending server settings</h2>
   <p class="muted">Point the mail client or script at these settings and

internal/web/templates/layout.html

@@ -92,6 +92,24 @@
   @media (prefers-color-scheme: dark) {
     .nav .links [aria-current] { color: #e6e8eb !important; background: #22303f !important; }
   }
+  /* Status badges: one vocabulary (ok/warn/error/unknown) shared by the server
+     status page and the per-domain DNS checks, so a colour means the same thing
+     everywhere. The class suffix is the check's own status value. */
+  .st {
+    display: inline-block; padding: 0.05rem 0.45rem; border-radius: 999px;
+    font-size: 0.7rem; font-weight: 700; text-transform: uppercase; letter-spacing: 0.04em;
+    vertical-align: middle; border: 1px solid transparent;
+  }
+  .st-ok { background: #ecfdf3; color: #067647; border-color: #abefc6; }
+  .st-warn { background: #fffaeb; color: #b54708; border-color: #fedf89; }
+  .st-error { background: #fef3f2; color: #b42318; border-color: #fecdca; }
+  .st-unknown { background: #f0f2f4; color: #6b7280; border-color: #e2e5e9; }
+  @media (prefers-color-scheme: dark) {
+    .st-ok { background: #0d2818 !important; color: #75d99b !important; border-color: #1a5336 !important; }
+    .st-warn { background: #2e2308 !important; color: #f5c86b !important; border-color: #6b5210 !important; }
+    .st-error { background: #2d1211 !important; color: #f5a29b !important; border-color: #6b201a !important; }
+    .st-unknown { background: #22262b !important; color: #9aa3ad !important; border-color: #2b3138 !important; }
+  }
   .code-row { display: flex; align-items: flex-start; gap: 0.5rem; }
   .code-row .code { flex: 1; min-width: 0; }
   button.copy {
@@ -121,7 +139,8 @@
 {{define "nav"}}
 <nav class="nav">
   <div class="links">
-    {{if eq .Active "domains"}}<span aria-current="page">Domains</span>{{else}}<a href="/">Domains</a>{{end}}
+    {{if eq .Active "status"}}<span aria-current="page">Status</span>{{else}}<a href="/status">Status</a>{{end}}
+    {{if eq .Active "domains"}}<span aria-current="page">Domains</span>{{else}}<a href="/domains">Domains</a>{{end}}
     {{if eq .Active "sendlog"}}<span aria-current="page">Send log</span>{{else}}<a href="/sendlog">Send log</a>{{end}}
     {{if eq .Active "queue"}}<span aria-current="page">Queue</span>{{else}}<a href="/queue">Queue</a>{{end}}
     {{if eq .Active "logtail"}}<span aria-current="page">Log</span>{{else}}<a href="/logtail">Log</a>{{end}}

internal/web/templates/status.html

@@ -0,0 +1,43 @@
+{{define "content"}}
+<h1>Server status</h1>
+
+{{if .Flash}}<div class="flash">{{.Flash}}</div>{{end}}
+
+{{template "status_body" .}}
+
+<div class="card">
+  <h2>Hostname and reverse DNS <span class="st st-{{.PTR.Status}}">{{.PTR.Status}}</span></h2>
+  <p class="muted">Receiving servers check that the name this server announces
+  resolves to its address <em>and</em> that the address resolves back to the same
+  name (forward-confirmed reverse DNS). A missing or mismatched reverse record is
+  the most common reason self-hosted mail is rejected or scored as spam. The
+  reverse record is set at the hosting provider, not in the domain's DNS zone.</p>
+
+  <label>Server hostname</label>
+  <span class="code">{{if .Hostname}}{{.Hostname}}{{else}}(SELFPOST_HOSTNAME is not set){{end}}</span>
+
+  {{if .PTR.Records}}
+  <label>Forward and reverse lookup</label>
+  <span class="code">{{range .PTR.Records}}{{.}}
+{{end}}</span>
+  {{end}}
+
+  <p class="{{if eq .PTR.Status "ok"}}muted{{else}}error{{end}}">{{.PTR.Detail}}</p>
+
+  <form class="inline" method="post" action="/status/recheck">
+    <button type="submit">Re-check DNS</button>
+  </form>
+</div>
+
+<div class="card">
+  <h2>Configuration</h2>
+  <p class="muted">Regenerates the OpenDKIM and Postfix configuration from the
+  database and reloads both daemons. Use it if you edited the files by hand,
+  restored a backup, or the running configuration looks out of step with the
+  domain and application lists. It does not touch the mail queue or the TLS
+  certificate, and it is safe to run at any time.</p>
+  <form class="inline" method="post" action="/reload">
+    <button type="submit">Reload configuration</button>
+  </form>
+</div>
+{{end}}

internal/web/templates/status_body.html

@@ -0,0 +1,65 @@
+{{define "status_body"}}
+<div id="status-body" hx-get="/status/fragment" hx-trigger="every 5s" hx-swap="outerHTML">
+  <div class="card">
+    <h2>Overall <span class="st st-{{.OverallStatus}}">{{.OverallStatus}}</span></h2>
+    <p class="muted">{{.OverallHeading}}</p>
+  </div>
+
+  <div class="card">
+    <h2>Processes <span class="st st-{{.ProcessStatus}}">{{.ProcessStatus}}</span></h2>
+    {{if .ProcessError}}
+    <p class="error">Could not ask supervisord for the process list.</p>
+    {{else}}
+    <table>
+      <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
+      <tbody>
+        {{range .Processes}}
+        <tr>
+          <td>{{.Name}}</td>
+          <td><span class="st st-{{.Status}}">{{.State}}</span></td>
+          <td class="muted">{{.Detail}}</td>
+        </tr>
+        {{end}}
+      </tbody>
+    </table>
+    {{end}}
+  </div>
+
+  <div class="card">
+    <h2>Mail queue <span class="st st-{{.QueueStatus}}">{{.QueueStatus}}</span></h2>
+    {{if .QueueError}}
+    <p class="error">{{.QueueError}}</p>
+    {{else}}
+    <p>{{if .QueueSummary}}{{.QueueSummary}}{{else}}Mail queue is empty.{{end}}
+    <a href="/queue">Full queue</a></p>
+    {{end}}
+  </div>
+
+  <div class="card">
+    <h2>TLS certificate <span class="st st-{{.Cert.Status}}">{{.Cert.Status}}</span></h2>
+    <p class="muted">The certificate Postfix serves on port 465{{if .Cert.Subject}} ({{.Cert.Subject}}){{end}}.
+    It is supplied by the reverse proxy through a read-only mount; SelfPost only reads it.</p>
+    {{if not .Cert.NotAfter.IsZero}}
+    <label>Expires</label>
+    <span class="code">{{.Cert.NotAfter.UTC.Format "2006-01-02 15:04 UTC"}}</span>
+    {{end}}
+    <p class="{{if eq .Cert.Status "ok"}}muted{{else}}error{{end}}">{{.Cert.Detail}}</p>
+  </div>
+
+  <div class="card">
+    <h2>Milter sockets <span class="st st-{{.SocketStatus}}">{{.SocketStatus}}</span></h2>
+    <table>
+      <thead><tr><th>Milter</th><th>Socket</th><th>State</th></tr></thead>
+      <tbody>
+        {{range .Sockets}}
+        <tr>
+          <td>{{.Name}}</td>
+          <td class="muted">{{.Path}}</td>
+          <td><span class="st st-{{.Status}}">{{.Status}}</span> {{.Detail}}</td>
+        </tr>
+        {{end}}
+      </tbody>
+    </table>
+  </div>
+</div>
+{{end}}

internal/web/templates_test.go

@@ -2,8 +2,13 @@ package web
 
 import (
 	"bytes"
+	"io/fs"
+	"path"
 	"strings"
 	"testing"
+	"time"
+
+	"codeberg.org/mix/selfpost/internal/health"
 )
 
 // The navigation is rendered from the layout, not copied into each page, so
@@ -45,3 +50,122 @@ func TestNavMarksActivePage(t *testing.T) {
 		t.Errorf("inactive pages are not linked:\n%s", out)
 	}
 }
+
+func TestNavLeadsWithStatusAndPointsDomainsAtItsOwnPath(t *testing.T) {
+	tmpl, err := loadTemplates()
+	if err != nil {
+		t.Fatalf("loadTemplates: %v", err)
+	}
+	var buf bytes.Buffer
+	if err := tmpl.pages["status"].ExecuteTemplate(&buf, "nav", map[string]any{
+		"User":   "admin",
+		"Active": "status",
+	}); err != nil {
+		t.Fatalf("execute nav: %v", err)
+	}
+	out := buf.String()
+	if !strings.Contains(out, `<span aria-current="page">Status</span>`) {
+		t.Errorf("the status page is not marked active:\n%s", out)
+	}
+	if !strings.Contains(out, `href="/domains"`) {
+		t.Errorf("Domains does not link to /domains:\n%s", out)
+	}
+	if strings.Index(out, "Status") > strings.Index(out, "Domains") {
+		t.Errorf("Status is not the first navigation entry:\n%s", out)
+	}
+}
+
+// Since the panel root now redirects to the status page, a link left pointing at
+// "/" silently lands on the wrong screen instead of failing — so no template may
+// contain one (phase 13.C).
+func TestNoTemplateLinksToTheBareRoot(t *testing.T) {
+	forEachTemplate(t, func(name, body string) {
+		if strings.Contains(body, `href="/"`) {
+			t.Errorf(`%s links to "/", which is now the status redirect; link to /domains (or the intended page) instead`, name)
+		}
+	})
+}
+
+// The reload action is a server-health control and lives only on the status
+// page (phase 13.D).
+func TestReloadFormLivesOnlyOnTheStatusPage(t *testing.T) {
+	forEachTemplate(t, func(name, body string) {
+		if strings.Contains(body, `action="/reload"`) && name != "status.html" {
+			t.Errorf("%s still posts to /reload; the reload control belongs on the status page", name)
+		}
+	})
+}
+
+func TestStatusPageRendersEveryCheck(t *testing.T) {
+	tmpl, err := loadTemplates()
+	if err != nil {
+		t.Fatalf("loadTemplates: %v", err)
+	}
+	var buf bytes.Buffer
+	err = tmpl.pages["status"].ExecuteTemplate(&buf, "layout.html", map[string]any{
+		"Title":  "SelfPost — status",
+		"User":   "admin",
+		"Active": "status",
+		"Processes": []health.Process{
+			{Name: "opendkim", State: "RUNNING", Detail: "pid 21", Status: health.StatusOK},
+			{Name: "postfix", State: "FATAL", Detail: "exited too quickly", Status: health.StatusError},
+		},
+		"ProcessStatus": health.StatusError,
+		"QueueSummary":  "Mail queue is empty",
+		"QueueStatus":   health.StatusOK,
+		"Cert": health.Certificate{
+			Path: "/etc/postfix/tls/fullchain.pem", Subject: "mail.example.com",
+			NotAfter: time.Now().Add(30 * 24 * time.Hour), DaysLeft: 30,
+			Status: health.StatusOK, Detail: "Valid for another 30 day(s).",
+		},
+		"Sockets": []health.Socket{
+			{Name: "OpenDKIM", Path: "/run/opendkim/opendkim.sock", Present: true, Status: health.StatusOK, Detail: "Listening."},
+		},
+		"SocketStatus":   health.StatusOK,
+		"OverallStatus":  health.StatusError,
+		"OverallHeading": "A component needs attention — see the details below.",
+		"Hostname":       "mail.example.com",
+		"PTR": dnscheckResult{
+			Status:  health.StatusError,
+			Detail:  "No address has a reverse record.",
+			Records: []string{"203.0.113.10 → no PTR record"},
+		},
+	})
+	if err != nil {
+		t.Fatalf("execute status page: %v", err)
+	}
+	out := buf.String()
+	for _, want := range []string{
+		"opendkim", "FATAL", "Mail queue is empty", "mail.example.com",
+		"203.0.113.10 → no PTR record", `action="/reload"`,
+		`hx-get="/status/fragment"`, `class="st st-error"`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("status page is missing %q", want)
+		}
+	}
+}
+
+// dnscheckResult mirrors dnscheck.Result's shape for the template test, so the
+// web package's template tests do not depend on the checker's constructor.
+type dnscheckResult struct {
+	Status  health.Status
+	Detail  string
+	Records []string
+}
+
+// forEachTemplate runs fn over every embedded template's source.
+func forEachTemplate(t *testing.T, fn func(name, body string)) {
+	t.Helper()
+	entries, err := fs.ReadDir(assetsFS, "templates")
+	if err != nil {
+		t.Fatalf("read templates: %v", err)
+	}
+	for _, e := range entries {
+		body, err := fs.ReadFile(assetsFS, path.Join("templates", e.Name()))
+		if err != nil {
+			t.Fatalf("read %s: %v", e.Name(), err)
+		}
+		fn(e.Name(), string(body))
+	}
+}

internal/web/web.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	"codeberg.org/mix/selfpost/internal/app"
+	"codeberg.org/mix/selfpost/internal/dnscheck"
 	"codeberg.org/mix/selfpost/internal/domain"
 	"codeberg.org/mix/selfpost/internal/store"
 )
@@ -49,6 +50,15 @@ type Config struct {
 	// honoured, so the header can't be spoofed by anyone but a trusted proxy.
 	// Empty (the default) keeps rate-limiting keyed on RemoteAddr only.
 	TrustedProxyCIDRs []*net.IPNet
+	// TLSCertFile is the certificate Postfix serves on 465/587 (spec 8), read
+	// read-only by the status page to report how much validity is left.
+	TLSCertFile string
+	// OpenDKIMSocket and JournalSocket are the two milter sockets Postfix
+	// connects to. The status page stats them: the first is required for mail
+	// to leave at all (OpenDKIM runs with default_action=tempfail), the second
+	// only for the send log (the journal-milter fails open).
+	OpenDKIMSocket string
+	JournalSocket  string
 }
 
 // Server is the panel HTTP application.
@@ -60,6 +70,7 @@ type Server struct {
 	tmpl     *templates
 	sessions *sessionStore
 	setup    *setupManager
+	dns      *dnscheck.Checker
 
 	loginLimiter *rateLimiter
 	setupLimiter *rateLimiter
@@ -83,6 +94,10 @@ func New(st *store.Store, domains *domain.Service, apps *app.Service, cfg Config
 		cfg:      cfg,
 		tmpl:     tmpl,
 		sessions: newSessionStore(),
+		// Published-DNS checks for the status page and the domain pages. The
+		// checker caches its own results, so page views do not each pay for a
+		// round of lookups (phase 13).
+		dns: dnscheck.New(),
 		// Setup: a handful of attempts per minute per IP is plenty for a
 		// legitimate admin and blunts automated probing (spec 7.6.1).
 		setupLimiter: newRateLimiter(10, time.Minute),
@@ -122,10 +137,20 @@ func (s *Server) Handler() http.Handler {
 	// Authenticated panel. Everything not matched by a more specific pattern
 	// above falls through to this sub-mux, wrapped once in the auth middleware.
 	authed := http.NewServeMux()
-	authed.HandleFunc("GET /{$}", s.handleDashboard)
+
+	// The landing page is the server status (phase 13.C): the first thing an
+	// administrator should see after logging in is whether the service is
+	// healthy, not the domain list. handleLogin still redirects to "/".
+	authed.HandleFunc("GET /{$}", redirectToStatus)
+	authed.HandleFunc("GET /status", s.handleStatus)
+	authed.HandleFunc("GET /status/fragment", s.handleStatusFragment)
+	authed.HandleFunc("POST /status/recheck", s.handleStatusRecheck)
+
+	authed.HandleFunc("GET /domains", s.handleDashboard)
 	authed.HandleFunc("POST /domains", s.handleAddDomain)
 	authed.HandleFunc("POST /domains/import", s.handleImportDomain)
 	authed.HandleFunc("GET /domains/{id}", s.handleDomainDetail)
+	authed.HandleFunc("POST /domains/{id}/dns-recheck", s.handleDomainDNSRecheck)
 	authed.HandleFunc("GET /domains/{id}/delete", s.handleDeleteConfirm)
 	authed.HandleFunc("POST /domains/{id}/delete", s.handleDeleteDomain)
 	authed.HandleFunc("POST /domains/{id}/applications", s.handleAddApplication)
@@ -159,6 +184,12 @@ func (s *Server) Handler() http.Handler {
 	return mux
 }
 
+// redirectToStatus points the panel root at the status page, so there is one
+// canonical URL for that content instead of two (phase 13.C).
+func redirectToStatus(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, "/status", http.StatusSeeOther)
+}
+
 func handleHealth(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 	w.WriteHeader(http.StatusOK)