from-header-binding: findings of the technical and security reviews

Both reviews were of c171fb5, read-only, given the code and questions.

Found by both, and the one that would have refused ordinary mail from the
first day: a folded From: line - what a mail library makes of a long display
name - did not parse and was refused with 550. The line is unfolded before it
is read. e2e sends one through Postfix now.

Technical (Opus)
- A display name in a charset Go does not convert (windows-1251, koi8-r) was
  refused: such a name is passed through unread, only the address is judged.
- The statistics ran between binding the socket and serving it, with a
  supervisorctl that has no timeout: they are kept beside the check now and
  nothing of them is waited for. A supervisorctl that fails is logged.
- The count of deferred mail followed smtpd's reject lines and so missed a
  check that stops answering in the middle of a message, where cleanup
  writes them: it is taken at Postfix's warning, the line that names the
  socket. The test line for that case had been invented with the wrong
  process; it is marked as composed from Postfix's source.
- A card whose figures could not be read showed zeros and "ok": dashes and
  "unknown".
- entrypoint removes the sockets a killed container left, which satisfied
  the wrapper's wait before the check was listening.
- Outside quoted strings the line may hold one "@" only - a rule that needs
  no knowledge of OpenDKIM's parser.
- Comments that still spoke of two sockets, or of a session replaced after a
  refusal; the limits of the cards layout on a phone, said where it is defined.

Security (Fable; no Critical or High)
- Another sender's name in an encoded display name passed the second look:
  the decoded name is looked at as well.
- A client could arm the deferred counter by sending the socket's name where
  Postfix quotes it in a warning: the two warnings are matched from their
  first word.
- A refused message wrote a row per recipient: one row, naming the first
  recipient and how many more.
- Docs: the check's lookup is stricter than Postfix's for address extensions
  and the case of logins, rather than "cannot disagree"; what a display name
  looks like to a person is not promised; the timeouts and the 454 at AUTH
  stated as they are; "messages" are connections turned away.

Left as found, in the plan: downtime that crosses midnight is booked on the
day of the restart; a message with the null envelope sender leaves a row
without a domain; a log read again after an unclean stop counts again.

Test server, this tree: go vet ok, go test 23 packages ok, make e2e ok (330 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/security.md

@@ -202,8 +202,14 @@ operator can act on it.
   signer. It reads the header as one field holding one address and then
   looks at the raw value once more for any other name of OpenDKIM's
   `SigningTable`, so that a line its parser and OpenDKIM's could read
-  differently is refused rather than argued about. What the client wrote
-  reaches the reply, the log and the send log only as printable ASCII, cut.
+  differently is refused rather than argued about; outside quoted strings
+  the line may hold one `@`. What this does not promise is what a display
+  name looks like to a person: a name of another sender written without an
+  `@` the scan can find (a full-width dot, a space inside the name) passes,
+  signed with the application's own key - a forged display name is as old
+  as mail, and no key of another's is involved. What the client wrote
+  reaches the reply, the log and the send log only as printable ASCII, cut,
+  and a refused message is one row of the log whatever its recipient count.
   Mail the panel submits itself does not pass the check: only root,
   `postfix` and the panel can submit locally. Architecture § Sender check.
 - **Inbound relay (optional, `INBOUND_RELAY_ENABLE`)** — port 25 is not an
@@ -459,8 +465,9 @@ deferred item from the roadmap.
   the rules arrive at.
 - **The sender check stops mail while the panel does not answer.** It is a
   role of the panel process, attached with `default_action=tempfail`, so a
-  panel that is down or slower than the milter timeouts (15 s a command)
-  defers every submission: availability of sending now depends on the panel,
+  panel that is down or slower than the milter timeouts (15 s to connect
+  and for a command, 30 s for the verdict at the end of the headers) defers
+  every submission: availability of sending now depends on the panel,
   which it did not before `2.4.0`. Chosen by the owner over the alternative,
   a check that is absent whenever the panel is - that one could be switched
   off by whoever can make the panel slow. Supervisord restarts the panel at