from-header-binding: the sender check, what it costs, its pages; guide, architecture, security

A message's From: line is held against the application that sends it, under
the rule Postfix holds the envelope sender to. OpenDKIM chooses the key by
that line, so until now an application could have mail signed as another
domain of the server or as the server itself.

The check (internal/milter/sender.go)
- A role of the panel on a socket of its own (SENDER_CHECK_SOCKET), first in
  smtpd_milters and strict: default_action=tempfail. The journal milter keeps
  its socket and stays fail-open. postfix-wrapper waits for the new socket.
- It reads no database: what an application may send as comes from Postfix's
  own sender_login_maps, what the server signs for from OpenDKIM's
  SigningTable. Both are read again when they change; one that cannot be
  read defers mail.
- One From: field, one address, allowed by the envelope's lookup; then no
  other name of the SigningTable may appear anywhere in the raw line.
  Refused: 550 5.7.1 naming the line, reduced to printable ASCII.
- A refusal is a send-log row with reason "from" and the header address
  (migration 0006), written by another goroutine and not waited for. The
  journal's refusals record their reason too (limit, client), and the
  notifier takes only a limit's.

What it costs (docs/plans/from-header-binding.md, Statistics)
- The role marks itself alive every 2 s; at start the gap since the mark is
  downtime, counted from Postfix's start if later and not at all when
  supervisord says Postfix is not running.
- The log tailer counts the connections Postfix turned away: a warning that
  names the socket, then milter-reject "Service unavailable" from the same
  smtpd. Seen on the stand: the client is refused from CONNECT on and leaves
  at AUTH (454), so no MAIL line is ever written.
- sender_check_days, a row per UTC day, kept a year.

Pages
- Health: the card "Sender check", the socket's row, and the cards layout -
  boxes numbered by importance in two stacks read in rows; the left stack
  polls, the three readings of the right one are swapped in by id.
- Outbound log: a refused row says why in its tag (wrong From, wrong client,
  rate-limited); the message's page shows the From: line and what the
  application may send as.
- Help: topic "Sender check", word for word the mockup's.

Found by the stand, fixed here: the names for the second look came from the
sender bindings, and a domain with a key and no application yet was not
among them.

e2e: negative_journal_milter_fail_open is gone - it proved that mail passes
with the panel down, which is no longer so. In its place
sender_check_holds_the_from_line (another domain's From:, the hostname's, a
stranger's, an address off the list, another sender in the display name -
refused; own addresses - delivered) and panel_down_defers_mail (4xx with the
panel stopped, the container alive, mail again after, downtime and one
deferred message on Health, the card warning).

Test server, this tree before the last cosmetic edits (a fixture row, a
fact's size, docs): go vet ok, go test 23 packages ok, make e2e ok (337 s).
Locally after them: internal/web/view ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/plans/from-header-binding.md

@@ -80,7 +80,8 @@ in the last 24 hours; downtime that deferred nothing warns of nothing.
 - **In the Outbound log:** a row with the reason in the status tag -
   `wrong From`, beside `rate-limited` and the tag of a refused client address.
   The built panel wrote `rejected` for all of them; it follows the mockup now.
-  The status filter keeps one entry, `rejected`.
+  (The mockup's status filter is not built - the log filters by domain and
+  application - so there is nothing to keep in step with the tags.)
 - **On the message's page:** a fact *From: line* with the address written in
   the header, and a History step that says which address was refused, for
   which application, what that application may write, and that it was told
@@ -101,7 +102,30 @@ the fourth was not.
   beside a tall one and the eye still goes 01, 02, 03. On a phone the boxes
   come in the order of their numbers.
 
-## To settle while building
+## Settled while building
+
+- **The header is read twice.** One `From:` field holding one address, by
+  Go's parser; then every `@name` of the raw value is held against OpenDKIM's
+  own `SigningTable`. The first build took the names for the second look from
+  the sender bindings, and the e2e stand let a line through that named a
+  domain with a key and no application yet: a domain is a signing name from
+  the moment it is added, not from its first application.
+- **What Postfix writes when the check does not answer** (seen on the stand):
+  a warning naming the socket, then `milter-reject: CONNECT … 451 4.7.1
+  Service unavailable` and the same for `EHLO`; the client is told `454 4.3.0
+  Try again later` at `AUTH` and leaves. No `MAIL` is ever offered, so what
+  is counted is the connection turned away, once. The journal milter's
+  level-2 refusal is written in the same words, which is why a reject line
+  counts only after the warning.
+- **When Postfix started** is asked of supervisord (`supervisorctl status`,
+  the uptime of `postfix`).
+- **The reply** is a milter reply code, `550 5.7.1 From: <line> - <why>`; what
+  the client wrote is reduced to printable ASCII and cut first.
+- **The Delivery log box stays on a refused message's page**, with the one
+  sentence it already had for a message that never reached the queue; the
+  picture shown to the owner had left the box out.
+
+## To settle while building (as first written)
 
 - How the header is read so that the check and OpenDKIM cannot disagree: one
   `From:` field, one address, and a cruder second look at the raw value.
@@ -116,11 +140,11 @@ the fourth was not.
 ## Implementation checklist
 
 - [x] Mockups: Health card and layout, the log row, help topic; accepted by the owner 2026-10-12 (`design:` commit)
-- [ ] Migration and store: refusal reason and header address, days of the sender check
-- [ ] The check: a role of the panel on its own socket, bindings read from Postfix's file; Postfix attaches it strictly; start order
-- [ ] Statistics: the alive mark and downtime, deferred mail from `mail.log`
-- [ ] Panel: Health (card, sockets row, layout), Outbound log tags, the message's page, help
-- [ ] guide.md, architecture.md, security.md (the accepted risk goes), schema-migrations.md
-- [ ] `go vet`, `go test`, e2e: refused for another domain's `From:`, for the hostname's and for an address off the list; accepted for its own
+- [x] Migration and store: refusal reason and header address, days of the sender check (`0006_sender_check.sql`)
+- [x] The check: a role of the panel on its own socket, bindings read from Postfix's file; Postfix attaches it strictly; start order
+- [x] Statistics: the alive mark and downtime, deferred mail from `mail.log`
+- [x] Panel: Health (card, sockets row, layout), Outbound log tags, the message's page, help
+- [x] guide.md, architecture.md, security.md (the accepted risk goes), schema-migrations.md
+- [x] `go vet`, `go test`, e2e: refused for another domain's `From:`, for the hostname's and for an address off the list; accepted for its own (on the test server: vet ok, 23 packages ok, e2e ok - `sender_check_holds_the_from_line`, `panel_down_defers_mail`)
 - [ ] Technical review — **Opus**
 - [ ] Security review — **Fable**