from-header-binding: the sender check, what it costs, its pages; guide, architecture, security

A message's From: line is held against the application that sends it, under
the rule Postfix holds the envelope sender to. OpenDKIM chooses the key by
that line, so until now an application could have mail signed as another
domain of the server or as the server itself.

The check (internal/milter/sender.go)
- A role of the panel on a socket of its own (SENDER_CHECK_SOCKET), first in
  smtpd_milters and strict: default_action=tempfail. The journal milter keeps
  its socket and stays fail-open. postfix-wrapper waits for the new socket.
- It reads no database: what an application may send as comes from Postfix's
  own sender_login_maps, what the server signs for from OpenDKIM's
  SigningTable. Both are read again when they change; one that cannot be
  read defers mail.
- One From: field, one address, allowed by the envelope's lookup; then no
  other name of the SigningTable may appear anywhere in the raw line.
  Refused: 550 5.7.1 naming the line, reduced to printable ASCII.
- A refusal is a send-log row with reason "from" and the header address
  (migration 0006), written by another goroutine and not waited for. The
  journal's refusals record their reason too (limit, client), and the
  notifier takes only a limit's.

What it costs (docs/plans/from-header-binding.md, Statistics)
- The role marks itself alive every 2 s; at start the gap since the mark is
  downtime, counted from Postfix's start if later and not at all when
  supervisord says Postfix is not running.
- The log tailer counts the connections Postfix turned away: a warning that
  names the socket, then milter-reject "Service unavailable" from the same
  smtpd. Seen on the stand: the client is refused from CONNECT on and leaves
  at AUTH (454), so no MAIL line is ever written.
- sender_check_days, a row per UTC day, kept a year.

Pages
- Health: the card "Sender check", the socket's row, and the cards layout -
  boxes numbered by importance in two stacks read in rows; the left stack
  polls, the three readings of the right one are swapped in by id.
- Outbound log: a refused row says why in its tag (wrong From, wrong client,
  rate-limited); the message's page shows the From: line and what the
  application may send as.
- Help: topic "Sender check", word for word the mockup's.

Found by the stand, fixed here: the names for the second look came from the
sender bindings, and a domain with a key and no application yet was not
among them.

e2e: negative_journal_milter_fail_open is gone - it proved that mail passes
with the panel down, which is no longer so. In its place
sender_check_holds_the_from_line (another domain's From:, the hostname's, a
stranger's, an address off the list, another sender in the display name -
refused; own addresses - delivered) and panel_down_defers_mail (4xx with the
panel stopped, the container alive, mail again after, downtime and one
deferred message on Health, the card warning).

Test server, this tree before the last cosmetic edits (a fixture row, a
fact's size, docs): go vet ok, go test 23 packages ok, make e2e ok (337 s).
Locally after them: internal/web/view ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/health.go

@@ -1,30 +1,38 @@
 package view
 
+import (
+	"strconv"
+	"time"
+)
+
 // The data of Server › Health (templates/health.html, mockup health.html):
 // every check behind the cards of Overview, as tables, and the home of the two
 // server actions, Re-check DNS and Reload configuration.
 //
-// Two rows of the page are polled (templates/health_body.html): the handler
-// builds the same Health for the page and for its fragment, and the fragment
-// carries Refresh so that its second row is swapped in out of band.
+// The page is two stacks of boxes numbered by importance (the `cards` layout),
+// and all but the Configuration box are polled (templates/health_body.html):
+// the handler builds the same Health for the page and for its fragment, and
+// AsFragment marks what the fragment swaps in out of band.
 
 // Health is the data of the Health page.
 type Health struct {
 	Meta
-	Head  Head
-	Flash *Flash
-	// Refresh is set on the polled fragment only. The fragment answers with two
-	// sibling rows; the first replaces the element that polls, and the second
-	// is marked to be swapped into place by its id.
-	Refresh bool
-
-	Machine     Box
-	MachineRows []MachineRow
-
+	Head         Head
+	Flash        *Flash
 	Processes    Box
 	ProcessRows  []ProcessRow
 	ProcessError bool
 
+	// SenderCheck is what the strict check of the From: line has cost: for how
+	// long the panel did not answer while Postfix was running, and how many
+	// messages were deferred for it. SenderNote is the line under its table.
+	SenderCheck Box
+	SenderRows  []SenderCheckRow
+	SenderNote  Text
+
+	Machine     Box
+	MachineRows []MachineRow
+
 	Certificate Box
 	CertFacts   []Fact
 	CertDetail  string
@@ -37,8 +45,7 @@ type Health struct {
 
 	// NotifyMail is the card of the DNS records notifications are signed and
 	// authorised with (their values are under Server › Settings); NotifyNote
-	// is the line under its table. It is polled with the rest, so Refresh swaps
-	// it into place on its own.
+	// is the line under its table.
 	NotifyMail Box
 	NotifyRows []MailRow
 	NotifyNote Text
@@ -47,6 +54,13 @@ type Health struct {
 	Reload        Action
 }
 
+// SenderCheckRow is one period of the Sender check table.
+type SenderCheckRow struct {
+	Period   string
+	Down     string
+	Deferred string
+}
+
 // MachineRow is one line of the Machine table. A row that is a level (CPU,
 // memory) carries a Gauge; one that is a rate (network) carries Usage text; a
 // reading that could not be taken carries neither and shows a dash. Detail is
@@ -122,14 +136,17 @@ func NewHealth(m Meta, flash string) *Health {
 			Lead:    Plain("Everything behind the cards on Overview. Refreshes automatically."),
 			Actions: []Action{{Label: "Re-check DNS", Icon: "ti-refresh", Post: "/server/health/recheck"}},
 		},
-		Machine:     Box{No: "01", Title: "Machine", ID: "machine", Help: topicLink(HelpChecks, "What these readings mean")},
-		Processes:   Box{No: "02", Title: "Processes", ID: "processes"},
-		Certificate: Box{No: "03", Title: "TLS certificate", ID: "certificate", Help: topicLink(HelpCertificate, "When it warns and what to do")},
-		Sockets:     Box{No: "04", Title: "Milter sockets", ID: "sockets"},
+		// Numbered by importance; the odd ones are the left stack.
+		Processes: Box{No: "01", Title: "Processes", ID: "processes"},
+		Sockets:   Box{No: "02", Title: "Milter sockets", ID: "sockets"},
+		SenderCheck: Box{No: "03", Title: "Sender check", ID: "sender-check",
+			Help: topicLink(HelpSenderCheck, "What is checked and what these numbers are for")},
+		Certificate: Box{No: "04", Title: "TLS certificate", ID: "certificate", Help: topicLink(HelpCertificate, "When it warns and what to do")},
 		Hostname:    Box{No: "05", Title: "Hostname and reverse DNS", ID: "hostname", Help: topicLink(HelpRDNS, "Forward and reverse DNS")},
 		NotifyMail: Box{No: "06", Title: "Notification mail", ID: "notification-mail",
 			Help: topicLink(HelpNotifications, "What the panel sends and what makes it arrive")},
-		Configuration: Box{No: "07", Title: "Configuration", ID: "configuration",
+		Machine: Box{No: "07", Title: "Machine", ID: "machine", Help: topicLink(HelpChecks, "What these readings mean")},
+		Configuration: Box{No: "08", Title: "Configuration", ID: "configuration",
 			End: Plain("Safe to run at any time")},
 		Reload: Action{Label: "Reload configuration", Icon: "ti-reload", Post: "/server/health/reload"},
 	}
@@ -150,5 +167,39 @@ func (h *Health) WithNotificationMail(from string, rows []MailRow, status string
 	return h
 }
 
+// WithSenderCheck fills the Sender check card: its three periods, the first
+// day counted ("" before any was) and the card's verdict.
+func (h *Health) WithSenderCheck(rows []SenderCheckRow, since, status string) *Health {
+	h.SenderCheck.End = Verdict(status)
+	h.SenderRows = rows
+	h.SenderNote = Rich("The panel holds each message's ", Code("From:"),
+		" against the application that sends it. While the panel does not answer, Postfix defers mail instead of accepting it unchecked. Time is counted only while Postfix itself was running.")
+	if since != "" {
+		h.SenderNote = append(h.SenderNote, Rich(" Counted since ", Mono(since), ".")...)
+	}
+	return h
+}
+
+// AsFragment makes the page its polled fragment: the left stack replaces the
+// element that polls, and the three readings of the right stack are marked to
+// be swapped into place by their ids.
+func (h *Health) AsFragment() *Health {
+	h.Sockets.OOB, h.Certificate.OOB, h.NotifyMail.OOB = true, true, true
+	return h
+}
+
+// Downtime prints a length of time the way the Sender check table does: whole
+// seconds while they say something, then minutes, then hours.
+func Downtime(d time.Duration) string {
+	secs := int64(d / time.Second)
+	switch {
+	case secs < 60:
+		return strconv.FormatInt(secs, 10) + " s"
+	case secs < 3600:
+		return strconv.FormatInt(secs/60, 10) + " min " + strconv.FormatInt(secs%60, 10) + " s"
+	}
+	return strconv.FormatInt(secs/3600, 10) + " h " + strconv.FormatInt(secs%3600/60, 10) + " min"
+}
+
 // Verdict puts a check's status in the end slot of its box, as the mockup does.
 func Verdict(status string) Text { return Text{TagOf(status, "")} }