from-header-binding: the sender check, what it costs, its pages; guide, architecture, security

A message's From: line is held against the application that sends it, under
the rule Postfix holds the envelope sender to. OpenDKIM chooses the key by
that line, so until now an application could have mail signed as another
domain of the server or as the server itself.

The check (internal/milter/sender.go)
- A role of the panel on a socket of its own (SENDER_CHECK_SOCKET), first in
  smtpd_milters and strict: default_action=tempfail. The journal milter keeps
  its socket and stays fail-open. postfix-wrapper waits for the new socket.
- It reads no database: what an application may send as comes from Postfix's
  own sender_login_maps, what the server signs for from OpenDKIM's
  SigningTable. Both are read again when they change; one that cannot be
  read defers mail.
- One From: field, one address, allowed by the envelope's lookup; then no
  other name of the SigningTable may appear anywhere in the raw line.
  Refused: 550 5.7.1 naming the line, reduced to printable ASCII.
- A refusal is a send-log row with reason "from" and the header address
  (migration 0006), written by another goroutine and not waited for. The
  journal's refusals record their reason too (limit, client), and the
  notifier takes only a limit's.

What it costs (docs/plans/from-header-binding.md, Statistics)
- The role marks itself alive every 2 s; at start the gap since the mark is
  downtime, counted from Postfix's start if later and not at all when
  supervisord says Postfix is not running.
- The log tailer counts the connections Postfix turned away: a warning that
  names the socket, then milter-reject "Service unavailable" from the same
  smtpd. Seen on the stand: the client is refused from CONNECT on and leaves
  at AUTH (454), so no MAIL line is ever written.
- sender_check_days, a row per UTC day, kept a year.

Pages
- Health: the card "Sender check", the socket's row, and the cards layout -
  boxes numbered by importance in two stacks read in rows; the left stack
  polls, the three readings of the right one are swapped in by id.
- Outbound log: a refused row says why in its tag (wrong From, wrong client,
  rate-limited); the message's page shows the From: line and what the
  application may send as.
- Help: topic "Sender check", word for word the mockup's.

Found by the stand, fixed here: the names for the second look came from the
sender bindings, and a domain with a key and no application yet was not
among them.

e2e: negative_journal_milter_fail_open is gone - it proved that mail passes
with the panel down, which is no longer so. In its place
sender_check_holds_the_from_line (another domain's From:, the hostname's, a
stranger's, an address off the list, another sender in the display name -
refused; own addresses - delivered) and panel_down_defers_mail (4xx with the
panel stopped, the container alive, mail again after, downtime and one
deferred message on Health, the card warning).

Test server, this tree before the last cosmetic edits (a fixture row, a
fact's size, docs): go vet ok, go test 23 packages ok, make e2e ok (337 s).
Locally after them: internal/web/view ok.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/view/templates/components.html

@@ -84,11 +84,19 @@
      sp-credential (a secret shown once). A box foot, a table in its
      table-container, a run of records, a log or an empty state sit directly
      inside; anything else goes in body_open … body_close. */}}
-{{define "box_open"}}<div class="box{{if eq .Variant "danger"}} sp-danger-zone{{else if eq .Variant "credential"}} sp-credential{{end}}"{{if .ID}} id="{{.ID}}"{{end}}{{if .Poll}} data-poll aria-live="polite" hx-get="{{.Poll}}" hx-trigger="load" hx-swap="outerHTML"{{end}}{{if .DomainPick}} data-domain-pick{{end}}>
+{{define "box_open"}}<div class="box{{if eq .Variant "danger"}} sp-danger-zone{{else if eq .Variant "credential"}} sp-credential{{end}}"{{if .ID}} id="{{.ID}}"{{end}}{{if .OOB}} hx-swap-oob="true"{{end}}{{if .Poll}} data-poll aria-live="polite" hx-get="{{.Poll}}" hx-trigger="load" hx-swap="outerHTML"{{end}}{{if .DomainPick}} data-domain-pick{{end}}>
 {{template "box_head" .}}
 {{end}}
 {{define "box_close"}}</div>{{end}}
 
+{{/* cards_open starts the `cards` layout and cards_close ends it: two
+     `column is-6` stacks of numbered boxes that are read in rows, the odd ones
+     on the left and the even ones on the right, each stack closed up so that a
+     short box leaves no gap beside a tall one. On a phone the stacks dissolve
+     and the boxes come in the order of their numbers (panel.css). */}}
+{{define "cards_open"}}<div class="columns sp-cards">{{end}}
+{{define "cards_close"}}</div>{{end}}
+
 {{/* body_open pads the content of a box (box_body); body_close ends it. */}}
 {{define "body_open"}}<div class="sp-box-body">{{end}}
 {{define "body_close"}}</div>{{end}}

internal/web/view/templates/health.html

@@ -1,17 +1,18 @@
 {{/* Server > Health (mockup health.html): every check behind the cards of
-     Overview, and the one action that is not about DNS, Reload configuration. The
-     two rows of tables are the polled part (health_body.html), and so is the
-     Notification mail card (health_mail), which sits in the last row beside the
-     static Configuration box. */}}
+     Overview, and the one action that is not about DNS, Reload configuration.
+     The page is the `cards` layout: two stacks of boxes numbered by importance,
+     the odd ones on the left and the even ones on the right. Everything but
+     the Configuration box is polled (health_body.html). */}}
 {{define "content"}}
 {{template "page_head" .Head}}
 {{if .Flash}}{{template "flash" .Flash}}{{end}}
 
-{{template "health_body" .}}
-
-<div class="columns">
-  {{template "health_mail" .}}
+{{template "cards_open"}}
+  {{template "health_stack" .}}
   <div class="column is-6">
+    {{template "health_sockets" .}}
+    {{template "health_certificate" .}}
+    {{template "health_mail" .}}
     {{template "box_open" .Configuration}}
     {{template "body_open"}}
     <p class="mb-3">Regenerates the OpenDKIM and Postfix configuration from the database and reloads both daemons. Use it after editing the files by hand, after restoring a backup, or when the running configuration looks out of step with the domain and application lists. It does not touch the queue or the TLS certificate.</p>
@@ -19,5 +20,5 @@
     {{template "body_close"}}
     {{template "box_close"}}
   </div>
-</div>
+{{template "cards_close"}}
 {{end}}

internal/web/view/templates/health_body.html

@@ -1,80 +1,83 @@
-{{/* The polled part of Health: two rows of boxes, in the page and in its
-     fragment (GET /server/health/fragment) alike. panel.js polls the first row
-     (data-poll, outerHTML) and htmx swaps the second into place by its id when
-     the fragment marks it out of band (.Refresh) — the two rows are siblings, and
-     a fragment can replace only the element that asked for it. The Notification
-     mail card is the third thing the fragment swaps in by id: it sits in a row of
-     the page with the static Configuration box, so it is a column of its own. */}}
-{{define "health_body"}}<div class="columns" id="health-machine" data-poll aria-live="polite" hx-get="/server/health/fragment" hx-trigger="load" hx-swap="outerHTML">
-  <div class="column is-6">
-    {{template "box_open" .Machine}}
-    <div class="table-container"><table class="table is-fullwidth">
-      <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
-      <tbody>{{range .MachineRows}}
-        <tr><td>{{.Resource}}</td><td>{{if .Gauge}}<progress class="progress is-small {{.Gauge.Bar}} mb-1" value="{{.Gauge.Percent}}" max="100"></progress>{{.Gauge.Text}}{{else if .Usage}}<span class="sp-nowrap">{{.Usage}}</span>{{else}}<span class="sp-muted">—</span>{{end}}</td><td class="sp-muted">{{range .Detail}}<div>{{.}}</div>{{end}}</td></tr>{{end}}
-      </tbody>
-    </table></div>
-    {{template "box_close"}}
-  </div>
-  <div class="column is-6">
-    {{template "box_open" .Processes}}
-    {{if .ProcessError}}
-    {{template "body_open"}}
-    <p class="has-text-danger">Could not ask supervisord for the process list.</p>
-    {{template "body_close"}}
-    {{else}}
-    <div class="table-container"><table class="table is-fullwidth">
-      <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
-      <tbody>{{range .ProcessRows}}
-        <tr><td>{{.Name}}</td><td>{{template "tag" .State}}</td><td class="sp-muted">{{.Detail}}</td></tr>{{end}}
-      </tbody>
-    </table></div>
-    {{end}}
-    {{template "box_close"}}
-  </div>
-</div>
+{{/* The polled part of Health, in the page and in its fragment
+     (GET /server/health/fragment) alike. The left stack is the element that
+     polls (data-poll, outerHTML): all four of its boxes are readings. The right
+     stack ends in the static Configuration box, so its three readings are
+     swapped into place one by one, each box by its own id, when the fragment
+     marks them out of band (Health.AsFragment) - a fragment can replace only
+     the element that asked for it. */}}
+{{define "health_body"}}{{template "health_stack" .}}
+{{template "health_sockets" .}}
+{{template "health_certificate" .}}
+{{template "health_mail" .}}{{end}}
 
-<div class="columns" id="health-checks"{{if .Refresh}} hx-swap-oob="true"{{end}}>
-  <div class="column is-4">
-    {{template "box_open" .Certificate}}
-    {{template "body_open"}}
-    {{if .CertFacts}}{{template "facts" .CertFacts}}{{end}}
-    <p class="mt-4 {{if .CertProblem}}has-text-danger{{else}}sp-muted{{end}}">{{.CertDetail}}</p>
-    {{template "body_close"}}
-    {{template "box_close"}}
-  </div>
-  <div class="column is-4">
-    {{template "box_open" .Sockets}}
-    <div class="table-container"><table class="table is-fullwidth">
-      <thead><tr><th>Milter</th><th>State</th></tr></thead>
-      <tbody>{{range .SocketRows}}
-        <tr><td>{{.Name}}{{if .Note}} <span class="sp-muted">· {{.Note}}</span>{{end}}<br><span class="sp-muted sp-mono sp-small">{{.Path}}</span>{{if .Detail}}<br><span class="sp-muted sp-small">{{.Detail}}</span>{{end}}</td><td>{{template "tag" .State}}</td></tr>{{end}}
-      </tbody>
-    </table></div>
-    {{template "box_close"}}
-  </div>
-  <div class="column is-4">
-    {{template "box_open" .Hostname}}
-    {{template "body_open"}}
-    {{template "facts" .HostFacts}}
-    {{template "body_close"}}
-    {{template "box_close"}}
-  </div>
-</div>{{if .Refresh}}
-{{template "health_mail" .}}{{end}}{{end}}
-
-{{/* health_mail is the Notification mail card (the page calls it inside its own
-     row; the fragment sends it out of band). */}}
-{{define "health_mail"}}<div class="column is-6" id="health-mail"{{if .Refresh}} hx-swap-oob="true"{{end}}>
-  {{template "box_open" .NotifyMail}}
+{{/* health_stack is the left stack: Processes, Sender check, Hostname and
+     reverse DNS, Machine. */}}
+{{define "health_stack"}}<div class="column is-6" id="health-stack" data-poll aria-live="polite" hx-get="/server/health/fragment" hx-trigger="load" hx-swap="outerHTML">
+  {{template "box_open" .Processes}}
+  {{if .ProcessError}}
+  {{template "body_open"}}
+  <p class="has-text-danger">Could not ask supervisord for the process list.</p>
+  {{template "body_close"}}
+  {{else}}
   <div class="table-container"><table class="table is-fullwidth">
-    <thead><tr><th>Record</th><th>State</th></tr></thead>
-    <tbody>{{range .NotifyRows}}
-      <tr><td>{{.Name}}<br><span class="sp-muted sp-mono sp-small">{{.Host}}</span></td><td>{{template "tag" .State}}</td></tr>{{end}}
+    <thead><tr><th>Program</th><th>State</th><th>Detail</th></tr></thead>
+    <tbody>{{range .ProcessRows}}
+      <tr><td>{{.Name}}</td><td>{{template "tag" .State}}</td><td class="sp-muted">{{.Detail}}</td></tr>{{end}}
+    </tbody>
+  </table></div>
+  {{end}}
+  {{template "box_close"}}
+  {{template "box_open" .SenderCheck}}
+  <div class="table-container"><table class="table is-fullwidth">
+    <thead><tr><th>Period</th><th>Panel not answering</th><th>Messages deferred</th></tr></thead>
+    <tbody>{{range .SenderRows}}
+      <tr><td>{{.Period}}</td><td>{{.Down}}</td><td>{{.Deferred}}</td></tr>{{end}}
     </tbody>
   </table></div>
   {{template "body_open"}}
-  <p class="sp-muted">{{template "inline" .NotifyNote}}</p>
+  <p class="sp-muted">{{template "inline" .SenderNote}}</p>
   {{template "body_close"}}
   {{template "box_close"}}
+  {{template "box_open" .Hostname}}
+  {{template "body_open"}}
+  {{template "facts" .HostFacts}}
+  {{template "body_close"}}
+  {{template "box_close"}}
+  {{template "box_open" .Machine}}
+  <div class="table-container"><table class="table is-fullwidth">
+    <thead><tr><th>Resource</th><th>Usage</th><th>Detail</th></tr></thead>
+    <tbody>{{range .MachineRows}}
+      <tr><td>{{.Resource}}</td><td>{{if .Gauge}}<progress class="progress is-small {{.Gauge.Bar}} mb-1" value="{{.Gauge.Percent}}" max="100"></progress>{{.Gauge.Text}}{{else if .Usage}}<span class="sp-nowrap">{{.Usage}}</span>{{else}}<span class="sp-muted">—</span>{{end}}</td><td class="sp-muted">{{range .Detail}}<div>{{.}}</div>{{end}}</td></tr>{{end}}
+    </tbody>
+  </table></div>
+  {{template "box_close"}}
 </div>{{end}}
+
+{{define "health_sockets"}}{{template "box_open" .Sockets}}
+<div class="table-container"><table class="table is-fullwidth">
+  <thead><tr><th>Milter</th><th>State</th></tr></thead>
+  <tbody>{{range .SocketRows}}
+    <tr><td>{{.Name}}{{if .Note}} <span class="sp-muted">· {{.Note}}</span>{{end}}<br><span class="sp-muted sp-mono sp-small">{{.Path}}</span>{{if .Detail}}<br><span class="sp-muted sp-small">{{.Detail}}</span>{{end}}</td><td>{{template "tag" .State}}</td></tr>{{end}}
+  </tbody>
+</table></div>
+{{template "box_close"}}{{end}}
+
+{{define "health_certificate"}}{{template "box_open" .Certificate}}
+{{template "body_open"}}
+{{if .CertFacts}}{{template "facts" .CertFacts}}{{end}}
+<p class="mt-4 {{if .CertProblem}}has-text-danger{{else}}sp-muted{{end}}">{{.CertDetail}}</p>
+{{template "body_close"}}
+{{template "box_close"}}{{end}}
+
+{{/* health_mail is the Notification mail card. */}}
+{{define "health_mail"}}{{template "box_open" .NotifyMail}}
+<div class="table-container"><table class="table is-fullwidth">
+  <thead><tr><th>Record</th><th>State</th></tr></thead>
+  <tbody>{{range .NotifyRows}}
+    <tr><td>{{.Name}}<br><span class="sp-muted sp-mono sp-small">{{.Host}}</span></td><td>{{template "tag" .State}}</td></tr>{{end}}
+  </tbody>
+</table></div>
+{{template "body_open"}}
+<p class="sp-muted">{{template "inline" .NotifyNote}}</p>
+{{template "body_close"}}
+{{template "box_close"}}{{end}}

internal/web/view/templates/kit.html

@@ -15,7 +15,7 @@
 {{template "body_close"}}
 {{template "box_close"}}
 
-<div class="columns">
+{{template "cards_open"}}
   <div class="column is-6">
     {{template "box_open" .Postmark}}
     {{template "body_open"}}
@@ -58,7 +58,7 @@
     {{template "body_close"}}
     {{template "box_close"}}
   </div>
-</div>
+{{template "cards_close"}}
 
 {{template "box_open" .HealthCard}}
 {{template "health_cards" .HealthCards}}