panel-notifications: findings of the technical and security reviews

Neither review (read-only agents, Opus and Fable, over 972a9f8..400aa76) has
a Critical finding. Both found the same serious one, and more:

- The notification about refused mail was built on what a rejected row says
  of itself. Its domain is the one in MAIL FROM, which the client typed and
  Postfix has not yet held against the login when the milter refuses: an
  application over its limit could have had the panel write a message per
  made-up domain, to another tenant's users among others. And the same
  status is written when an application is refused for its client address,
  which is no limit. Refusals are now counted by the domain the login is
  registered under, only for logins that exist and only while a limit is set
  on the login or its domain; one subject per sending domain. They are read
  through a partial index of their own (migration 0005): the query walked
  the whole send log every minute.
- Account and user e-mails were checked with the DMARC report validator,
  which refuses Gmail and the like - the owner's own kind of address. A new
  validate.AccountEmail accepts them and refuses a local part beginning "-".
- "Said" now means sent: what arises while nobody can be told, or while
  Postfix does not take the message, is told at a later check. Its ending
  with nobody left to tell is simply over.
- Two DNS checks must be 45 minutes apart as well as two: the last check
  before a restart and the first after it were minutes apart.
- The notifier's own mail waiting in the queue, and its bounce coming back
  to postmaster@ this server, are not the queue's subject. A listing cut at
  its size limit or with a line too long to read is no listing; postqueue -j
  gets 30 seconds.
- The tables must name the selector the panel shows, not only have the line.
- An a/mx lookup that did not answer inside the SPF check made the record
  "not authorising"; it is "cannot tell" now, for the pages too.
- A ceiling of 60 messages an hour; a pass stops between domains when the
  process is asked to stop; sendmail gets a WaitDelay; days are rounded as a
  person counts; a failed read of the switch shows it on, not off.

Recorded as accepted in security.md, with a roadmap candidate
(from-header-binding): an application can have a message signed as the
server's own name - or, as always, as another registered domain - by writing
it into the From: header, which nothing holds against the login.

Left as found: a recipient whose copy failed while another's went out is not
tried again; a certificate that lives under 14 days is reported at each
renewal.

On the test server, for this tree: go vet clean, go test ./... 23 packages
ok, make e2e ok (326 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/store/migrations/0004_notifications.sql

@@ -12,12 +12,13 @@ ALTER TABLE users ADD COLUMN notify INTEGER NOT NULL DEFAULT 1 CHECK (notify IN
 --   dns:<domain>            a sending domain's records
 --   cert                    the TLS certificate
 --   queue                   a message older than three days
---   limit:<domain>:<login>  a level-2 limit that refused mail
+--   limit:<domain>          level-2 limits that refused mail of the domain
 -- phase is where the subject stands ("pending": seen wrong, not yet said;
 -- "open": said; for the certificate, the threshold last said). count is the
 -- checks in a row that agree with the phase's direction, mark what the phase
--- refers to (the certificate's expiry), since when it began, sent_at when the
--- last message about it went out.
+-- refers to (the certificate's expiry; for DNS, when the records were first
+-- seen right again), since when it began, sent_at when the last message about
+-- it went out.
 CREATE TABLE notify_state (
     key     TEXT PRIMARY KEY,
     phase   TEXT NOT NULL,

internal/store/migrations/0005_send_log_rejected_index.sql

@@ -0,0 +1,6 @@
+-- The notifier asks every minute for the mail refused in the last day
+-- (panel-notifications, 2.3.0). Refusals are a sliver of the send log; without
+-- an index of their own the question walks the whole retention period each
+-- time. A partial index holds only the refused rows. The query names the
+-- status as a literal, which is what lets SQLite use it.
+CREATE INDEX idx_send_log_rejected ON send_log (created_at) WHERE status = 'rejected';

internal/store/notify.go

@@ -155,24 +155,40 @@ func (s *Store) ListNotifyStateKeys(prefix string) ([]string, error) {
 	return out, rows.Err()
 }
 
-// LimitRefusal is the mail one application was refused under a level-2 rate
-// limit in a span of time: how many messages and when the first.
+// LimitRefusal is the mail the applications of one sending domain were refused
+// under a level-2 rate limit in a span of time.
 type LimitRefusal struct {
-	Domain   string
-	AppLogin string
-	Count    int
-	First    time.Time
+	Domain string
+	// Apps are the logins that were refused, in order.
+	Apps  []string
+	Count int
+	First time.Time
 }
 
-// LimitRefusalsSince returns, per domain and application, the messages the
-// journal milter refused under a level-2 limit at or after since (send-log
-// rows with status "rejected").
+// LimitRefusalsSince returns, per sending domain, the messages the journal
+// milter refused under a level-2 limit at or after since.
+//
+// A refusal is a send-log row with status "rejected", and what such a row
+// says about itself is not to be believed whole. Its domain is the one in
+// MAIL FROM, which the client typed and Postfix has not yet held against the
+// login when the milter refuses; so the domain here is the one the login is
+// registered under, and a row whose login is no application's is not counted.
+// The same status is written when an application is refused for its client
+// address (applications.auth_ip_restrict), which is no limit at all; so a
+// login counts only while a level-2 limit is set on it or on its domain.
 func (s *Store) LimitRefusalsSince(since time.Time) ([]LimitRefusal, error) {
+	// The status is a literal so that the partial index of migration 0005
+	// answers the question.
 	rows, err := s.db.Query(
-		`SELECT COALESCE(domain, ''), COALESCE(app_login, ''), COUNT(*), MIN(created_at) FROM send_log
-		 WHERE status = ? AND created_at >= ?
-		 GROUP BY domain, app_login ORDER BY domain, app_login`,
-		StatusRejected, since.UTC().Format(time.RFC3339),
+		`SELECT d.name, a.login, COUNT(*), MIN(l.created_at)
+		 FROM send_log l
+		 JOIN applications a ON a.login = l.app_login
+		 JOIN domains d ON d.id = a.domain_id
+		 WHERE l.status = 'rejected' AND l.created_at >= ?
+		   AND (EXISTS (SELECT 1 FROM rate_limits r WHERE r.scope = 'application' AND r.ref_id = a.id)
+		     OR EXISTS (SELECT 1 FROM rate_limits r WHERE r.scope = 'domain' AND r.ref_id = d.id))
+		 GROUP BY d.name, a.login ORDER BY d.name, a.login`,
+		since.UTC().Format(time.RFC3339),
 	)
 	if err != nil {
 		return nil, fmt.Errorf("limit refusals: %w", err)
@@ -181,14 +197,22 @@ func (s *Store) LimitRefusalsSince(since time.Time) ([]LimitRefusal, error) {
 	var out []LimitRefusal
 	for rows.Next() {
 		var (
-			r     LimitRefusal
-			first string
+			domain, login, first string
+			count                int
 		)
-		if err := rows.Scan(&r.Domain, &r.AppLogin, &r.Count, &first); err != nil {
+		if err := rows.Scan(&domain, &login, &count, &first); err != nil {
 			return nil, fmt.Errorf("limit refusals scan: %w", err)
 		}
-		r.First, _ = time.Parse(time.RFC3339, first)
-		out = append(out, r)
+		at, _ := time.Parse(time.RFC3339, first)
+		if n := len(out); n > 0 && out[n-1].Domain == domain {
+			out[n-1].Apps = append(out[n-1].Apps, login)
+			out[n-1].Count += count
+			if at.Before(out[n-1].First) {
+				out[n-1].First = at
+			}
+			continue
+		}
+		out = append(out, LimitRefusal{Domain: domain, Apps: []string{login}, Count: count, First: at})
 	}
 	return out, rows.Err()
 }

internal/store/notify_test.go

@@ -130,26 +130,60 @@ func TestNotifyStateRoundTrip(t *testing.T) {
 	}
 }
 
-// Refused mail is counted per domain and application from a point in time;
-// delivered mail and older refusals are not.
+// Refused mail is counted per sending domain from a point in time - and only
+// what was refused under a limit. The row's own domain is what the client
+// typed in MAIL FROM; the login's registered domain is what counts. A login
+// that is nobody's is not counted, nor is one refused with no limit set (its
+// client address was not on its list).
 func TestLimitRefusalsSince(t *testing.T) {
 	s := openTestStore(t)
+	d, err := s.AddDomain("example.com", "sp")
+	if err != nil {
+		t.Fatal(err)
+	}
+	other, err := s.AddDomain("other.example", "sp")
+	if err != nil {
+		t.Fatal(err)
+	}
+	app := func(domainID int64, login string) int64 {
+		t.Helper()
+		a, err := s.AddApplication(domainID, login, AddressModeWildcard, nil)
+		if err != nil {
+			t.Fatalf("add %s: %v", login, err)
+		}
+		return a.ID
+	}
+	limit := func(scope string, id int64) {
+		t.Helper()
+		if err := s.SetRateLimit(RateLimit{Scope: scope, RefID: id, MaxMessages: 1, WindowSeconds: 3600}); err != nil {
+			t.Fatalf("set limit: %v", err)
+		}
+	}
+	limit(RateLimitScopeApp, app(d.ID, "app1"))
+	limit(RateLimitScopeApp, app(d.ID, "app2"))
+	app(d.ID, "nolimit")         // refused for its client address
+	app(other.ID, "byitsdomain") // limited through its domain
+	limit(RateLimitScopeDomain, other.ID)
+
 	for _, e := range []SendLogEntry{
 		{Domain: "example.com", AppLogin: "app1", From: "a@example.com"},
-		{Domain: "example.com", AppLogin: "app1", From: "a@example.com"},
-		{Domain: "example.com", AppLogin: "app2", From: "b@example.com"},
+		{Domain: "victim.example", AppLogin: "app1", From: "a@victim.example"}, // a domain the client made up
+		{Domain: "other.example", AppLogin: "app2", From: "b@other.example"},   // another tenant's name
+		{Domain: "example.com", AppLogin: "nolimit", From: "c@example.com"},
+		{Domain: "example.com", AppLogin: "ghost", From: "d@example.com"},
+		{Domain: "other.example", AppLogin: "byitsdomain", From: "e@other.example"},
 	} {
 		if err := s.InsertRejected(e); err != nil {
 			t.Fatal(err)
 		}
 	}
-	if err := s.InsertQueued(SendLogEntry{QueueID: "ABC123", Domain: "example.com", AppLogin: "app3", To: "x@example.net"}); err != nil {
+	if err := s.InsertQueued(SendLogEntry{QueueID: "ABC123", Domain: "example.com", AppLogin: "app1", To: "x@example.net"}); err != nil {
 		t.Fatal(err)
 	}
-	if err := s.InsertRejected(SendLogEntry{Domain: "old.example.com", AppLogin: "old"}); err != nil {
+	if err := s.InsertRejected(SendLogEntry{Domain: "example.com", AppLogin: "app2", From: "old@example.com"}); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := s.db.Exec(`UPDATE send_log SET created_at = '2026-01-01T00:00:00Z' WHERE app_login = 'old'`); err != nil {
+	if _, err := s.db.Exec(`UPDATE send_log SET created_at = '2026-01-01T00:00:00Z' WHERE from_addr = 'old@example.com'`); err != nil {
 		t.Fatal(err)
 	}
 
@@ -157,10 +191,32 @@ func TestLimitRefusalsSince(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if len(got) != 2 || got[0].AppLogin != "app1" || got[0].Count != 2 || got[1].AppLogin != "app2" || got[1].Count != 1 {
-		t.Fatalf("refusals = %+v", got)
+	if len(got) != 2 {
+		t.Fatalf("refusals = %+v, want two domains", got)
 	}
-	if got[0].Domain != "example.com" || got[0].First.IsZero() {
-		t.Errorf("first refusal = %+v", got[0])
+	if g := got[0]; g.Domain != "example.com" || strings.Join(g.Apps, " ") != "app1 app2" || g.Count != 3 || g.First.IsZero() {
+		t.Errorf("example.com = %+v; want app1 (2, one under a made-up domain) and app2 (1, under another tenant's name)", g)
+	}
+	if g := got[1]; g.Domain != "other.example" || strings.Join(g.Apps, " ") != "byitsdomain" || g.Count != 1 {
+		t.Errorf("other.example = %+v", g)
+	}
+
+	// The question is answered from the index of the refused rows alone.
+	var plan []string
+	rows, err := s.db.Query(`EXPLAIN QUERY PLAN SELECT COUNT(*) FROM send_log l WHERE l.status = 'rejected' AND l.created_at >= '2026-10-01T00:00:00Z'`)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for rows.Next() {
+		var id, parent, notused int
+		var detail string
+		if err := rows.Scan(&id, &parent, &notused, &detail); err != nil {
+			t.Fatal(err)
+		}
+		plan = append(plan, detail)
+	}
+	rows.Close()
+	if !strings.Contains(strings.Join(plan, "; "), "idx_send_log_rejected") {
+		t.Errorf("refused rows are not found through their index: %v", plan)
 	}
 }

internal/store/schema_test.go

@@ -104,7 +104,7 @@ func TestBaselineSchema(t *testing.T) {
 	wantIdx := []string{
 		"idx_dmarc_report_records_report", "idx_dmarc_reports_domain", "idx_dmarc_reports_received",
 		"idx_inbound_spam_log_created_at", "idx_inbound_spam_log_domain_created_at",
-		"idx_send_log_app_login_created_at", "idx_send_log_created_at", "idx_send_log_domain", "idx_send_log_lines_queue_id", "idx_send_log_queue_id",
+		"idx_send_log_app_login_created_at", "idx_send_log_created_at", "idx_send_log_domain", "idx_send_log_lines_queue_id", "idx_send_log_queue_id", "idx_send_log_rejected",
 		"idx_sessions_expires_at",
 	}
 	sort.Strings(wantIdx)
@@ -113,8 +113,8 @@ func TestBaselineSchema(t *testing.T) {
 	}
 
 	var version, appID int64
-	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 4 {
-		t.Errorf("user_version = %d, %v; want 4", version, err)
+	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 5 {
+		t.Errorf("user_version = %d, %v; want 5", version, err)
 	}
 	if err := st.db.QueryRow("PRAGMA application_id").Scan(&appID); err != nil || appID != applicationID {
 		t.Errorf("application_id = %#x, %v; want %#x", appID, err, applicationID)
@@ -190,8 +190,8 @@ func TestOpenMigratesA20Database(t *testing.T) {
 	}
 	defer st.Close()
 	var version int
-	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 4 {
-		t.Errorf("user_version = %d, %v; want 4", version, err)
+	if err := st.db.QueryRow("PRAGMA user_version").Scan(&version); err != nil || version != 5 {
+		t.Errorf("user_version = %d, %v; want 5", version, err)
 	}
 	if ok, err := st.UserExists(); err != nil || !ok {
 		t.Errorf("the user of the 2.0 database: exists = %v, %v", ok, err)