panel-notifications: findings of the technical and security reviews

Neither review (read-only agents, Opus and Fable, over 972a9f8..400aa76) has
a Critical finding. Both found the same serious one, and more:

- The notification about refused mail was built on what a rejected row says
  of itself. Its domain is the one in MAIL FROM, which the client typed and
  Postfix has not yet held against the login when the milter refuses: an
  application over its limit could have had the panel write a message per
  made-up domain, to another tenant's users among others. And the same
  status is written when an application is refused for its client address,
  which is no limit. Refusals are now counted by the domain the login is
  registered under, only for logins that exist and only while a limit is set
  on the login or its domain; one subject per sending domain. They are read
  through a partial index of their own (migration 0005): the query walked
  the whole send log every minute.
- Account and user e-mails were checked with the DMARC report validator,
  which refuses Gmail and the like - the owner's own kind of address. A new
  validate.AccountEmail accepts them and refuses a local part beginning "-".
- "Said" now means sent: what arises while nobody can be told, or while
  Postfix does not take the message, is told at a later check. Its ending
  with nobody left to tell is simply over.
- Two DNS checks must be 45 minutes apart as well as two: the last check
  before a restart and the first after it were minutes apart.
- The notifier's own mail waiting in the queue, and its bounce coming back
  to postmaster@ this server, are not the queue's subject. A listing cut at
  its size limit or with a line too long to read is no listing; postqueue -j
  gets 30 seconds.
- The tables must name the selector the panel shows, not only have the line.
- An a/mx lookup that did not answer inside the SPF check made the record
  "not authorising"; it is "cannot tell" now, for the pages too.
- A ceiling of 60 messages an hour; a pass stops between domains when the
  process is asked to stop; sendmail gets a WaitDelay; days are rounded as a
  person counts; a failed read of the switch shows it on, not off.

Recorded as accepted in security.md, with a roadmap candidate
(from-header-binding): an application can have a message signed as the
server's own name - or, as always, as another registered domain - by writing
it into the From: header, which nothing holds against the login.

Left as found: a recipient whose copy failed while another's went out is not
tried again; a certificate that lives under 14 days is reported at each
renewal.

On the test server, for this tree: go vet clean, go test ./... 23 packages
ok, make e2e ok (326 s).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_account.go

@@ -102,7 +102,7 @@ func (h *Handlers) HandleAccountProfile(w http.ResponseWriter, r *http.Request)
 			return
 		}
 	}
-	if err := validate.Email(f.Email); err != nil {
+	if err := validate.AccountEmail(f.Email); err != nil {
 		fail(http.StatusBadRequest, err.Error())
 		return
 	}

internal/web/handlers/handlers_settings.go

@@ -54,7 +54,10 @@ func (h *Handlers) renderServerSettings(w http.ResponseWriter, r *http.Request,
 	page := view.NewSettings(h.shellMeta(r), strconv.Itoa(form.outbound), view.FormatRate(h.l1Messages(), h.l1Window()))
 	on, err := h.store.NotificationsEnabled()
 	if err != nil {
+		// Shown as on: the form saves what it shows, and a failed read must not
+		// become "off" at the next Save.
 		logf("panel: settings: read the notifications switch: %v", err)
+		on = true
 	}
 	page.WithNotifications(on, notify.From(h.cfg.Hostname))
 	page.WithMail(h.serverMail(false).records)

internal/web/handlers/handlers_users.go

@@ -187,7 +187,7 @@ func (h *Handlers) submitUserCreate(w http.ResponseWriter, r *http.Request) {
 		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: err.Error(), FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
 		return
 	}
-	if err := validate.Email(email); err != nil {
+	if err := validate.AccountEmail(email); err != nil {
 		h.renderUserForm(w, r, http.StatusBadRequest, 0, userFormView{FormErr: err.Error(), FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
 		return
 	}
@@ -261,7 +261,7 @@ func (h *Handlers) submitUserUpdate(w http.ResponseWriter, r *http.Request, u st
 		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
 		return
 	}
-	if err := validate.Email(email); err != nil {
+	if err := validate.AccountEmail(email); err != nil {
 		h.renderUserForm(w, r, http.StatusBadRequest, u.ID, userFormView{FormErr: err.Error(), FormUsername: username, FormEmail: email, FormRole: string(role), Reach: reach})
 		return
 	}

internal/web/validate/validate.go

@@ -118,8 +118,21 @@ var freemailDomains = map[string]struct{}{
 	"protonmail.com": {},
 }
 
+// AccountEmail checks a panel user's own address: where the panel writes to
+// them. Empty is allowed. It is the address check of Email without that
+// function's refusal of public mail hosts - a mailbox at one of those is a
+// perfectly good place to be notified, and for many administrators the only
+// one that does not depend on the server the notification is about.
+func AccountEmail(addr string) error {
+	return emailAddress(addr, true)
+}
+
 // Email checks a DMARC rua= mailbox. Empty is allowed (policy-only).
 func Email(addr string) error {
+	return emailAddress(addr, false)
+}
+
+func emailAddress(addr string, publicHosts bool) error {
 	addr = strings.TrimSpace(addr)
 	if addr == "" {
 		return nil
@@ -129,6 +142,11 @@ func Email(addr string) error {
 		return fmt.Errorf("enter a valid email address")
 	}
 	local := addr[:at]
+	// An address is handed to sendmail(1) as an argument; one that begins like
+	// an option is refused here, where the user can be told.
+	if strings.HasPrefix(local, "-") {
+		return fmt.Errorf("email address must not begin with '-'")
+	}
 	domain := NormalizeDomain(addr[at+1:])
 	if err := Domain(domain); err != nil {
 		return fmt.Errorf("email domain is invalid: %w", err)
@@ -141,7 +159,7 @@ func Email(addr string) error {
 			return fmt.Errorf("email address contains invalid characters")
 		}
 	}
-	if _, blocked := freemailDomains[domain]; blocked {
+	if _, blocked := freemailDomains[domain]; blocked && !publicHosts {
 		return fmt.Errorf("use an address on a domain you control; public mail hosts cannot receive authorised DMARC reports")
 	}
 	return nil

internal/web/validate/validate_email_test.go

@@ -31,3 +31,23 @@ func TestValidateEmail(t *testing.T) {
 		t.Error("blocked freemail domain accepted")
 	}
 }
+
+// A user's own address is where the panel writes to them, and a mailbox at a
+// public host is a good place for that - the refusal of those hosts belongs to
+// DMARC report addresses alone. What cannot be an address is refused for both,
+// and so is one that would read as an option on sendmail's command line.
+func TestAccountEmail(t *testing.T) {
+	for _, ok := range []string{"", "me@gmail.com", "first.last+tag@proton.me", "admin@example.org"} {
+		if err := AccountEmail(ok); err != nil {
+			t.Errorf("AccountEmail(%q) = %v, want accepted", ok, err)
+		}
+	}
+	for _, bad := range []string{"no-at-sign", "@example.org", "me@", "a b@example.org", "me@exa mple.org", "-oQ/tmp@example.org", "\u00fc@example.org"} {
+		if err := AccountEmail(bad); err == nil {
+			t.Errorf("AccountEmail(%q) accepted", bad)
+		}
+	}
+	if err := Email("-x@example.org"); err == nil {
+		t.Error("Email accepted an address that begins like an option")
+	}
+}