mix
5e5d157496
A bounce could be recorded as a successful delivery. The log-tailer's Fixed: - A bounce could be recorded as a successful delivery. The log-tailer's - Log-tailer resumes where it stopped instead of jumping to end-of-file on - Level-2 rate limit no longer overshoots under concurrency: messages that Changed: - The project has a single public home: `github.com/mixeme/selfpost`. Codeberg - Code comments no longer cite the archived specification. References like - `docs/code-review.md` is gone. Its plan is finished — phases 0 (bar the - `docs/architecture.md` gained a *Code layers* section: a diagram of - Phase 1 doc/code hygiene (`docs/code-review.md`): removed ~30 stale … (1 more in CHANGELOG) Security: - Pre-release security review (plan § D, model Fable, 2026-08-06): full pass - `saslpasswd2` argv: the application login is now passed after a `--` Added: - Optional password encryption for the two secret-bearing downloads (plan - Domain import accepts an encrypted export: the envelope is detected by its - `selfpost-backup` writes encrypted archives and reads them back: - `TestParseDelivery` covers the exotic mail.log shapes the review asked for - docs: README *Encrypting a backup or export*; `docs/security.md` § … (14 more in CHANGELOG) Removed: - docs: `security.md` — accepted risk «restore old backup revives session rows» Changed: - docs: `implementation-plan.md` trimmed to the sole open v1.x gate — pre-release - docs: `architecture.md` — sessions (SQLite, idle renew, password change), - docs: `development.md` — expanded e2e stack and `release.yml` matrix workflow. - docs: `security.md` — accepted risk for send-log rows stuck at `queued` after - docs: `roadmap.md` — optional send-log / `mail.log` follow-ups under v1.x tail. … (10 more in CHANGELOG) Full detail: CHANGELOG.md (0.5.0).
90 lines
2.7 KiB
Go
90 lines
2.7 KiB
Go
package dnscheck
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/mixeme/selfpost/internal/health"
|
|
)
|
|
|
|
// checkServer resolves the panel's own hostname and confirms the reverse
|
|
// lookup of each address points back at that name (FCrDNS). A missing or
|
|
// mismatched PTR is the single most common reason mail from a self-hosted
|
|
// server is rejected or scored as spam, which is why it is an error and not
|
|
// advice.
|
|
func (c *Checker) checkServer(ctx context.Context, hostname string) Server {
|
|
srv := Server{Hostname: hostname, CheckedAt: time.Now()}
|
|
if hostname == "" {
|
|
srv.PTR = Result{
|
|
Status: health.StatusUnknown,
|
|
Detail: "SELFPOST_HOSTNAME is not set, so the server's own name in DNS cannot be checked. Set it in the deployment environment.",
|
|
}
|
|
return srv
|
|
}
|
|
|
|
addrs, err := c.resolver.LookupIPAddr(ctx, hostname)
|
|
if err != nil || len(addrs) == 0 {
|
|
srv.PTR = Result{
|
|
Status: health.StatusError,
|
|
Detail: fmt.Sprintf("%s does not resolve to any address. Publish an A (or AAAA) record for it — receiving servers check the name this server announces in HELO.", hostname),
|
|
}
|
|
return srv
|
|
}
|
|
|
|
want := normalizeName(hostname)
|
|
matched, total := 0, len(addrs)
|
|
var records []string
|
|
for _, a := range addrs {
|
|
ip := a.IP.String()
|
|
srv.IPs = append(srv.IPs, ip)
|
|
|
|
names, err := c.resolver.LookupAddr(ctx, ip)
|
|
if err != nil || len(names) == 0 {
|
|
records = append(records, ip+" → no PTR record")
|
|
continue
|
|
}
|
|
hit := false
|
|
for _, n := range names {
|
|
if normalizeName(n) == want {
|
|
hit = true
|
|
}
|
|
}
|
|
if hit {
|
|
matched++
|
|
records = append(records, ip+" → "+normalizeName(names[0]))
|
|
} else {
|
|
records = append(records, ip+" → "+normalizeName(names[0])+" (does not match)")
|
|
}
|
|
}
|
|
|
|
srv.PTR.Records = records
|
|
switch {
|
|
case matched == total:
|
|
srv.PTR.Status = health.StatusOK
|
|
srv.PTR.Detail = fmt.Sprintf("%s resolves to %s and the reverse lookup points back at it.", hostname, joinIPs(srv.IPs))
|
|
case matched > 0:
|
|
srv.PTR.Status = health.StatusWarn
|
|
srv.PTR.Detail = fmt.Sprintf("Only %d of %d addresses of %s have a matching PTR record. Mail sent from the others may be rejected — set the reverse DNS of every address at your hosting provider.", matched, total, hostname)
|
|
default:
|
|
srv.PTR.Status = health.StatusError
|
|
srv.PTR.Detail = fmt.Sprintf("No address of %s has a reverse (PTR) record pointing back at it. Many receiving servers reject or spam-score mail from such a host — set the reverse DNS of the server's IP to %s at your hosting provider.", hostname, hostname)
|
|
}
|
|
return srv
|
|
}
|
|
|
|
func joinIPs(ips []string) string {
|
|
switch len(ips) {
|
|
case 0:
|
|
return "no address"
|
|
case 1:
|
|
return ips[0]
|
|
default:
|
|
out := ips[0]
|
|
for _, ip := range ips[1:] {
|
|
out += ", " + ip
|
|
}
|
|
return out
|
|
}
|
|
}
|