feat(email): generate DMARC recommendation, fix DNS TXT-record verification precision - #304
Open
clau1902 wants to merge 1 commit into
Open
feat(email): generate DMARC recommendation, fix DNS TXT-record verification precision#304clau1902 wants to merge 1 commit into
clau1902 wants to merge 1 commit into
Conversation
…cation precision - Adds a DMARC record (_dmarc.<domain>, "v=DMARC1; p=quarantine; pct=100") to the domain's DNS records list for display. Informational only: deliberately excluded from setup_dns's auto-create (publishing a DMARC policy isn't additive like SPF/DKIM/MX — it can affect mail from other senders on the domain) and from the domain verification status computation (so no already-verified domain regresses to pending/failed just because it doesn't have a DMARC record). - Fixes a false-positive bug in TXT record verification: the check accepted a match if `expected_value.contains(&txt_data)` as well as the correct direction, which meant any short, unrelated TXT record (e.g. a single stray character) was trivially a substring of a long expected DKIM key — a domain could be reported "Verified" with a DNS record that had nothing to do with the expected value. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Independent of the other email-hardening PRs in this series — touches only
dns.rs,domain_service.rs, andsetup_dnsindomains.rs._dmarc.<domain>,v=DMARC1; p=quarantine; pct=100) to the domain's DNS records list for display. Informational only: deliberately excluded fromsetup_dns's auto-create (publishing a DMARC policy isn't additive like SPF/DKIM/MX — it sets a policy for the entire domain and can affect mail from senders other than Temps, e.g. the company's regular Google Workspace/M365 mail, if their SPF/DKIM alignment isn't already clean) and from the domain verification status computation (so no already-verified domain regresses to pending/failed just because it doesn't have a DMARC record — DMARC is recommended, not required).expected_value.contains(&txt_data)as well as the correcttxt_data.contains(expected_value)direction. That backward check is a trap — any short, unrelated TXT record (e.g. a single stray character) is trivially a substring of a long expected DKIM key, so a domain could be reported "Verified" with a DNS record that has nothing to do with the expected value.Test plan
cargo test -p temps-email --lib— 157 tests pass, including updatedtest_build_dns_records(now asserts the DMARC record is present alongside SPF/DKIM/MX)🤖 Generated with Claude Code