kevinveenbirkenbachandClaude Opus 5.5 191afe48b2 fix(mail): harden the DMARC rua checks after review ...

The Mailu assert accepted any non-empty forward on the rua user, so a
forward to a user without a mailbox let the deploy publish an rua address
whose alias delivers nowhere. A forward now satisfies the assert only when
its target carries a mailbox account.

production_facts.py let a later duplicate tag overwrite an earlier one, so
a record with two rua tags passed although receivers discard it (DKIM
tag-list rules, adopted by RFC 7489). dmarc_tags now raises on a duplicate
tag and check_dmarc reports the record as invalid. The rua comparison also
took the raw URI text, so a percent-encoded address or one followed by
mailto header fields never matched; the address is now cut at '?' and
percent-decoded after the size suffix is removed (RFC 6068).

Refs #1125

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 01:17:51 +01:00

..

__init__.py

refactor(python): clear the open CodeQL code-quality alerts

2026-10-20 21:40:58 +02:00

test_migrate_from_mailu.py

…

test_production_facts.py

fix(mail): harden the DMARC rua checks after review

2026-10-29 01:17:51 +01:00