dmarcator 0.6.1 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ab57f0c6599df86ed3331199b84f0abdd9aae8876405e4205f2070b9e457b5ca
-  data.tar.gz: 5466098000ff91848f6cb8208606ed8b3312eb9b476763074d917b3f7f377aca
+  metadata.gz: dfd0c6f8b9f84d311a49c5ad8a6b0e43618bd151ebd9cb7532a76486f4ea600a
+  data.tar.gz: 1b0eb0947c60844e369594d4c28e68510a91246faceb4a099f2c08dd7391a3fa
 SHA512:
-  metadata.gz: 71c83a39fc17926997e43465ef07210a7a062a67b922462623e4d6c0daa617acefc4ec2546194ffa2f6755bf62321504134140b5e35813ac9e34b8ed43abbf89
-  data.tar.gz: ebdc8623cdba9d7632188a52fbdc203d7c1f85efed580f72ce5ceebeafd8a7c5eae4f5f0797d8960b1a6fb5e1b2af9aeb9d5484ffc74a5f8adc4942af4de286a
+  metadata.gz: a151f9aabc45f12dc8107a0d4fb8c61bcb4f66880698045ba6df8dc97664f4840db0dc98af62fce3f2c77243f9250ee0df6d886908816a71b853d55f94d4ca8a
+  data.tar.gz: 7d7d50f10d95e4d762e8a8f3f1deb9fab301f690b942e65f77129f0ee633afa108281a86947ac6fe81a59e8062fe62f51e9b492ab0f2e08940b6483ad27f8248

data/ChangeLog.md

@@ -1,3 +1,13 @@
+### 0.7.0 / 2026-10-29
+
+* Plaintext DNS lookups now fail closed: a lookup failure raises `DMARCator::ResolutionError` instead of being reported as a domain without a DMARC record. Previously a timeout or resolver failure looked like no policy, which failed open. This is a behavior change and applies to every transport.
+* DoH responses must use the `application/dns-message` content type (RFC 8484) and are capped at 65,535 bytes.
+* `DMARCator::Uri` no longer forwards calls to private methods of the wrapped `URI::MailTo`.
+* Remove the unused `XmlHelper#get_int`/`#get_timestamp` helpers and the deprecated `Record.from_txt`.
+* Memoize a missing report version instead of recomputing it, and scope spec constants under `DMARCator`.
+* Add `changelog_uri` and `documentation_uri` gem metadata, and document that domains must be passed as A-labels.
+* Add a CI workflow that runs the specs on the minimum supported Ruby and the current release, loads the gem with warnings enabled, fails on YARD warnings, and builds the gem.
+
 ### 0.6.1 / 2026-10-29
 
 * Remove a redundant `attr_reader :sp` that `Record#sp` already overrode, fixing a `method redefined; discarding old sp` warning emitted under `-w` (as CI enables).

data/README.md

@@ -93,6 +93,11 @@ record = DMARCator::Record.query("twitter.com")
 # => #<DMARCator::Record ... @p=:reject, @rua=[...], ...>
 ```
 
+Domains must be ASCII (A-labels): pass punycode such as
+`xn--mnchen-3ya.de` rather than `münchen.de`. A lookup failure raises
+`DMARCator::ResolutionError`; `nil` only means the domain genuinely has no
+DMARC record.
+
 ## Strict parsing
 
 By default, unknown tags and tags with invalid values are ignored. Pass
@@ -149,9 +154,11 @@ hostname.
 
 Encrypted transports fail closed: a transport failure raises
 `DMARCator::ResolutionError` instead of being reported as a domain without a
-DMARC record. Plaintext is the default because forcing a public resolver breaks
-private and split-horizon zones, and some networks block port 853 or public
-resolvers.
+DMARC record. This applies to every transport, including plaintext —
+`Resolv` returns an empty result for NXDOMAIN and raises for timeouts and
+other failures, so a failed lookup is never mistaken for an absent record.
+Plaintext remains the default because forcing a public resolver breaks private
+and split-horizon zones, and some networks block port 853 or public resolvers.
 
 A resolver can also be built explicitly:
 
@@ -181,7 +188,8 @@ DMARC records and XML reports are treated as untrusted input:
   TLS certificates and fail closed: a transport failure raises
   `DMARCator::ResolutionError` rather than being reported as a domain without a
   DMARC record, so a blocked or downgraded lookup can never silently enforce no
-  policy.
+  policy. Plaintext lookups fail closed the same way. DoH responses must be
+  `application/dns-message` and are capped at 65,535 bytes.
 
 ## Requirements
 

data/lib/dmarcator/query.rb

@@ -104,11 +104,11 @@ module DMARCator
   #   plaintext resolvers receive {DNS_TIMEOUTS}.
   #
   # @return [String, nil]
-  #   The domain's DMARC record or `nil` if none exists.
+  #   The domain's DMARC record, or `nil` if the domain simply has none.
   #
-  # @raise [Resolver::DoH, Resolver::DoT] resolution errors
-  #   Encrypted transports raise {ResolutionError} when the lookup fails, so
-  #   a transport problem is never reported as a missing record.
+  # @raise [ResolutionError]
+  #   The lookup failed. A failure is never reported as a missing record, so a
+  #   blocked or degraded resolver cannot silently enforce no policy.
   #
   # @api semipublic
   #
@@ -121,10 +121,13 @@ module DMARCator
 
     host = "_dmarc.#{domain}"
 
+    # Resolv returns an empty result for NXDOMAIN and raises for timeouts and
+    # other failures, so any exception here is a transport failure, not an
+    # absent record.
     begin
       records = resolver.getresources(host, Resolv::DNS::Resource::IN::TXT)
-    rescue Resolv::ResolvError
-      return nil
+    rescue Resolv::ResolvError => error
+      raise ResolutionError, "DNS lookup failed for #{host}: #{error.message}"
     end
 
     # Per RFC 7489 §6.6.3, use the TXT record beginning with "v=DMARC1".

data/lib/dmarcator/record.rb

@@ -288,13 +288,6 @@ module DMARCator
       raise InvalidRecord.new(truncate_error_message(error.message), error.cause)
     end
 
-    #
-    # @deprecated use {parse} instead.
-    #
-    def self.from_txt(rec)
-      parse(rec)
-    end
-
     # Maximum length of error messages echoed from parsing untrusted input.
     MAX_ERROR_MESSAGE_LENGTH = 500
 

data/lib/dmarcator/report.rb

@@ -78,7 +78,9 @@ module DMARCator
     # @return [BigDecimal, nil]
     #
     def version
-      @version ||= begin
+      return @version if defined?(@version)
+
+      @version = begin
         value = get_text('feedback/version')
 
         if value && !value.empty?

data/lib/dmarcator/resolver/doh.rb

@@ -25,6 +25,12 @@ module DMARCator
       # Default connect/read timeout in seconds.
       DEFAULT_TIMEOUT = 5
 
+      # Maximum accepted response body in bytes (the DNS message limit).
+      MAX_RESPONSE_BYTES = 65_535
+
+      # Media type RFC 8484 requires for DNS messages.
+      CONTENT_TYPE = 'application/dns-message'
+
       # @return [URI::HTTPS] the DoH endpoint.
       attr_reader :url
 
@@ -92,8 +98,8 @@ module DMARCator
         http.ipaddr = @ipaddr if @ipaddr
 
         request = Net::HTTP::Post.new(@url.request_uri)
-        request['content-type'] = 'application/dns-message'
-        request['accept'] = 'application/dns-message'
+        request['content-type'] = CONTENT_TYPE
+        request['accept'] = CONTENT_TYPE
         request.body = query.encode
 
         response = http.start { |connection| connection.request(request) }
@@ -104,7 +110,20 @@ module DMARCator
           raise ResolutionError, "DoH endpoint returned HTTP #{status}"
         end
 
-        response.body.to_s.b
+        content_type = response['content-type'].to_s
+
+        unless content_type.start_with?(CONTENT_TYPE)
+          raise ResolutionError, "DoH endpoint returned unexpected content-type: #{content_type.inspect}"
+        end
+
+        body = response.body.to_s.b
+
+        if body.bytesize > MAX_RESPONSE_BYTES
+          raise ResolutionError,
+                "DoH response exceeds maximum size of #{MAX_RESPONSE_BYTES} bytes"
+        end
+
+        body
       rescue ResolutionError
         raise
       rescue StandardError => error

data/lib/dmarcator/uri.rb

@@ -118,19 +118,24 @@ module DMARCator
     private
 
     #
-    # Pass all missing methods to {#uri}.
+    # Pass public methods through to {#uri}.
+    #
+    # Private methods are not forwarded: delegation is limited to the wrapped
+    # URI's public interface.
     #
     def method_missing(name,*arguments,&block)
-      @uri.send(name,*arguments,&block)
+      return super unless @uri.respond_to?(name)
+
+      @uri.public_send(name,*arguments,&block)
     end
 
     #
-    # Indicates whether a missing method can be handled by {#uri}.
+    # Indicates whether a missing public method can be handled by {#uri}.
     #
     # @return [Boolean]
     #
     def respond_to_missing?(name, include_private = false)
-      @uri.respond_to?(name, include_private) || super
+      @uri.respond_to?(name) || super
     end
 
   end

data/lib/dmarcator/version.rb

@@ -2,5 +2,5 @@
 
 module DMARCator
   # dmarcator version
-  VERSION = '0.6.1'
+  VERSION = '0.7.0'
 end

data/lib/dmarcator/xml_helper.rb

@@ -20,30 +20,6 @@ module DMARCator
       @node.at_xpath(xpath)&.text
     end
 
-    #
-    # Returns a Unix timestamp as a `Time`.
-    #
-    # @param [String] xpath
-    #   The XPath expression to match.
-    #
-    # @return [Time, nil]
-    #
-    def get_timestamp(xpath)
-      parse_timestamp(get_text(xpath))
-    end
-
-    #
-    # Returns an integer value.
-    #
-    # @param [String] xpath
-    #   The XPath expression to match.
-    #
-    # @return [Integer, nil]
-    #
-    def get_int(xpath)
-      parse_integer(get_text(xpath))
-    end
-
     #
     # Parses a Unix timestamp from raw element text.
     #

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dmarcator
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.7.0
 platform: ruby
 authors:
 - Noah Berman
@@ -92,6 +92,8 @@ licenses:
 metadata:
   source_code_uri: https://github.com/bermannoah/dmarcator
   bug_tracker_uri: https://github.com/bermannoah/dmarcator/issues
+  changelog_uri: https://github.com/bermannoah/dmarcator/blob/main/ChangeLog.md
+  documentation_uri: https://rubydoc.info/gems/dmarcator
   rubygems_mfa_required: 'true'
 rdoc_options: []
 require_paths: