@blamejs/core 0.18.39 → 0.18.40

package/lib/mail-auth.js

@@ -38,20 +38,45 @@
  *   which ships the Public Suffix List as vendored data; DNS queries
  *   go through an operator-supplied `dnsLookup` callback.
  *
- *   POLICY DISCOVERY QUERIES THREE NAMES, NOT RFC 9989 §4.10's DNS TREE
- *   WALK. In order: the exact domain, then the organizational domain
- *   from `b.publicSuffix` (RFC 7489 §6.6.3's two-step lookup), and —
- *   only when neither published a policy — the public suffix itself,
- *   which is honored when that record carries `psd=y` (RFC 9989 §4.7,
- *   for TLD-operator policy).
+ *   Policy discovery is RFC 9989 §4.10's DNS tree walk: `_dmarc.` at the
+ *   Author Domain, then at each ancestor in turn, so a policy published
+ *   at an INTERMEDIATE label is found — for `a.b.example.com`,
+ *   `_dmarc.b.example.com` is queried, which a two-step exact-then-
+ *   organizational-domain lookup skips.
  *
- *   The tree walk queries each ancestor in turn, so it finds a policy
- *   published at an INTERMEDIATE label that none of those three reach:
- *   for `a.b.example.com` it would consider `_dmarc.b.example.com`, and
- *   a `p=reject` there evaluates as `none` here. If your senders
- *   publish policy at intermediate labels, that gap is real mail
- *   delivered against an intended reject. Tracked as #31; the rest of
- *   the DMARC surface — tags, alignment, reporting — follows RFC 9989.
+ *   The walk carries the spec's own denial-of-service guard: a domain
+ *   with eight or more labels drops straight to seven remaining after
+ *   the first query, so no Author Domain costs more than eight lookups
+ *   however many labels a sender gives it.
+ *
+ *   A single valid record carrying `psd=n` or `psd=y` stops the walk
+ *   (§4.10 step 2), and the Organizational Domain is chosen from what
+ *   the walk found by §4.10.2: a `psd=n` record names it directly, a
+ *   `psd=y` record found above the starting domain names the domain one
+ *   label below it, and otherwise it is the record with the fewest
+ *   labels. `b.publicSuffix` still reports the PSL organizational
+ *   domain on the result, but no longer decides which record applies.
+ *
+ *   A `psd=n` record declares its own name the organizational boundary,
+ *   and relaxed alignment is then bounded by it rather than by the PSL.
+ *   With the boundary at `b.example.com`, mail from `a.b.example.com`
+ *   does not align with an authenticated `evil.example.com` even though
+ *   the list reduces both to `example.com` — honoring the record for
+ *   policy while ignoring it for alignment would let a sibling outside
+ *   the boundary satisfy a policy published inside it. The
+ *   fewest-labels fallback does NOT narrow alignment: it is an
+ *   inference from what happened to be published, not a declaration.
+ *
+ *   A lookup that FAILS is not an answer of "no policy". A name that did
+ *   not resolve may publish the controlling policy, so applying whatever
+ *   the walk did find would downgrade an unknown `p=reject` to a
+ *   `p=none` published higher up: an incomplete walk is a temperror.
+ *
+ *   The exception is a record at the Author Domain itself. That is the
+ *   most specific name there is and its `p=` applies directly, so no
+ *   name the walk failed to read can be more authoritative for the
+ *   policy — otherwise every domain would be hostage to a flaky parent
+ *   zone. A failure at the Author Domain is a temperror outright.
  *
  * ARC (RFC 8617) — chain-of-custody verification. The framework parses
  *   the existing chain headers, recomputes the per-hop signatures, and
@@ -1151,6 +1176,269 @@ async function _fetchDmarcRecord(domain, dnsLookup) {
   return matches[0];
 }
 
+// RFC 9989 §4.10 — the DNS Tree Walk.
+//
+// An Author Domain with many labels must not turn into many DNS queries, so
+// the spec builds the cap into the walk itself: with eight or more labels the
+// second target drops straight to seven remaining, which bounds any domain at
+// eight queries however long it is. That is a denial-of-service guard on the
+// RECEIVER, not a nicety — the sender picks the domain.
+// RFC 1035 §2.3.4 — the wire form of a name is at most 253 octets, and a single
+// label at most 63.
+var DMARC_MAX_QNAME_OCTETS = 253;
+var DNS_MAX_LABEL_OCTETS = 63;
+var DMARC_TREE_WALK_MAX_LABELS = 8;
+var DMARC_TREE_WALK_LABEL_FLOOR = 7;
+
+// The labels of an Author Domain, lowercased, or null when the name is not a
+// syntactically valid domain.
+//
+// A single trailing root dot is legal and is the only thing removed. Every
+// other empty label makes the name malformed, and a malformed name is refused
+// rather than repaired: dropping empty labels wholesale would rewrite
+// `evil..example.com` into the real, separately-owned `evil.example.com` and
+// evaluate THAT domain's policy — returning a verdict, and a
+// `policyOriginDomain`, for a name the message never claimed. b.publicSuffix
+// already refuses the same shape, and the two must not disagree about what
+// counts as a domain.
+// A U-label Author Domain is converted, not refused: the mail surface carries
+// EAI/IDN addresses, and a domain owner publishes `_dmarc` under the A-label
+// form of their name. Querying `_dmarc.münchen.example` finds nothing and would
+// report the domain as having no policy — while `_dmarc.xn--mnchen-3ya.example`
+// resolves. `canonicalDomain` returns "" for a name it cannot canonicalize,
+// including one carrying an empty label, which is the refusal this wants.
+function _dmarcAuthorDomainLabels(domain) {
+  // ONE rule, for every Author Domain. canonicalDomain lowercases, converts to
+  // A-labels, strips exactly one root marker in whichever spelling it arrived,
+  // and refuses an empty label, a control byte, a URL delimiter and an
+  // over-length name. Reproducing any part of that here is how the layers
+  // drifted: a local root-marker strip let a second one come off inside
+  // canonicalDomain and turned `münchen.example。.` into a real, different
+  // domain, while a local ASCII fast path skipped the character and length
+  // rules entirely and accepted `example.com/evil` — a name that matters
+  // because `domainToASCII` TRUNCATES at the delimiter, so it can masquerade
+  // as a trusted prefix of itself.
+  //
+  // Going through the same function the authenticated SPF and DKIM domains
+  // reach via `_alignmentCheck` is also what lets a message align with itself:
+  // both sides end up in one canonical form.
+  var d = publicSuffix.canonicalDomain(String(domain));
+  if (!d) return null;
+  // RFC 1035 §2.3.4 bounds a LABEL at 1..63 octets as well as the whole name at
+  // 253, and `canonicalDomain` enforces only the second — it is the framework's
+  // definition of a domain NAME, and a label cap is a DNS wire rule rather than
+  // a naming one. Checking it here keeps the answer the same whichever resolver
+  // is wired in: the default one refuses an over-long label as `dns/bad-host`
+  // and the evaluation temperrors, while an operator's own `dnsLookup` would
+  // answer for it and let a policy apply to a name that cannot exist.
+  var labels = d.split(".");
+  for (var i = 0; i < labels.length; i += 1) {
+    if (labels[i].length === 0 || labels[i].length > DNS_MAX_LABEL_OCTETS) return null;
+  }
+  return labels;
+}
+
+// The ordered list of names the walk queries, starting with the domain itself.
+// For the RFC's own example, a.b.c.d.e.f.g.h.i.j.mail.example.com, this is the
+// eight names it lists. A malformed Author Domain has no targets; `evaluate`
+// refuses it before the walk is reached.
+function _dmarcTreeWalkTargets(domain) {
+  var labels = _dmarcAuthorDomainLabels(domain);
+  if (labels === null || labels.length === 0) return [];
+  var targets = [labels.join(".")];
+  var rest = labels.length >= DMARC_TREE_WALK_MAX_LABELS
+    ? labels.slice(labels.length - DMARC_TREE_WALK_LABEL_FLOOR)   // keep seven
+    : labels.slice(1);                                            // drop the leftmost
+  while (rest.length > 0) {
+    targets.push(rest.join("."));
+    rest = rest.slice(1);
+  }
+  return targets;
+}
+
+// Walk the targets in order, collecting every valid record. `_fetchDmarcRecord`
+// already applies step 2's first two rules — a record whose v= tag does not
+// name this DMARC version is discarded, and multiple records at one target are
+// ALL discarded. The third rule is here: a single valid record carrying `psd=n`
+// or `psd=y` stops the walk, so nothing above it is queried.
+// A lookup that FAILED is not the same answer as one that said "no such
+// record" — RFC 9989 is explicit that only the latter means DMARC does not
+// apply. The walk therefore records transient failures instead of letting the
+// first one abort it: a policy found at one name is still a policy even if an
+// ancestor's lookup fell over, and `transient` only decides the outcome when
+// the walk found nothing at all.
+//
+// A failure at the STARTING domain is different in kind and rethrown — that is
+// the authoritative lookup for this message, and answering "no policy" because
+// it was unreachable would be inventing an answer.
+async function _dmarcTreeWalk(domain, dnsLookup) {
+  var targets = _dmarcTreeWalkTargets(domain);
+  var found = [];
+  var transient = false;
+  // The first target is the Author Domain as the walk NORMALIZED it — lowercased
+  // and with the root dot dropped. Callers must compare against this rather than
+  // against the raw From-header domain: `example.com.` and `EXAMPLE.com` would
+  // otherwise never match their own record, which would demote it to an
+  // ancestor and apply `sp=` where `p=` governs. A `p=reject; sp=none` record
+  // would then permit exactly the mail it rejects.
+  var start = targets.length > 0 ? targets[0] : null;
+  // Once ANY record is in hand, a name above it can only refine the walk, never
+  // decide it: the walk runs most-specific first, so the closest record found
+  // supplies `p=` directly and every closer name has already answered. A broken
+  // or unresolvable record published higher is then a fact about that zone, and
+  // a domain owner controls what they publish rather than what their parent
+  // does — abandoning a `p=reject` that resolved cleanly over it would let a
+  // parent turn its children's policy into no policy at all.
+  //
+  // Before the first record there is nothing to protect, the unread name may be
+  // the one whose policy would have applied, and the walk cannot know what it
+  // said: the error stands rather than skipping to a weaker record above it.
+  //
+  // True when the walk passed over a name without reading it. Keeping the
+  // Author Domain's policy across such a gap is a decision about the POLICY
+  // only: a name that was not read may publish `psd=n`, a boundary narrower
+  // than the Public Suffix List, and relaxed alignment computed without it
+  // would admit a sibling that boundary exists to separate. `evaluate` withholds
+  // relaxed alignment while this is set.
+  var skipped = false;
+  // True when a name the walk could not read is MORE specific than the closest
+  // record it found — including the case where it found none at all. Direction
+  // is what decides whether an unread name can still matter: the walk runs
+  // most-specific first, so once a record is in hand every closer name has
+  // already answered, and a name above it can carry a boundary but never a
+  // policy that beats it. A name BELOW it is the opposite — its policy would
+  // have won, and the walk cannot know what it said.
+  var unreadBelowClosestRecord = false;
+  // How many names the resolver was actually asked about — not how many were
+  // generated. The two differ whenever the walk stops early or steps over an
+  // unqueryable name, and the count reaches operators in the "no DMARC record
+  // at any of the N name(s)" explanation, where a name nothing was sent to
+  // would read as one that answered nothing.
+  var queried = 0;
+  for (var i = 0; i < targets.length; i += 1) {
+    var raw;
+    var parsed;
+    // `_dmarc.` is seven octets the Author Domain did not choose, so a domain
+    // close to the RFC 1035 ceiling can be perfectly valid while its policy
+    // name is not. Nobody can publish a record at an unrepresentable name —
+    // including its owner — so this is "no record exists here", the same as an
+    // empty answer, and the walk continues to the ancestors.
+    //
+    // Treating it as a lookup failure aborted the whole evaluation with a
+    // temperror and never asked them, so a `p=reject` one label up was neither
+    // found nor applied.
+    if (("_dmarc." + targets[i]).length > DMARC_MAX_QNAME_OCTETS) continue;
+    try {
+      queried += 1;
+      raw = await _fetchDmarcRecord(targets[i], dnsLookup);
+      if (!raw) continue;
+      parsed = _parseDmarcRecord(raw);
+    } catch (e) {
+      if (i === 0) throw e;
+      if (_isPermanentDmarcError(e)) {
+        // Any record already found is enough, not only one at the Author
+        // Domain: the walk runs most-specific first, so a malformed record at
+        // a name ABOVE the closest one it read cannot carry a policy that
+        // outranks it. Discarding a clean `p=reject` over a broken record
+        // published higher in the tree hands a parent zone the power to turn
+        // its children's policy into no policy at all.
+        // `skipped` is NOT set here. It means "a name went past without being
+        // read", and such a name may publish `psd=n` — a boundary narrower than
+        // the Public Suffix List — which is why it withholds relaxed alignment.
+        // A malformed record is the opposite: the walk READ it, and a record
+        // that does not parse declares no boundary at all. Counting it as
+        // unread forces both alignment modes to strict and fails mail that
+        // aligns correctly under the closer record's own relaxed policy.
+        if (found.length > 0) continue;
+        throw e;
+      }
+      transient = true;
+      skipped = true;
+      if (found.length === 0) unreadBelowClosestRecord = true;
+      continue;
+    }
+    found.push({ domain: targets[i], policy: parsed, labels: targets[i].split(".").length });
+    if (parsed.psd === "n" || parsed.psd === "y") break;
+  }
+  return { found: found, transient: transient, start: start, skipped: skipped,
+           queried: queried, unreadBelowClosestRecord: unreadBelowClosestRecord };
+}
+
+// RFC 9989 §4.10.1 — a syntactically invalid or policy-less record is a
+// PERMANENT error (permerror); only a DNS resolution failure is transient.
+// These are the codes `_parseDmarcRecord` actually raises, and the single place
+// that decides: the walk asks it to know whether to keep going, and evaluate()
+// asks it to choose between permerror and temperror. Two copies of this list
+// drift, and a code that matches neither reads as transient — which would let a
+// malformed record at one name be skipped and a policy from another applied.
+function _isPermanentDmarcError(e) {
+  return !!(e && typeof e.code === "string" &&
+    (e.code === "mail-auth/dmarc-bad-version" ||
+     e.code === "mail-auth/dmarcbis-bad-tag" ||
+     e.code === "mail-auth/dmarc-missing-policy"));
+}
+
+// The walk's record for one name, or null.
+function _dmarcRecordAt(found, domain) {
+  return found.filter(function (r) { return r.domain === domain; })[0] || null;
+}
+
+// RFC 9989 §4.10.2 — which of the records the walk produced names the
+// Organizational Domain, in the spec's order of precedence.
+function _dmarcOrganizationalDomain(found, startDomain) {
+  var i;
+  for (i = 0; i < found.length; i += 1) {
+    if (found[i].policy.psd === "n") return { domain: found[i].domain, via: "psd-n" };
+  }
+  for (i = 0; i < found.length; i += 1) {
+    if (found[i].policy.psd !== "y") continue;
+    // A `psd=y` record AT the starting domain has nothing below it to name —
+    // the walk started there — and it shares an organization with NOBODY.
+    //
+    // The record says this name is a public suffix, which makes each immediate
+    // child a separately registrable name belonging to whoever registered it.
+    // So the declaring name and everything under it are different
+    // organizations, and relaxed alignment — whose whole job is to join names
+    // within one organization — has nothing to join. Reporting the name as an
+    // organizational boundary would be worse than reporting none: every
+    // registrant under the suffix would sit inside it and could authenticate
+    // mail claiming to come from the registry itself.
+    //
+    // Falling through to the fewest-labels inference is equally wrong, because
+    // that reduces both sides to the Public Suffix List answer and lets an
+    // authenticated sibling satisfy the `p=reject` the declaring domain
+    // published about itself. RFC 9989 §4.10 stops the walk on either psd
+    // value, so no ancestor is queried that could supply a boundary later.
+    //
+    // What is left is exact alignment, and `evaluate` reads this `via` to
+    // require it.
+    if (found[i].domain === startDomain) {
+      return { domain: startDomain, via: "psd-y-self" };
+    }
+    var below = _labelBelow(startDomain, found[i].domain);
+    if (below) return { domain: below, via: "psd-y" };
+  }
+  var fewest = null;
+  for (i = 0; i < found.length; i += 1) {
+    if (fewest === null || found[i].labels < fewest.labels) fewest = found[i];
+  }
+  return fewest ? { domain: fewest.domain, via: "fewest-labels" } : null;
+}
+
+// The name one label below `ancestor` on the path from `startDomain`, or null
+// when `ancestor` is not an ancestor of it.
+// Both arguments are walk targets, which carry no empty label — so no label is
+// dropped here. Comparing the labels as they are keeps it that way: silently
+// removing one would make a name read as an ancestor of a domain it is not on
+// the path of.
+function _labelBelow(startDomain, ancestor) {
+  var start = String(startDomain).toLowerCase().split(".");
+  var anc = String(ancestor).toLowerCase().split(".");
+  if (anc.length >= start.length) return null;
+  if (start.slice(start.length - anc.length).join(".") !== anc.join(".")) return null;
+  return start.slice(start.length - anc.length - 1).join(".");
+}
+
 // RFC 9989 (DMARCbis) base policy keys
 // extensions:
 //   np=<none|quarantine|reject>  policy for non-existent subdomains
@@ -1232,7 +1520,15 @@ function _parseDmarcRecord(text) {
   return policy;
 }
 
-function _alignmentCheck(fromDomain, authDomain, mode) {
+// `boundary`, when given, is the Organizational Domain the RFC 9989 tree walk
+// established — a name that published `psd=n`, which is a domain declaring
+// itself the organizational boundary. Relaxed alignment must respect it: with
+// the boundary at `b.example.com`, mail from `a.b.example.com` does NOT align
+// with an authenticated `evil.example.com`, even though the Public Suffix List
+// reduces both to `example.com`. Honouring the record for policy while ignoring
+// it here would let a sibling outside the declared boundary satisfy a policy
+// published inside it.
+function _alignmentCheck(fromDomain, authDomain, mode, boundary) {
   if (!fromDomain || !authDomain) return false;
   // Canonicalize both domains identically (lowercase + trailing-dot strip + IDN
   // A-label) so strict alignment compares the same host form the relaxed PSL
@@ -1249,6 +1545,13 @@ function _alignmentCheck(fromDomain, authDomain, mode) {
   // aligned even though they're separately registered. PSL lookup
   // closes the gap.
   if (f === a) return true;
+  if (boundary) {
+    // Both sides must sit at or under the declared boundary. Reducing to the
+    // PSL organizational domain here would step over it.
+    var b = publicSuffix.canonicalDomain(boundary);
+    if (!b) return false;
+    return _isAtOrUnder(f, b) && _isAtOrUnder(a, b);
+  }
   var fOrg = null;
   var aOrg = null;
   try { fOrg = publicSuffix.organizationalDomain(f); } catch (_e) { fOrg = null; }
@@ -1257,6 +1560,17 @@ function _alignmentCheck(fromDomain, authDomain, mode) {
   return false;
 }
 
+// True when `domain` IS `ancestor` or a subdomain of it — compared label by
+// label, so `evil-b.example.com` does not read as a subdomain of
+// `b.example.com` the way a text-suffix test would.
+function _isAtOrUnder(domain, ancestor) {
+  if (domain === ancestor) return true;
+  var d = String(domain).split(".");
+  var a = String(ancestor).split(".");
+  if (d.length <= a.length) return false;
+  return d.slice(d.length - a.length).join(".") === a.join(".");
+}
+
 async function dmarcEvaluate(opts) {
   opts = opts || {};
   validateOpts(opts, ["from", "spf", "dkim", "dnsLookup", "domainExists",
@@ -1281,6 +1595,13 @@ async function dmarcEvaluate(opts) {
       "dmarc.evaluate: opts.from is missing the @domain part");
   }
   fromDomain = fromDomain.toLowerCase();
+  // An empty label makes the name malformed. It is refused here rather than
+  // normalized away, so no evaluation can end up reporting the policy of a
+  // neighbouring domain that the repair happened to produce.
+  if (_dmarcAuthorDomainLabels(fromDomain) === null) {
+    throw new MailAuthError("mail-auth/dmarc-bad-from",
+      "dmarc.evaluate: the From domain has an empty label (not a valid domain name)");
+  }
 
   // RFC 9989 replaces the legacy "drop one
   // label" org-domain heuristic with a proper Public Suffix List lookup.
@@ -1295,72 +1616,136 @@ async function dmarcEvaluate(opts) {
   var policyOriginDomain = null;
   var orgDomainPolicyApplied = false;
   var psdPolicyApplied = false;
+  // Set only when the walk found a record declaring itself the organizational
+  // boundary (`psd=n`). Relaxed alignment is then bounded by that name instead
+  // of by the Public Suffix List, which would reach past it.
+  var alignmentBoundary = null;
+  // Set when the walk passed over a name it could not read. The exemptions below
+  // keep the Author Domain's policy across such a gap; they do not decide
+  // alignment, which a boundary at the unread name could have narrowed.
+  var walkSkipped = false;
+  // Set when the Author Domain declared ITSELF a public suffix. It then shares
+  // an organization with no other name, so relaxed alignment has nothing to
+  // join and only an exact match can hold.
+  var alignmentExactOnly = false;
   try {
-    var rec = await _fetchDmarcRecord(fromDomain, opts.dnsLookup);
-    if (rec) {
-      policy = _parseDmarcRecord(rec);
-      policyOriginDomain = fromDomain;
-    } else if (orgDomain && orgDomain !== fromDomain) {
-      // Fall through to the organizational domain. When the org-domain
-      // record sets sp= it applies to this subdomain; otherwise p= is the
-      // operative policy.
+    // RFC 9989 §4.10 — the DNS tree walk. Every ancestor is queried in turn,
+    // which finds a policy published at an INTERMEDIATE label; the two-step
+    // lookup this replaces (exact domain, then the PSL organizational domain)
+    // skipped those, so a `p=reject` at `b.example.com` evaluated as `none`
+    // for `a.b.example.com` and mail the domain owner meant to reject was
+    // delivered.
+    var walk = await _dmarcTreeWalk(fromDomain, opts.dnsLookup);
+    var found = walk.found;
+    var atStart = _dmarcRecordAt(found, walk.start);
+    // A lookup that never completed means the walk cannot say what policy
+    // applies — only that it could not tell. Answering with whatever it did
+    // find would apply a policy from higher in the tree while a name it failed
+    // to read may publish a stricter one, so an unavailable ancestor would
+    // downgrade `p=reject` to a `p=none` published above it.
+    //
+    // The exception is a record at the Author Domain itself. That is the most
+    // specific name there is and its `p=` applies directly, so no name the walk
+    // failed to read can be more authoritative for the policy. Without this,
+    // any flaky parent zone would temperror mail whose own policy resolved
+    // cleanly. RFC 9989 §4.10 leaves the handling of a DNS error during the
+    // walk to the receiver, so this is a choice the specification allows —
+    // about the policy alone. What an unread name could still have changed is
+    // the alignment boundary, and `walkSkipped` withholds relaxed alignment for
+    // exactly that reason.
+    walkSkipped = walk.skipped === true;
+    // Only a name the walk could not read that is MORE SPECIFIC than the
+    // closest record it found can change which policy applies — the record at
+    // the Author Domain is just the strongest case of that, not a special one.
+    // A failure above a record found at an intermediate name used to discard
+    // that record and answer temperror, throwing away a `p=reject` the walk had
+    // already read because a name that could not have outranked it timed out.
+    if (walk.unreadBelowClosestRecord) {
+      throw new MailAuthError("mail-auth/dmarc-lookup-failed",
+        "DMARC tree walk could not complete for " + fromDomain +
+        " — a name below the record that would apply did not resolve");
+    }
+    // RFC 9989 §4.10.2 picks which of the found records applies. `orgDomain`
+    // keeps the PSL answer: that is what the field has always reported and what
+    // callers surface, and the name the walk selects is reported separately as
+    // `policyOriginDomain`. Overwriting one with the other would silently
+    // change the meaning of an existing result field.
+    var selected = _dmarcOrganizationalDomain(found, walk.start);
+    // Both `psd` values DECLARE a boundary, and each names a different one:
+    // `psd=n` says "this name is the Organizational Domain", `psd=y` says "this
+    // name is a public suffix", which puts the Organizational Domain one label
+    // below it. `_dmarcOrganizationalDomain` has already resolved either into
+    // the name itself, so both constrain alignment the same way.
+    //
+    // The `psd=y` case is the one the Public Suffix List is most likely to get
+    // wrong — a multi-label PSD the vendored list does not carry — so reducing
+    // to the list for alignment there puts every tenant of a platform in one
+    // organization: a `p=reject` at `platform.example` was satisfied by an
+    // authenticated `evil.platform.example` for mail from
+    // `tenant.platform.example`.
+    //
+    // The fewest-labels fallback is NOT a declaration. It is an inference from
+    // what happened to be published, and narrowing alignment on an inference
+    // would refuse mail that aligns perfectly well today.
+    if (selected && (selected.via === "psd-n" || selected.via === "psd-y")) {
+      alignmentBoundary = selected.domain;
+    }
+    // `psd-y-self` — the Author Domain declared ITSELF a public suffix, so it
+    // shares an organization with nothing and there is no boundary to be inside
+    // of. Exact alignment is the only kind that can hold: a descendant is a
+    // separate registrant, and a sibling is a separate name entirely.
+    if (selected && selected.via === "psd-y-self") alignmentExactOnly = true;
+
+    if (atStart) {
+      // A record at the Author Domain itself: `p=` is the operative policy,
+      // because no subdomain rule is in play.
+      policy = atStart.policy;
+      policyOriginDomain = atStart.domain;
+    } else if (found.length > 0) {
+      // Which name is the Organizational Domain and which record supplies the
+      // policy are two different questions, and `selected` only answers the
+      // first. The policy comes from the CLOSEST record the walk found — the
+      // walk queries from the Author Domain upward, so that is the first one.
       //
-      // This is the RFC 7489 §6.6.3 two-step lookup — the exact domain, then
-      // the PSL organizational domain — NOT RFC 9989 §4.10's DNS tree walk,
-      // which queries each ancestor in turn and so can find a policy at an
-      // intermediate label this path skips. For `a.b.example.com` the tree
-      // walk would consider `_dmarc.b.example.com`; this does not.
-      var orgRec = await _fetchDmarcRecord(orgDomain, opts.dnsLookup);
-      if (orgRec) {
-        var orgPolicy = _parseDmarcRecord(orgRec);
-        orgPolicy.p = orgPolicy.sp || orgPolicy.p;
-        policy = orgPolicy;
-        policyOriginDomain = orgDomain;
-        orgDomainPolicyApplied = true;
-      }
-    }
-
-    // RFC 9989 §4.7 — when the org-domain record carries `psd=y`, OR
-    // the published record sits at the public suffix itself (TLD
-    // operator), the receiver continues lookup at the public suffix
-    // for downstream DSP cooperation. We honor the `psd=y` opt-in by
-    // surfacing the tag so operators can route on it; the explicit
-    // suffix walk below covers the suffix-record case.
-    if (!policy) {
-      var suffix = null;
-      try { suffix = publicSuffix.publicSuffix(fromDomain); }
-      catch (_e) { suffix = null; }
-      if (suffix && suffix !== fromDomain && suffix !== orgDomain) {
-        var psdRec = await _fetchDmarcRecord(suffix, opts.dnsLookup);
-        if (psdRec) {
-          var psdPolicy = _parseDmarcRecord(psdRec);
-          if (psdPolicy.psd === "y") {
-            psdPolicy.p = psdPolicy.sp || psdPolicy.p;
-            policy = psdPolicy;
-            policyOriginDomain = suffix;
-            psdPolicyApplied = true;
-          }
-        }
-      }
+      // Answering both with `selected` recreates exactly the downgrade this
+      // walk exists to stop: with `p=reject` at `b.example.com` and
+      // `p=none; psd=n` at `example.com`, mail from `a.b.example.com` would
+      // take the `p=none` published two labels up. The boundary is still the
+      // `psd=n` name; the policy is still the closer record.
+      var chosen = found[0];
+      // The record governs a subdomain here, so `sp=` is the operative policy
+      // when it is set.
+      chosen.policy.p = chosen.policy.sp || chosen.policy.p;
+      policy = chosen.policy;
+      policyOriginDomain = chosen.domain;
+      // Which flag is reported describes the record that was APPLIED, not the
+      // boundary. A `psd=y` record two labels up can be the boundary while an
+      // ordinary domain closer in supplies the policy — that is an
+      // organizational-domain policy, not a public-suffix operator's.
+      if (chosen.policy.psd === "y") psdPolicyApplied = true;
+      else orgDomainPolicyApplied = true;
     }
   } catch (e) {
-    // RFC 9989 §4.10.1 — a syntactically invalid / policy-less record is a
-    // PERMANENT error (permerror); only transient DNS resolution failures
-    // are temperror. The DMARC parser raises typed MailAuthError codes for
-    // the permanent cases (bad version, unrecognized tag value, missing
-    // required p=); anything else (DNS lookup) is transient. Either way the
-    // disposition is fail-closed — neither path yields recommendedAction
-    // "deliver".
-    var permanent = e && typeof e.code === "string" &&
-      (e.code === "mail-auth/dmarc-bad-version" ||
-       e.code === "mail-auth/dmarcbis-bad-tag" ||
-       e.code === "mail-auth/dmarc-missing-policy");
+    // Either disposition is fail-closed — neither yields recommendedAction
+    // "deliver". Which one is _isPermanentDmarcError's single answer.
+    var permanent = _isPermanentDmarcError(e);
     return { result: permanent ? "permerror" : "temperror", explanation: e.message,
              policy: null, alignment: { spf: false, dkim: false },
              orgDomain: orgDomain };
   }
   if (!policy) {
-    return { result: "none", explanation: "no DMARC record at _dmarc." + fromDomain,
+    // Naming one domain was accurate when discovery queried one domain. The
+    // walk queries up to eight, under the normalized name — so reporting the
+    // raw From domain would name a name that was never asked for, which for a
+    // U-label address is a different name entirely.
+    //
+    // The count is reported rather than "every ancestor", because for a domain
+    // of eight or more labels the walk deliberately skips the names between the
+    // start and the seven-label suffix. Claiming those were searched would be
+    // the same kind of overstatement in the other direction.
+    return { result: "none",
+             explanation: "no DMARC record at any of the " + walk.queried +
+                          " name(s) queried from _dmarc." + walk.start + " upward",
              policy: null, alignment: { spf: false, dkim: false },
              orgDomain: orgDomain };
   }
@@ -1385,13 +1770,28 @@ async function dmarcEvaluate(opts) {
   var spfDomain = (opts.spf && opts.spf.domain) || null;
   var dkimResults = Array.isArray(opts.dkim) ? opts.dkim : (opts.dkim ? [opts.dkim] : []);
 
+  // Applying the Author Domain's own policy across a name the walk could not
+  // read decides the POLICY, not the alignment. That name may publish `psd=n`,
+  // a boundary narrower than the Public Suffix List, so relaxed alignment
+  // computed without it can admit an authenticated sibling the boundary exists
+  // to separate — a `p=reject` published inside the boundary satisfied from
+  // outside it.
+  //
+  // Relaxed is therefore withheld until the walk completes. Strict is not: every
+  // boundary the walk could have found lies at or above the Author Domain, so an
+  // exact match is aligned under all of them and under none of them. The message
+  // that cannot be decided is the one that is refused.
+  var relaxedUnavailable = walkSkipped || alignmentExactOnly;
+  var alignSpf = relaxedUnavailable ? "s" : policy.aspf;
+  var alignDkim = relaxedUnavailable ? "s" : policy.adkim;
+
   var spfAligned = opts.spf && opts.spf.result === "pass" &&
-                   _alignmentCheck(fromDomain, spfDomain, policy.aspf);
+                   _alignmentCheck(fromDomain, spfDomain, alignSpf, alignmentBoundary);
   var dkimAligned = false;
   for (var i = 0; i < dkimResults.length; i += 1) {
     var d = dkimResults[i];
     if (d && d.result === "pass" &&
-        _alignmentCheck(fromDomain, d.d || d.domain, policy.adkim)) {
+        _alignmentCheck(fromDomain, d.d || d.domain, alignDkim, alignmentBoundary)) {
       dkimAligned = true;
       break;
     }