@bobfrankston/rmfmail 1.2.256 → 1.2.258

package/packages/mailx-service/index.ts

@@ -264,8 +264,72 @@ interface ReputationResult {
     sources: Array<{ service: string; flagged: boolean; verdict: string }>;
     verdict: string;
     service: string;
+    /** Services that answered something that is NOT a listing verdict —
+     *  "query came through a public resolver", "volume limit exceeded",
+     *  SERVFAIL. Kept out of listedCount/checkedCount so a refusal can never
+     *  read as a conviction, and carried to the UI/log so the feature can say
+     *  it is blind rather than silently reporting "clean". */
+    unavailable: Array<{ service: string; reason: string }>;
 }
 
+// ── DNSBL answer codes ──
+// A DNSBL answers in 127.0.0.0/8 and only SOME of those addresses mean
+// "listed" — the rest are STATUS codes saying why the list did not answer
+// the question. Treating any A record as a listing is what flagged
+// e.nytimes.com as spam on 2 of 2 services (Bob 2026-08-13): from a
+// consumer connection Spamhaus answers 127.255.255.254 ("query via a
+// public/open resolver") for EVERY domain — google.com and Spamhaus's own
+// dbltest.com included — and URIBL answers 127.0.0.1 ("query refused") the
+// same way. Exported so the code tables are unit-testable without DNS.
+
+export type DnsblOutcome =
+    | { service: string; status: "listed"; verdict: string }
+    | { service: string; status: "clean" }
+    | { service: string; status: "unavailable"; reason: string };
+
+/** Interpret one A record from a DNSBL. Returns a verdict for a documented
+ *  listing code, or the reason the answer cannot be read as one. */
+export type DnsblInterpret = (ip: string) => { verdict: string } | { reason: string };
+
+/** Spamhaus DBL — listings are 127.0.1.2 … 127.0.1.106; 127.255.255.x is
+ *  status/error. https://www.spamhaus.org/faq/section/DNSBL%20Usage */
+const DBL_LISTINGS: Record<number, string> = {
+    2: "spam", 4: "phishing", 5: "malware", 6: "botnet C&C",
+    102: "abused legit spam", 103: "abused spammed redirector",
+    104: "abused legit phishing", 105: "abused legit malware", 106: "abused legit botnet",
+};
+const DBL_STATUS: Record<string, string> = {
+    "127.255.255.252": "query name malformed",
+    "127.255.255.253": "anonymous query — a DQS key is required",
+    "127.255.255.254": "query came through a public/open DNS resolver — Spamhaus refuses these (set a Spamhaus DQS key in Settings)",
+    "127.255.255.255": "query volume limit exceeded",
+};
+export const interpretSpamhausDbl: DnsblInterpret = (ip) => {
+    const m = /^127\.0\.1\.(\d+)$/.exec(ip);
+    const code = m ? Number(m[1]) : NaN;
+    if (DBL_LISTINGS[code]) return { verdict: DBL_LISTINGS[code] };
+    if (m && code >= 2 && code <= 106) return { verdict: "listed" };
+    return { reason: DBL_STATUS[ip] || `unrecognized answer ${ip || "(empty)"}` };
+};
+
+/** URIBL / SURBL — both answer 127.0.0.<bitmask>. In BOTH, 127.0.0.1 means
+ *  "query refused" (public resolver / not permitted) and 127.0.0.255 means
+ *  "blocked, too many queries" — neither is a listing. */
+const bitmaskInterpret = (bits: Record<number, string>): DnsblInterpret => (ip) => {
+    const m = /^127\.0\.0\.(\d+)$/.exec(ip);
+    if (!m) return { reason: `unrecognized answer ${ip || "(empty)"}` };
+    const v = Number(m[1]);
+    if (v === 1) return { reason: "query refused — this list does not answer public DNS resolvers" };
+    if (v === 255) return { reason: "query volume limit exceeded" };
+    const names = Object.keys(bits).map(Number).filter(b => v & b).map(b => bits[b]);
+    if (names.length) return { verdict: `listed (${names.join(" + ")})` };
+    return { reason: `unrecognized answer ${ip}` };
+};
+/** URIBL multi: 2 black, 4 grey, 8 red. */
+export const interpretUribl = bitmaskInterpret({ 2: "black", 4: "grey", 8: "red" });
+/** SURBL multi: 8 phishing, 16 malware, 32 abuse, 64 cracked. */
+export const interpretSurbl = bitmaskInterpret({ 8: "phishing", 16: "malware", 32: "abuse", 64: "cracked" });
+
 // ── Service ──
 
 /** Injected popup function — wraps mailx-host's showMessageBox so the
@@ -1952,68 +2016,88 @@ export class MailxService implements MailxApi {
      *    SURBL multi     — `<d>.multi.surbl.org`      mixed (ph/mw/abuse)
      *    URIBL multi     — `<d>.multi.uribl.com`      black/grey/red lists
      *
+     *  A DNSBL answers in 127.0.0.0/8, and only SOME of those addresses mean
+     *  "listed" — the rest are STATUS codes. Treating any A record as a
+     *  listing is the bug that flagged e.nytimes.com as spam on 2 of 2
+     *  services (Bob 2026-08-13). From a consumer connection every DBL query
+     *  comes back `127.255.255.254` ("query via a public/open resolver"),
+     *  including for google.com and for Spamhaus's own dbltest.com, and
+     *  URIBL answers `127.0.0.1` ("query refused") the same way — so the old
+     *  code convicted every domain it looked at. Each service now gets an
+     *  interpreter that returns a verdict ONLY for a documented listing code;
+     *  anything else is "unavailable" and never reaches the banner.
+     *
      *  Each lookup is bounded at 500 ms; missing/slow services are treated
      *  as "unknown" (don't poison the cache). Returns the aggregate plus
      *  the per-service detail so the UI can show "N of 3 services flag
      *  this domain" with the contributing source list.
      *
-     *  Privacy: each query leaks the bare domain to that DNSBL's
-     *  infrastructure plus the user's local resolver. Opt-in via Settings.
+     *  Spamhaus DQS: a free personal key (https://www.spamhaus.com/free-trial/)
+     *  makes DBL answer from any resolver — queries go to
+     *  `<domain>.<key>.dbl.dq.spamhaus.net` instead. Set `spamhausDqsKey` in
+     *  Settings; without it, DBL is simply reported as unavailable rather
+     *  than guessed at.
      *
-     *  No API keys, free for personal use across all three services. */
+     *  Privacy: each query leaks the bare domain to that DNSBL's
+     *  infrastructure plus the user's local resolver. Opt-in via Settings. */
     async checkDomainReputation(domain: string): Promise<ReputationResult | null> {
         domain = (domain || "").toLowerCase().trim();
         if (!domain) return null;
         const cached = this.reputationCache.get(domain);
         if (cached && cached.expiresAt > Date.now()) return cached.result;
 
-        const probe = async (service: string, host: string, mapVerdict: (lastOctet: string) => string)
-            : Promise<{ service: string; flagged: boolean; verdict: string } | null> => {
+        const probe = async (service: string, host: string, interpret: DnsblInterpret): Promise<DnsblOutcome> => {
             try {
                 const lookup = dns.resolve4(`${domain}.${host}`);
                 const timeout = new Promise<never>((_, reject) =>
                     setTimeout(() => reject(new Error("dnsbl-timeout")), MailxService.REPUTATION_TIMEOUT_MS));
                 const records = await Promise.race([lookup, timeout]) as string[];
-                const last = records[0]?.split(".").pop() || "";
-                return { service, flagged: true, verdict: mapVerdict(last) };
+                const ip = records[0] || "";
+                const seen = interpret(ip);
+                return "verdict" in seen
+                    ? { service, status: "listed", verdict: seen.verdict }
+                    : { service, status: "unavailable", reason: seen.reason };
             } catch (e: any) {
                 const code = e?.code || "";
-                if (code === "ENOTFOUND" || code === "ENODATA") {
-                    return { service, flagged: false, verdict: "clean" };
-                }
-                return null; // timeout / network — unknown
+                // NXDOMAIN / no A record is the DNSBL way of saying "not listed".
+                if (code === "ENOTFOUND" || code === "ENODATA") return { service, status: "clean" };
+                return { service, status: "unavailable", reason: code || String(e?.message || e) };
             }
         };
 
-        const dblVerdict = (last: string) =>
-            last === "2" ? "spam" :
-            last === "4" ? "phishing" :
-            last === "5" ? "malware" :
-            last === "6" ? "botnet" :
-            "listed";
-        // SURBL/URIBL encode multiple list memberships in a bitfield; the
-        // distinction matters less to the end user than "how many sources
-        // agree", so we keep a generic "listed" verdict for both.
-        const generic = (_last: string) => "listed";
+        // A DQS key routes DBL queries to Spamhaus's keyed service, which
+        // answers from any resolver. Without one we still ask the public zone —
+        // it works from an ISP resolver that Spamhaus doesn't classify as open.
+        const dqsKey = String((this.getCachedSettings() as any)?.spamhausDqsKey || "").trim();
+        const dblHost = dqsKey ? `${dqsKey}.dbl.dq.spamhaus.net` : "dbl.spamhaus.org";
 
         const sources = await Promise.all([
-            probe("Spamhaus DBL", "dbl.spamhaus.org", dblVerdict),
-            probe("SURBL", "multi.surbl.org", generic),
-            probe("URIBL", "multi.uribl.com", generic),
+            probe("Spamhaus DBL", dblHost, interpretSpamhausDbl),
+            probe("SURBL", "multi.surbl.org", interpretSurbl),
+            probe("URIBL", "multi.uribl.com", interpretUribl),
         ]);
 
-        const known = sources.filter((s): s is { service: string; flagged: boolean; verdict: string } => s !== null);
-        const flagged = known.filter(s => s.flagged);
+        const listed = sources.filter((s): s is Extract<DnsblOutcome, { status: "listed" }> => s.status === "listed");
+        const unavailable = sources.filter((s): s is Extract<DnsblOutcome, { status: "unavailable" }> => s.status === "unavailable");
+        const answered = sources.filter(s => s.status !== "unavailable");
         const result: ReputationResult = {
-            flagged: flagged.length > 0,
-            listedCount: flagged.length,
-            checkedCount: known.length,
-            sources: flagged,
+            flagged: listed.length > 0,
+            listedCount: listed.length,
+            checkedCount: answered.length,
+            sources: listed.map(s => ({ service: s.service, flagged: true, verdict: s.verdict })),
             // Pick the most specific verdict if Spamhaus contributed (since
             // DBL distinguishes phishing/malware/etc); otherwise generic.
-            verdict: flagged.find(s => s.service === "Spamhaus DBL")?.verdict || flagged[0]?.verdict || "clean",
-            service: flagged.map(s => s.service).join(", ") || "Spamhaus DBL / SURBL / URIBL",
+            verdict: listed.find(s => s.service === "Spamhaus DBL")?.verdict || listed[0]?.verdict || "clean",
+            service: listed.map(s => s.service).join(", ") || "Spamhaus DBL / SURBL / URIBL",
+            unavailable: unavailable.map(s => ({ service: s.service, reason: s.reason })),
         };
+        // Say so when the feature is blind — a domain nobody could check must
+        // not read as a domain everybody cleared. Once per cache entry (5 min),
+        // and only when NOTHING answered, so this can't spam the log.
+        if (answered.length === 0) {
+            console.warn(`[reputation] ${domain}: no service could answer — `
+                + unavailable.map(s => `${s.service}: ${s.reason}`).join("; "));
+        }
         this.reputationCache.set(domain, { result, expiresAt: Date.now() + MailxService.REPUTATION_TTL_MS });
         return result;
     }

package/packages/mailx-service/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-service",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",