@bobfrankston/rmfmail 1.2.257 → 1.2.259

package/packages/mailx-service/index.js

@@ -246,6 +246,49 @@ function calendarRowEquals(prior, fresh) {
         && (prior.htmlLink || null) === (fresh.htmlLink || null)
         && (prior.calendarId || "") === (fresh.calendarId || "");
 }
+/** Spamhaus DBL — listings are 127.0.1.2 … 127.0.1.106; 127.255.255.x is
+ *  status/error. https://www.spamhaus.org/faq/section/DNSBL%20Usage */
+const DBL_LISTINGS = {
+    2: "spam", 4: "phishing", 5: "malware", 6: "botnet C&C",
+    102: "abused legit spam", 103: "abused spammed redirector",
+    104: "abused legit phishing", 105: "abused legit malware", 106: "abused legit botnet",
+};
+const DBL_STATUS = {
+    "127.255.255.252": "query name malformed",
+    "127.255.255.253": "anonymous query — a DQS key is required",
+    "127.255.255.254": "query came through a public/open DNS resolver — Spamhaus refuses these (set a Spamhaus DQS key in Settings)",
+    "127.255.255.255": "query volume limit exceeded",
+};
+export const interpretSpamhausDbl = (ip) => {
+    const m = /^127\.0\.1\.(\d+)$/.exec(ip);
+    const code = m ? Number(m[1]) : NaN;
+    if (DBL_LISTINGS[code])
+        return { verdict: DBL_LISTINGS[code] };
+    if (m && code >= 2 && code <= 106)
+        return { verdict: "listed" };
+    return { reason: DBL_STATUS[ip] || `unrecognized answer ${ip || "(empty)"}` };
+};
+/** URIBL / SURBL — both answer 127.0.0.<bitmask>. In BOTH, 127.0.0.1 means
+ *  "query refused" (public resolver / not permitted) and 127.0.0.255 means
+ *  "blocked, too many queries" — neither is a listing. */
+const bitmaskInterpret = (bits) => (ip) => {
+    const m = /^127\.0\.0\.(\d+)$/.exec(ip);
+    if (!m)
+        return { reason: `unrecognized answer ${ip || "(empty)"}` };
+    const v = Number(m[1]);
+    if (v === 1)
+        return { reason: "query refused — this list does not answer public DNS resolvers" };
+    if (v === 255)
+        return { reason: "query volume limit exceeded" };
+    const names = Object.keys(bits).map(Number).filter(b => v & b).map(b => bits[b]);
+    if (names.length)
+        return { verdict: `listed (${names.join(" + ")})` };
+    return { reason: `unrecognized answer ${ip}` };
+};
+/** URIBL multi: 2 black, 4 grey, 8 red. */
+export const interpretUribl = bitmaskInterpret({ 2: "black", 4: "grey", 8: "red" });
+/** SURBL multi: 8 phishing, 16 malware, 32 abuse, 64 cracked. */
+export const interpretSurbl = bitmaskInterpret({ 8: "phishing", 16: "malware", 32: "abuse", 64: "cracked" });
 /** How long an un-consumed compose-popout init stash survives. The popout
  *  window normally consumes it within a second of spawning; the timer only
  *  matters when the window fails to launch. */
@@ -1991,15 +2034,30 @@ export class MailxService {
      *    SURBL multi     — `<d>.multi.surbl.org`      mixed (ph/mw/abuse)
      *    URIBL multi     — `<d>.multi.uribl.com`      black/grey/red lists
      *
+     *  A DNSBL answers in 127.0.0.0/8, and only SOME of those addresses mean
+     *  "listed" — the rest are STATUS codes. Treating any A record as a
+     *  listing is the bug that flagged e.nytimes.com as spam on 2 of 2
+     *  services (Bob 2026-08-13). From a consumer connection every DBL query
+     *  comes back `127.255.255.254` ("query via a public/open resolver"),
+     *  including for google.com and for Spamhaus's own dbltest.com, and
+     *  URIBL answers `127.0.0.1` ("query refused") the same way — so the old
+     *  code convicted every domain it looked at. Each service now gets an
+     *  interpreter that returns a verdict ONLY for a documented listing code;
+     *  anything else is "unavailable" and never reaches the banner.
+     *
      *  Each lookup is bounded at 500 ms; missing/slow services are treated
      *  as "unknown" (don't poison the cache). Returns the aggregate plus
      *  the per-service detail so the UI can show "N of 3 services flag
      *  this domain" with the contributing source list.
      *
-     *  Privacy: each query leaks the bare domain to that DNSBL's
-     *  infrastructure plus the user's local resolver. Opt-in via Settings.
+     *  Spamhaus DQS: a free personal key (https://www.spamhaus.com/free-trial/)
+     *  makes DBL answer from any resolver — queries go to
+     *  `<domain>.<key>.dbl.dq.spamhaus.net` instead. Set `spamhausDqsKey` in
+     *  Settings; without it, DBL is simply reported as unavailable rather
+     *  than guessed at.
      *
-     *  No API keys, free for personal use across all three services. */
+     *  Privacy: each query leaks the bare domain to that DNSBL's
+     *  infrastructure plus the user's local resolver. Opt-in via Settings. */
     async checkDomainReputation(domain) {
         domain = (domain || "").toLowerCase().trim();
         if (!domain)
@@ -2007,48 +2065,56 @@ export class MailxService {
         const cached = this.reputationCache.get(domain);
         if (cached && cached.expiresAt > Date.now())
             return cached.result;
-        const probe = async (service, host, mapVerdict) => {
+        const probe = async (service, host, interpret) => {
             try {
                 const lookup = dns.resolve4(`${domain}.${host}`);
                 const timeout = new Promise((_, reject) => setTimeout(() => reject(new Error("dnsbl-timeout")), MailxService.REPUTATION_TIMEOUT_MS));
                 const records = await Promise.race([lookup, timeout]);
-                const last = records[0]?.split(".").pop() || "";
-                return { service, flagged: true, verdict: mapVerdict(last) };
+                const ip = records[0] || "";
+                const seen = interpret(ip);
+                return "verdict" in seen
+                    ? { service, status: "listed", verdict: seen.verdict }
+                    : { service, status: "unavailable", reason: seen.reason };
             }
             catch (e) {
                 const code = e?.code || "";
-                if (code === "ENOTFOUND" || code === "ENODATA") {
-                    return { service, flagged: false, verdict: "clean" };
-                }
-                return null; // timeout / network — unknown
+                // NXDOMAIN / no A record is the DNSBL way of saying "not listed".
+                if (code === "ENOTFOUND" || code === "ENODATA")
+                    return { service, status: "clean" };
+                return { service, status: "unavailable", reason: code || String(e?.message || e) };
             }
         };
-        const dblVerdict = (last) => last === "2" ? "spam" :
-            last === "4" ? "phishing" :
-                last === "5" ? "malware" :
-                    last === "6" ? "botnet" :
-                        "listed";
-        // SURBL/URIBL encode multiple list memberships in a bitfield; the
-        // distinction matters less to the end user than "how many sources
-        // agree", so we keep a generic "listed" verdict for both.
-        const generic = (_last) => "listed";
+        // A DQS key routes DBL queries to Spamhaus's keyed service, which
+        // answers from any resolver. Without one we still ask the public zone —
+        // it works from an ISP resolver that Spamhaus doesn't classify as open.
+        const dqsKey = String(this.getCachedSettings()?.spamhausDqsKey || "").trim();
+        const dblHost = dqsKey ? `${dqsKey}.dbl.dq.spamhaus.net` : "dbl.spamhaus.org";
         const sources = await Promise.all([
-            probe("Spamhaus DBL", "dbl.spamhaus.org", dblVerdict),
-            probe("SURBL", "multi.surbl.org", generic),
-            probe("URIBL", "multi.uribl.com", generic),
+            probe("Spamhaus DBL", dblHost, interpretSpamhausDbl),
+            probe("SURBL", "multi.surbl.org", interpretSurbl),
+            probe("URIBL", "multi.uribl.com", interpretUribl),
         ]);
-        const known = sources.filter((s) => s !== null);
-        const flagged = known.filter(s => s.flagged);
+        const listed = sources.filter((s) => s.status === "listed");
+        const unavailable = sources.filter((s) => s.status === "unavailable");
+        const answered = sources.filter(s => s.status !== "unavailable");
         const result = {
-            flagged: flagged.length > 0,
-            listedCount: flagged.length,
-            checkedCount: known.length,
-            sources: flagged,
+            flagged: listed.length > 0,
+            listedCount: listed.length,
+            checkedCount: answered.length,
+            sources: listed.map(s => ({ service: s.service, flagged: true, verdict: s.verdict })),
             // Pick the most specific verdict if Spamhaus contributed (since
             // DBL distinguishes phishing/malware/etc); otherwise generic.
-            verdict: flagged.find(s => s.service === "Spamhaus DBL")?.verdict || flagged[0]?.verdict || "clean",
-            service: flagged.map(s => s.service).join(", ") || "Spamhaus DBL / SURBL / URIBL",
+            verdict: listed.find(s => s.service === "Spamhaus DBL")?.verdict || listed[0]?.verdict || "clean",
+            service: listed.map(s => s.service).join(", ") || "Spamhaus DBL / SURBL / URIBL",
+            unavailable: unavailable.map(s => ({ service: s.service, reason: s.reason })),
         };
+        // Say so when the feature is blind — a domain nobody could check must
+        // not read as a domain everybody cleared. Once per cache entry (5 min),
+        // and only when NOTHING answered, so this can't spam the log.
+        if (answered.length === 0) {
+            console.warn(`[reputation] ${domain}: no service could answer — `
+                + unavailable.map(s => `${s.service}: ${s.reason}`).join("; "));
+        }
         this.reputationCache.set(domain, { result, expiresAt: Date.now() + MailxService.REPUTATION_TTL_MS });
         return result;
     }