@push.rocks/smartmta 6.5.2 → 8.0.0

package/ts/mail/security/classes.dkimcreator.ts

@@ -1,19 +1,10 @@
 import * as plugins from '../../plugins.js';
-import * as paths from '../../paths.js';
-import { type IStorageManagerLike, hasStorageManagerMethods } from '../interfaces.storage.js';
+import type { IStorageManager } from '../interfaces.storage.js';
 
 import { Email } from '../core/classes.email.js';
-// MtaService reference removed
 
-const readFile = plugins.util.promisify(plugins.fs.readFile);
-const writeFile = plugins.util.promisify(plugins.fs.writeFile);
 const generateKeyPair = plugins.util.promisify(plugins.crypto.generateKeyPair);
 
-export interface IKeyPaths {
-  privateKeyPath: string;
-  publicKeyPath: string;
-}
-
 export interface IDkimKeyMetadata {
   domain: string;
   selector: string;
@@ -23,80 +14,60 @@ export interface IDkimKeyMetadata {
   keySize: number;
 }
 
+export type TDkimKeyType = 'rsa' | 'ed25519';
+
+export interface IDkimSigningMaterial {
+  privateKey: string;
+  publicKey: string;
+  keyType: TDkimKeyType;
+}
+
 export class DKIMCreator {
-  private keysDir: string;
-  private storageManager?: IStorageManagerLike;
+  constructor(private readonly storageManager: IStorageManager) {}
 
-  constructor(keysDir = paths.keysDir, storageManager?: IStorageManagerLike) {
-    this.keysDir = keysDir;
-    this.storageManager = storageManager;
+  private legacyKey(domain: string, filename: 'private.key' | 'public.key'): string {
+    return `/email/dkim/${domain}/${filename}`;
   }
 
-  private async writeKeyPairToFilesystem(
-    privateKeyPath: string,
-    publicKeyPath: string,
-    privateKey: string,
-    publicKey: string,
-  ): Promise<void> {
-    await Promise.all([writeFile(privateKeyPath, privateKey), writeFile(publicKeyPath, publicKey)]);
+  private selectorKey(
+    domain: string,
+    selector: string,
+    filename: 'private.key' | 'public.key',
+  ): string {
+    return selector === 'default'
+      ? this.legacyKey(domain, filename)
+      : `/email/dkim/${domain}/${selector}/${filename}`;
   }
 
-  private async storeLegacyKeysToStorage(domain: string, privateKey: string, publicKey: string): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['set'])) {
-      return;
-    }
-    await Promise.all([
-      this.storageManager.set(`/email/dkim/${domain}/private.key`, privateKey),
-      this.storageManager.set(`/email/dkim/${domain}/public.key`, publicKey),
-    ]);
+  private metadataKey(domain: string, selector: string): string {
+    return `/email/dkim/${domain}/${selector}/metadata`;
   }
 
-  private async storeSelectorKeysToStorage(
+  private async storeKeyPair(
     domain: string,
     selector: string,
     privateKey: string,
     publicKey: string,
   ): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['set'])) {
-      return;
-    }
     await Promise.all([
-      this.storageManager.set(`/email/dkim/${domain}/${selector}/private.key`, privateKey),
-      this.storageManager.set(`/email/dkim/${domain}/${selector}/public.key`, publicKey),
+      this.storageManager.set(this.selectorKey(domain, selector, 'private.key'), privateKey),
+      this.storageManager.set(this.selectorKey(domain, selector, 'public.key'), publicKey),
     ]);
   }
 
-  public async getKeyPathsForDomain(domainArg: string): Promise<IKeyPaths> {
-    return {
-      privateKeyPath: plugins.path.join(this.keysDir, `${domainArg}-private.pem`),
-      publicKeyPath: plugins.path.join(this.keysDir, `${domainArg}-public.pem`),
-    };
+  public async handleDKIMKeysForDomain(domain: string): Promise<void> {
+    await this.handleDKIMKeysForSelector(domain, 'default');
   }
 
-  // Check if a DKIM key is present and creates one and stores it to disk otherwise
-  public async handleDKIMKeysForDomain(domainArg: string): Promise<void> {
-    try {
-      await this.readDKIMKeys(domainArg);
-    } catch (error) {
-      console.log(`No DKIM keys found for ${domainArg}. Generating...`);
-      await this.createAndStoreDKIMKeys(domainArg);
-      const dnsValue = await this.getDNSRecordForDomain(domainArg);
-      await plugins.smartfs.directory(paths.dnsRecordsDir).recursive().create();
-      await plugins.smartfs.file(plugins.path.join(paths.dnsRecordsDir, `${domainArg}.dkimrecord.json`)).write(JSON.stringify(dnsValue, null, 2));
-    }
-  }
-
-  public async handleDKIMKeysForSelector(domainArg: string, selector: string = 'default', keySize: number = 2048): Promise<void> {
-    if (selector === 'default') {
-      await this.handleDKIMKeysForDomain(domainArg);
-      return;
-    }
-
+  public async handleDKIMKeysForSelector(
+    domain: string,
+    selector = 'default',
+    keySize = 2048,
+  ): Promise<void> {
     try {
-      await this.readDKIMKeysForSelector(domainArg, selector);
+      await this.readDKIMKeysForSelector(domain, selector);
     } catch {
-      console.log(`No DKIM keys found for ${domainArg}/${selector}. Generating...`);
-      await this.createAndStoreDKIMKeysForSelector(domainArg, selector, keySize);
+      await this.createAndStoreDKIMKeysForSelector(domain, selector, keySize);
     }
   }
 
@@ -105,367 +76,191 @@ export class DKIMCreator {
     await this.handleDKIMKeysForDomain(domain);
   }
 
-  // Read DKIM keys - always use storage manager, migrate from filesystem if needed
-  public async readDKIMKeys(domainArg: string): Promise<{ privateKey: string; publicKey: string }> {
-    // Try to read from storage manager first
-    if (hasStorageManagerMethods(this.storageManager, ['get', 'set'])) {
-      try {
-        const [privateKey, publicKey] = await Promise.all([
-          this.storageManager.get(`/email/dkim/${domainArg}/private.key`),
-          this.storageManager.get(`/email/dkim/${domainArg}/public.key`)
-        ]);
-        
-        if (privateKey && publicKey) {
-          return { privateKey, publicKey };
-        }
-      } catch (error) {
-        // Fall through to migration check
-      }
-      
-      // Check if keys exist in filesystem and migrate them to storage manager
-      const keyPaths = await this.getKeyPathsForDomain(domainArg);
-      try {
-        const [privateKeyBuffer, publicKeyBuffer] = await Promise.all([
-          readFile(keyPaths.privateKeyPath),
-          readFile(keyPaths.publicKeyPath),
-        ]);
-
-        // Convert the buffers to strings
-        const privateKey = privateKeyBuffer.toString();
-        const publicKey = publicKeyBuffer.toString();
-        
-        // Migrate to storage manager
-        console.log(`Migrating DKIM keys for ${domainArg} from filesystem to StorageManager`);
-        await this.storeLegacyKeysToStorage(domainArg, privateKey, publicKey);
-        
-        return { privateKey, publicKey };
-      } catch (error) {
-        if (error.code === 'ENOENT') {
-          // Keys don't exist anywhere
-          throw new Error(`DKIM keys not found for domain ${domainArg}`);
-        }
-        throw error;
-      }
-    } else {
-      // No storage manager, use filesystem directly
-      const keyPaths = await this.getKeyPathsForDomain(domainArg);
-      const [privateKeyBuffer, publicKeyBuffer] = await Promise.all([
-        readFile(keyPaths.privateKeyPath),
-        readFile(keyPaths.publicKeyPath),
-      ]);
+  public async readDKIMKeys(domain: string): Promise<{ privateKey: string; publicKey: string }> {
+    return this.readDKIMKeysForSelector(domain, 'default');
+  }
 
-      const privateKey = privateKeyBuffer.toString();
-      const publicKey = publicKeyBuffer.toString();
-      
-      return { privateKey, publicKey };
+  public async readDKIMKeysForSelector(
+    domain: string,
+    selector: string,
+  ): Promise<{ privateKey: string; publicKey: string }> {
+    const [privateKey, publicKey] = await Promise.all([
+      this.storageManager.get(this.selectorKey(domain, selector, 'private.key')),
+      this.storageManager.get(this.selectorKey(domain, selector, 'public.key')),
+    ]);
+    if (!privateKey || !publicKey) {
+      throw new Error(`DKIM keys not found for domain ${domain} with selector ${selector}`);
     }
+    return { privateKey, publicKey };
   }
 
-  // Create an RSA DKIM key pair - changed to public for API access
-  public async createDKIMKeys(keySize: number = 2048): Promise<{ privateKey: string; publicKey: string }> {
+  public async readValidatedDKIMKeysForSelector(
+    domain: string,
+    selector: string,
+  ): Promise<IDkimSigningMaterial> {
+    const keys = await this.readDKIMKeysForSelector(domain, selector);
+    let privateKeyObject: plugins.crypto.KeyObject;
+    let publicKeyObject: plugins.crypto.KeyObject;
+    try {
+      privateKeyObject = plugins.crypto.createPrivateKey(keys.privateKey);
+      publicKeyObject = plugins.crypto.createPublicKey(keys.publicKey);
+    } catch (error) {
+      throw new Error(
+        `Invalid DKIM key material for domain ${domain} with selector ${selector}: ${(error as Error).message}`,
+      );
+    }
+
+    const keyType = privateKeyObject.asymmetricKeyType;
+    if (keyType !== 'rsa' && keyType !== 'ed25519') {
+      throw new Error(
+        `Unsupported DKIM key type for domain ${domain} with selector ${selector}: ${keyType || 'unknown'}`,
+      );
+    }
+    if (publicKeyObject.asymmetricKeyType !== keyType) {
+      throw new Error(`DKIM public/private key type mismatch for domain ${domain} with selector ${selector}`);
+    }
+
+    const derivedPublicKey = plugins.crypto.createPublicKey(keys.privateKey).export({
+      type: 'spki',
+      format: 'der',
+    }) as Buffer;
+    const suppliedPublicKey = publicKeyObject.export({ type: 'spki', format: 'der' }) as Buffer;
+    if (!derivedPublicKey.equals(suppliedPublicKey)) {
+      throw new Error(`DKIM public/private key mismatch for domain ${domain} with selector ${selector}`);
+    }
+
+    return { ...keys, keyType };
+  }
+
+  public async createDKIMKeys(
+    keySize = 2048,
+  ): Promise<{ privateKey: string; publicKey: string }> {
     const { privateKey, publicKey } = await generateKeyPair('rsa', {
       modulusLength: keySize,
       publicKeyEncoding: { type: 'spki', format: 'pem' },
       privateKeyEncoding: { type: 'pkcs1', format: 'pem' },
     });
-
     return { privateKey, publicKey };
   }
 
-  // Create an Ed25519 DKIM key pair (RFC 8463)
   public async createEd25519Keys(): Promise<{ privateKey: string; publicKey: string }> {
     const { privateKey, publicKey } = await generateKeyPair('ed25519', {
       publicKeyEncoding: { type: 'spki', format: 'pem' },
       privateKeyEncoding: { type: 'pkcs8', format: 'pem' },
     });
-
     return { privateKey, publicKey };
   }
 
-  // Create a DKIM key pair and store it to disk - changed to public for API access
-  public async createAndStoreDKIMKeys(domain: string, keySize: number = 2048): Promise<void> {
-    const { privateKey, publicKey } = await this.createDKIMKeys(keySize);
-    const keyPaths = await this.getKeyPathsForDomain(domain);
-    await this.storeLegacyKeysToStorage(domain, privateKey, publicKey);
-    await this.writeKeyPairToFilesystem(keyPaths.privateKeyPath, keyPaths.publicKeyPath, privateKey, publicKey);
-    await this.saveKeyMetadata({
-      domain,
-      selector: 'default',
-      createdAt: Date.now(),
-      keySize,
-    });
-    console.log(`DKIM keys for ${domain} created and stored.`);
+  public async createAndStoreDKIMKeys(domain: string, keySize = 2048): Promise<void> {
+    await this.createAndStoreDKIMKeysForSelector(domain, 'default', keySize);
   }
 
   public async createAndStoreDKIMKeysForSelector(
     domain: string,
     selector: string,
-    keySize: number = 2048,
+    keySize = 2048,
   ): Promise<void> {
-    if (selector === 'default') {
-      await this.createAndStoreDKIMKeys(domain, keySize);
-      return;
-    }
-
     const { privateKey, publicKey } = await this.createDKIMKeys(keySize);
-    const keyPaths = await this.getKeyPathsForSelector(domain, selector);
-    await this.storeSelectorKeysToStorage(domain, selector, privateKey, publicKey);
-    await this.writeKeyPairToFilesystem(keyPaths.privateKeyPath, keyPaths.publicKeyPath, privateKey, publicKey);
+    await this.storeKeyPair(domain, selector, privateKey, publicKey);
     await this.saveKeyMetadata({
       domain,
       selector,
       createdAt: Date.now(),
       keySize,
     });
-    console.log(`DKIM keys for ${domain}/${selector} created and stored.`);
   }
 
-  // Changed to public for API access
   public async getDNSRecordForDomain(
-    domainArg: string,
-    selector: string = 'default',
+    domain: string,
+    selector = 'default',
   ): Promise<plugins.tsclass.network.IDnsRecord> {
-    await this.handleDKIMKeysForSelector(domainArg, selector);
-    return this.getDNSRecordForSelector(domainArg, selector);
+    await this.handleDKIMKeysForSelector(domain, selector);
+    return this.getDNSRecordForSelector(domain, selector);
   }
 
-  /**
-   * Get DKIM key metadata for a domain
-   */
-  private async getKeyMetadata(domain: string, selector: string = 'default'): Promise<IDkimKeyMetadata | null> {
-    if (!hasStorageManagerMethods(this.storageManager, ['get'])) {
-      return null;
-    }
-    
-    const metadataKey = `/email/dkim/${domain}/${selector}/metadata`;
-    const metadataStr = await this.storageManager.get(metadataKey);
-    
-    if (!metadataStr) {
-      return null;
-    }
-    
-    return JSON.parse(metadataStr) as IDkimKeyMetadata;
+  private async getKeyMetadata(
+    domain: string,
+    selector = 'default',
+  ): Promise<IDkimKeyMetadata | null> {
+    const metadata = await this.storageManager.get(this.metadataKey(domain, selector));
+    return metadata ? JSON.parse(metadata) as IDkimKeyMetadata : null;
   }
 
-  /**
-   * Save DKIM key metadata
-   */
   private async saveKeyMetadata(metadata: IDkimKeyMetadata): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['set'])) {
-      return;
-    }
-    
-    const metadataKey = `/email/dkim/${metadata.domain}/${metadata.selector}/metadata`;
-    await this.storageManager.set(metadataKey, JSON.stringify(metadata));
+    await this.storageManager.set(
+      this.metadataKey(metadata.domain, metadata.selector),
+      JSON.stringify(metadata),
+    );
   }
 
-  /**
-   * Check if DKIM keys need rotation
-   */
-  public async needsRotation(domain: string, selector: string = 'default', rotationIntervalDays: number = 90): Promise<boolean> {
+  public async needsRotation(
+    domain: string,
+    selector = 'default',
+    rotationIntervalDays = 90,
+  ): Promise<boolean> {
     const metadata = await this.getKeyMetadata(domain, selector);
-    
-    if (!metadata) {
-      // No metadata means old keys, should rotate
-      return true;
-    }
-    
-    const now = Date.now();
-    const keyAgeMs = now - metadata.createdAt;
-    const keyAgeDays = keyAgeMs / (1000 * 60 * 60 * 24);
-    
-    return keyAgeDays >= rotationIntervalDays;
+    if (!metadata) return true;
+    return (Date.now() - metadata.createdAt) / (1000 * 60 * 60 * 24) >= rotationIntervalDays;
   }
 
-  /**
-   * Rotate DKIM keys for a domain
-   */
-  public async rotateDkimKeys(domain: string, currentSelector: string = 'default', keySize: number = 2048): Promise<string> {
-    console.log(`Rotating DKIM keys for ${domain}...`);
-    
-    // Generate new selector based on date
+  public async rotateDkimKeys(
+    domain: string,
+    currentSelector = 'default',
+    keySize = 2048,
+  ): Promise<string> {
     const now = new Date();
     const newSelector = `key${now.getFullYear()}${String(now.getMonth() + 1).padStart(2, '0')}`;
-    
-    // Create new keys with custom key size
     const { privateKey, publicKey } = await this.createDKIMKeys(keySize);
-    
-    // Store new keys with new selector
-    const newKeyPaths = await this.getKeyPathsForSelector(domain, newSelector);
-    
-    // Store in storage manager if available
-    await this.storeSelectorKeysToStorage(domain, newSelector, privateKey, publicKey);
-    
-    // Also store to filesystem
-    await this.writeKeyPairToFilesystem(newKeyPaths.privateKeyPath, newKeyPaths.publicKeyPath, privateKey, publicKey);
-    
-    // Save metadata for new keys
-    const metadata: IDkimKeyMetadata = {
+    await this.storeKeyPair(domain, newSelector, privateKey, publicKey);
+    await this.saveKeyMetadata({
       domain,
       selector: newSelector,
       createdAt: Date.now(),
       previousSelector: currentSelector,
-      keySize
-    };
-    await this.saveKeyMetadata(metadata);
-    
-    // Update metadata for old keys
+      keySize,
+    });
+
     const oldMetadata = await this.getKeyMetadata(domain, currentSelector);
     if (oldMetadata) {
       oldMetadata.rotatedAt = Date.now();
       await this.saveKeyMetadata(oldMetadata);
     }
-    
-    console.log(`DKIM keys rotated for ${domain}. New selector: ${newSelector}`);
     return newSelector;
   }
 
-  /**
-   * Get key paths for a specific selector
-   */
-  public async getKeyPathsForSelector(domain: string, selector: string): Promise<IKeyPaths> {
-    return {
-      privateKeyPath: plugins.path.join(this.keysDir, `${domain}-${selector}-private.pem`),
-      publicKeyPath: plugins.path.join(this.keysDir, `${domain}-${selector}-public.pem`),
-    };
-  }
-
-  /**
-   * Read DKIM keys for a specific selector
-   */
-  public async readDKIMKeysForSelector(domain: string, selector: string): Promise<{ privateKey: string; publicKey: string }> {
-    // Try to read from storage manager first
-    if (hasStorageManagerMethods(this.storageManager, ['get', 'set'])) {
-      try {
-        const [privateKey, publicKey] = await Promise.all([
-          this.storageManager.get(`/email/dkim/${domain}/${selector}/private.key`),
-          this.storageManager.get(`/email/dkim/${domain}/${selector}/public.key`)
-        ]);
-        
-        if (privateKey && publicKey) {
-          return { privateKey, publicKey };
-        }
-
-        if (selector === 'default') {
-          return await this.readDKIMKeys(domain);
-        }
-      } catch (error) {
-        // Fall through to migration check
-      }
-      
-      // Check if keys exist in filesystem and migrate them to storage manager
-      const keyPaths = await this.getKeyPathsForSelector(domain, selector);
-      try {
-        const [privateKeyBuffer, publicKeyBuffer] = await Promise.all([
-          readFile(keyPaths.privateKeyPath),
-          readFile(keyPaths.publicKeyPath),
-        ]);
-
-        const privateKey = privateKeyBuffer.toString();
-        const publicKey = publicKeyBuffer.toString();
-        
-        // Migrate to storage manager
-        console.log(`Migrating DKIM keys for ${domain}/${selector} from filesystem to StorageManager`);
-        await this.storeSelectorKeysToStorage(domain, selector, privateKey, publicKey);
-        
-        return { privateKey, publicKey };
-      } catch (error) {
-        if (error.code === 'ENOENT') {
-          throw new Error(`DKIM keys not found for domain ${domain} with selector ${selector}`);
-        }
-        throw error;
-      }
-    } else {
-      // No storage manager, use filesystem directly
-      if (selector === 'default') {
-        return this.readDKIMKeys(domain);
-      }
-      const keyPaths = await this.getKeyPathsForSelector(domain, selector);
-      const [privateKeyBuffer, publicKeyBuffer] = await Promise.all([
-        readFile(keyPaths.privateKeyPath),
-        readFile(keyPaths.publicKeyPath),
-      ]);
-
-      const privateKey = privateKeyBuffer.toString();
-      const publicKey = publicKeyBuffer.toString();
-
-      return { privateKey, publicKey };
-    }
-  }
-
-  /**
-   * Get DNS record for a specific selector
-   */
-  public async getDNSRecordForSelector(domain: string, selector: string): Promise<plugins.tsclass.network.IDnsRecord> {
-    const keys = await this.readDKIMKeysForSelector(domain, selector);
-
-    // Remove the PEM header and footer and newlines
-    const pemHeader = '-----BEGIN PUBLIC KEY-----';
-    const pemFooter = '-----END PUBLIC KEY-----';
-    const keyContents = keys.publicKey
-      .replace(pemHeader, '')
-      .replace(pemFooter, '')
-      .replace(/\n/g, '');
-
-    // Detect key type from PEM header
-    const keyAlgo = keys.privateKey.includes('ED25519') || keys.publicKey.length < 200 ? 'ed25519' : 'rsa';
-
-    // Generate the DKIM DNS TXT record
-    const dnsRecordValue = `v=DKIM1; h=sha256; k=${keyAlgo}; p=${keyContents}`;
+  public async getDNSRecordForSelector(
+    domain: string,
+    selector: string,
+  ): Promise<plugins.tsclass.network.IDnsRecord> {
+    const material = await this.readValidatedDKIMKeysForSelector(domain, selector);
+    const keyContents = material.publicKey
+      .replace('-----BEGIN PUBLIC KEY-----', '')
+      .replace('-----END PUBLIC KEY-----', '')
+      .replace(/\s/g, '');
 
     return {
       name: `${selector}._domainkey.${domain}`,
       type: 'TXT',
-      dnsSecEnabled: null,
-      value: dnsRecordValue,
+      dnsSecEnabled: false,
+      value: `v=DKIM1; h=sha256; k=${material.keyType}; p=${keyContents}`,
     };
   }
 
-  /**
-   * Clean up old DKIM keys after grace period
-   */
-  public async cleanupOldKeys(domain: string, gracePeriodDays: number = 30): Promise<void> {
-    if (!hasStorageManagerMethods(this.storageManager, ['get', 'list', 'delete'])) {
-      console.log(`StorageManager for ${domain} does not support list/delete. Skipping DKIM cleanup.`);
-      return;
-    }
-    
-    // List all selectors for the domain
-    const metadataKeys = await this.storageManager.list(`/email/dkim/${domain}/`);
-    
-    for (const key of metadataKeys) {
-      if (key.endsWith('/metadata')) {
-        const metadataStr = await this.storageManager.get(key);
-        if (metadataStr) {
-          const metadata = JSON.parse(metadataStr) as IDkimKeyMetadata;
-          
-          // Check if key is rotated and past grace period
-          if (metadata.rotatedAt) {
-            const gracePeriodMs = gracePeriodDays * 24 * 60 * 60 * 1000;
-            const now = Date.now();
-            
-            if (now - metadata.rotatedAt > gracePeriodMs) {
-              console.log(`Cleaning up old DKIM keys for ${domain} selector ${metadata.selector}`);
-              
-              // Delete key files
-              const keyPaths = await this.getKeyPathsForSelector(domain, metadata.selector);
-              try {
-                await plugins.fs.promises.unlink(keyPaths.privateKeyPath);
-                await plugins.fs.promises.unlink(keyPaths.publicKeyPath);
-              } catch (error) {
-                console.warn(`Failed to delete old key files: ${error.message}`);
-              }
-              
-              // Delete selector-specific storage keys and metadata
-              await Promise.all([
-                this.storageManager.delete(`/email/dkim/${domain}/${metadata.selector}/private.key`),
-                this.storageManager.delete(`/email/dkim/${domain}/${metadata.selector}/public.key`),
-              ]);
-              await this.storageManager.delete(key);
-            }
-          }
-        }
-      }
+  public async cleanupOldKeys(domain: string, gracePeriodDays = 30): Promise<void> {
+    const cutoff = Date.now() - gracePeriodDays * 24 * 60 * 60 * 1000;
+    const keys = await this.storageManager.list(`/email/dkim/${domain}/`);
+    const metadataKeys = keys.filter((key) => key.endsWith('/metadata'));
+
+    for (const metadataKey of metadataKeys) {
+      const serialized = await this.storageManager.get(metadataKey);
+      if (!serialized) continue;
+      const metadata = JSON.parse(serialized) as IDkimKeyMetadata;
+      if (!metadata.rotatedAt || metadata.rotatedAt >= cutoff) continue;
+      await Promise.all([
+        this.storageManager.delete(this.selectorKey(domain, metadata.selector, 'private.key')),
+        this.storageManager.delete(this.selectorKey(domain, metadata.selector, 'public.key')),
+        this.storageManager.delete(metadataKey),
+      ]);
     }
   }
 }

package/ts/mail/security/classes.spfverifier.ts

@@ -1,4 +1,5 @@
 import { logger } from '../../logger.js';
+import { getErrorMessage } from '../../functions.errors.js';
 
 /**
  * SPF result qualifiers
@@ -116,9 +117,10 @@ export class SpfVerifier {
 
       return spfRecord;
     } catch (error) {
-      logger.log('error', `Error parsing SPF record: ${error.message}`, {
+      const errorMessage = getErrorMessage(error);
+      logger.log('error', `Error parsing SPF record: ${errorMessage}`, {
         record,
-        error: error.message
+        error: errorMessage
       });
       return null;
     }