@slicedearth/whoisleuth-cli 1.32.0

package/lib/dns-mx.mjs

@@ -0,0 +1,24 @@
+// Pure MX classification shared by deep DNS intelligence and the owned-domain
+// posture audit.
+// Keeping the null-MX rule pure lets it be tested against synthetic record
+// arrays without touching the network or mocking DNS.
+//
+// RFC 7505 "null MX" - a single record pointing at the root domain (".") is
+// a domain explicitly declaring it accepts no mail, not "mail is
+// configured". Node's resolver strips the trailing dot from the target, so
+// the root comes back as "" as well as ".".
+function classifyMxRecords(records) {
+    const realRecords = records.filter((record) => record.exchange !== '.' && record.exchange !== '');
+    // Distinct from simply having no MX record at all - a null MX is a
+    // deliberate "this domain never accepts mail" declaration, not an absence
+    // of configuration. Not currently used for scoring (both cases already
+    // correctly score as hasMx: false); exposed for callers that want to tell
+    // the two apart.
+    const hasNullMx = records.length > 0 && realRecords.length === 0;
+    return {
+        hasMx: realRecords.length > 0,
+        hasNullMx,
+        mxHosts: realRecords.map((record) => record.exchange),
+    };
+}
+export { classifyMxRecords };

package/lib/dns-resolver-selection.mjs

@@ -0,0 +1,33 @@
+import { Resolver } from 'node:dns/promises';
+import { isIP } from 'node:net';
+const MAX_SELECTED_DNS_RESOLVERS = 3;
+const MAX_SELECTED_DNS_RESOLVER_TEXT = 256;
+function normalizeSelectedDnsResolvers(value) {
+    if (typeof value !== 'string' || !value.trim() || value.length > MAX_SELECTED_DNS_RESOLVER_TEXT) {
+        throw new TypeError(`DNS resolver selection must contain at most ${MAX_SELECTED_DNS_RESOLVER_TEXT} characters.`);
+    }
+    const values = [...new Set(value.split(',').map((item) => item.trim()).filter(Boolean))];
+    if (!values.length || values.length > MAX_SELECTED_DNS_RESOLVERS || values.some((item) => isIP(item) === 0)) {
+        throw new TypeError(`DNS resolver selection requires 1 to ${MAX_SELECTED_DNS_RESOLVERS} literal IPv4 or IPv6 addresses.`);
+    }
+    return values;
+}
+function createSelectedDnsResolvers(servers) {
+    if (!Array.isArray(servers) || !servers.length || servers.length > MAX_SELECTED_DNS_RESOLVERS
+        || servers.some((item) => typeof item !== 'string' || isIP(item) === 0)) {
+        throw new TypeError('Validated DNS resolver addresses are required.');
+    }
+    const resolver = new Resolver();
+    resolver.setServers([...servers]);
+    return Object.freeze({
+        resolve4: (value) => resolver.resolve4(value),
+        resolve6: (value) => resolver.resolve6(value),
+        resolveCname: (value) => resolver.resolveCname(value),
+        resolveNs: (value) => resolver.resolveNs(value),
+        resolveMx: (value) => resolver.resolveMx(value),
+        resolveTxt: (value) => resolver.resolveTxt(value),
+        resolveCaa: (value) => resolver.resolveCaa(value),
+        resolveSoa: (value) => resolver.resolveSoa(value),
+    });
+}
+export { MAX_SELECTED_DNS_RESOLVERS, MAX_SELECTED_DNS_RESOLVER_TEXT, createSelectedDnsResolvers, normalizeSelectedDnsResolvers, };

package/lib/domain-posture-analysis.mjs

@@ -0,0 +1,254 @@
+// Bounded analysis for owned-domain posture evidence. Network access is
+// injected so every traversal can be fixture-tested and the caller retains the
+// existing DNS timeout and missing/error semantics.
+import { parse as parseDomain } from 'tldts';
+import { parseDmarcRecords, parseSpfRecords } from "./domain-posture-parsers.mjs";
+const SPF_LOOKUP_LIMIT = 10;
+const SPF_VOID_LOOKUP_LIMIT = 2;
+const SPF_MAX_DEPTH = 5;
+const SPF_MAX_BRANCHES = 32;
+const MAX_DMARC_DESTINATIONS = 10;
+const MAX_DEPENDENCIES = 64;
+function strictHostname(value) {
+    const raw = String(value || '').trim().toLowerCase().replace(/\.+$/u, '');
+    if (!raw || raw.length > 253 || raw.includes('%'))
+        return null;
+    if (!raw.split('.').every((label) => /^(?:_?[a-z0-9](?:[a-z0-9_-]{0,61}[a-z0-9])?)$/iu.test(label)))
+        return null;
+    return raw.includes('.') ? raw : null;
+}
+function branchFor(item, state, terminalPolicy, dnsLookupTerms, issues) {
+    return {
+        domain: item.domain,
+        parent: item.parent,
+        relation: item.relation,
+        depth: item.depth,
+        state,
+        terminalPolicy,
+        dnsLookupTerms,
+        issues: issues.slice(0, 12),
+    };
+}
+async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
+    const queue = [{
+            domain: rootDomain,
+            parent: null,
+            relation: 'root',
+            depth: 0,
+            path: [rootDomain],
+            records: rootQuery.records,
+            error: rootQuery.error,
+        }];
+    const branches = [];
+    const issues = [];
+    let lookupsUsed = 1;
+    let voidLookups = 0;
+    let dnsLookupTerms = 0;
+    let boundReached = false;
+    while (queue.length > 0 && branches.length < SPF_MAX_BRANCHES) {
+        const item = queue.shift();
+        if (!item)
+            break;
+        if (item.depth > SPF_MAX_DEPTH) {
+            boundReached = true;
+            branches.push(branchFor(item, 'limit', null, 0, [`Maximum SPF expansion depth ${SPF_MAX_DEPTH} was reached.`]));
+            continue;
+        }
+        if (item.path.slice(0, -1).includes(item.domain)) {
+            branches.push(branchFor(item, 'cycle', null, 0, ['The include or redirect chain contains a cycle.']));
+            continue;
+        }
+        let query;
+        if (item.records !== undefined) {
+            query = { records: item.records, error: item.error || null };
+        }
+        else if (lookupsUsed >= SPF_LOOKUP_LIMIT) {
+            boundReached = true;
+            branches.push(branchFor(item, 'limit', null, 0, [`Maximum SPF policy-query budget ${SPF_LOOKUP_LIMIT} was reached.`]));
+            continue;
+        }
+        else {
+            lookupsUsed += 1;
+            query = await resolveTxt(item.domain);
+        }
+        if (query.error) {
+            branches.push(branchFor(item, 'unavailable', null, 0, [query.error]));
+            continue;
+        }
+        if (query.records.length === 0) {
+            voidLookups += 1;
+            branches.push(branchFor(item, 'not_found', null, 0, ['No SPF policy record was returned for this branch.']));
+            if (voidLookups > SPF_VOID_LOOKUP_LIMIT) {
+                boundReached = true;
+                issues.push(`The SPF expansion exceeded the ${SPF_VOID_LOOKUP_LIMIT}-answer void-lookup budget.`);
+            }
+            continue;
+        }
+        const parsed = parseSpfRecords(query.records);
+        dnsLookupTerms += parsed.dnsLookupTerms;
+        branches.push(branchFor(item, parsed.valid ? 'success' : 'invalid', parsed.terminalPolicy, parsed.dnsLookupTerms, parsed.issues));
+        if (!parsed.valid)
+            continue;
+        if (dnsLookupTerms > SPF_LOOKUP_LIMIT) {
+            boundReached = true;
+            issues.push(`The expanded policy declares more than ${SPF_LOOKUP_LIMIT} DNS-querying terms.`);
+            continue;
+        }
+        if (voidLookups > SPF_VOID_LOOKUP_LIMIT)
+            continue;
+        const dependencies = [
+            ...parsed.includes.map((domain) => ({ relation: 'include', domain })),
+            ...(parsed.redirect ? [{ relation: 'redirect', domain: parsed.redirect }] : []),
+        ];
+        for (const dependency of dependencies) {
+            const normalized = strictHostname(dependency.domain);
+            if (!normalized) {
+                branches.push(branchFor({
+                    domain: String(dependency.domain || '').slice(0, 253),
+                    parent: item.domain,
+                    relation: dependency.relation,
+                    depth: item.depth + 1,
+                    path: item.path,
+                }, 'invalid', null, 0, ['The SPF dependency is not a literal public hostname; macros are not expanded by this audit.']));
+                continue;
+            }
+            queue.push({
+                domain: normalized,
+                parent: item.domain,
+                relation: dependency.relation,
+                depth: item.depth + 1,
+                path: [...item.path, normalized],
+            });
+        }
+    }
+    if (queue.length > 0 || branches.length >= SPF_MAX_BRANCHES) {
+        boundReached = true;
+        issues.push(`The SPF branch inventory was capped at ${SPF_MAX_BRANCHES} entries.`);
+    }
+    const root = branches[0];
+    const incomplete = boundReached || branches.some((branch) => !['success'].includes(branch.state));
+    const state = root?.state === 'unavailable'
+        ? 'unavailable'
+        : root?.state === 'invalid'
+            ? 'invalid'
+            : incomplete
+                ? 'partial'
+                : 'complete';
+    return {
+        version: 1,
+        state,
+        lookupLimit: SPF_LOOKUP_LIMIT,
+        lookupsUsed,
+        voidLookupLimit: SPF_VOID_LOOKUP_LIMIT,
+        voidLookups,
+        maxDepth: SPF_MAX_DEPTH,
+        dnsLookupTerms,
+        branches,
+        issues: [...new Set(issues)].slice(0, 12),
+    };
+}
+function reportDestinationDomain(value) {
+    const raw = String(value || '').trim();
+    if (!/^mailto:/iu.test(raw))
+        return null;
+    const address = raw.slice(7).split('!')[0] || '';
+    const at = address.lastIndexOf('@');
+    return at > 0 ? strictHostname(address.slice(at + 1)) : null;
+}
+async function validateDmarcExternalReporting(ownerDomain, dmarcQuery, resolveTxt) {
+    if (dmarcQuery.error)
+        return [];
+    const parsed = parseDmarcRecords(dmarcQuery.records);
+    if (!parsed.valid)
+        return [];
+    const destinations = [
+        ...parsed.aggregateDestinations.map((destination) => ({ destination, reportType: 'aggregate' })),
+        ...parsed.failureDestinations.map((destination) => ({ destination, reportType: 'failure' })),
+    ].slice(0, MAX_DMARC_DESTINATIONS);
+    const results = [];
+    const cache = new Map();
+    for (const item of destinations) {
+        const destinationDomain = reportDestinationDomain(item.destination);
+        if (!destinationDomain) {
+            results.push({
+                destination: item.destination.slice(0, 512),
+                reportType: item.reportType,
+                recordName: null,
+                state: 'invalid_destination',
+                error: null,
+            });
+            continue;
+        }
+        if (destinationDomain === ownerDomain || destinationDomain.endsWith(`.${ownerDomain}`)) {
+            results.push({
+                destination: destinationDomain,
+                reportType: item.reportType,
+                recordName: null,
+                state: 'self',
+                error: null,
+            });
+            continue;
+        }
+        const recordName = `${ownerDomain}._report._dmarc.${destinationDomain}`;
+        let query = cache.get(recordName);
+        if (!query) {
+            query = await resolveTxt(recordName);
+            cache.set(recordName, query);
+        }
+        const authorized = query.records.some((record) => (String(Array.isArray(record) ? record.join('') : record || '').trim().toUpperCase().startsWith('V=DMARC1')));
+        results.push({
+            destination: destinationDomain,
+            reportType: item.reportType,
+            recordName,
+            state: query.error ? 'unavailable' : authorized ? 'authorized' : 'not_found',
+            error: query.error,
+        });
+    }
+    return results;
+}
+function dependencyScope(ownerDomain, target) {
+    const owner = parseDomain(ownerDomain).domain;
+    const dependency = parseDomain(target).domain;
+    if (!owner || !dependency)
+        return 'unknown';
+    return owner === dependency ? 'same_registrable_domain' : 'external';
+}
+function buildExternalDependencies({ domain, nameservers, mx, spfExpansion, dmarcAuthorizations, }) {
+    const output = [];
+    const seen = new Set();
+    const add = (kind, targetValue, source, state) => {
+        const target = strictHostname(targetValue);
+        if (!target)
+            return;
+        const key = `${kind}:${target}`;
+        if (seen.has(key) || output.length >= MAX_DEPENDENCIES)
+            return;
+        seen.add(key);
+        output.push({
+            kind,
+            target,
+            source,
+            scope: dependencyScope(domain, target),
+            state,
+            limitation: 'A shared or external dependency is an operational review lead, not evidence of common ownership, insecurity, exploitability, or availability.',
+        });
+    };
+    for (const nameserver of nameservers.records)
+        add('nameserver', nameserver, 'DNS NS', nameservers.error ? 'unavailable' : 'observed');
+    for (const record of mx.records) {
+        const exchange = record && typeof record === 'object' && !Array.isArray(record)
+            ? record.exchange
+            : null;
+        add('mail_exchange', exchange, 'DNS MX', mx.error ? 'unavailable' : 'observed');
+    }
+    for (const branch of spfExpansion.branches) {
+        if (branch.relation === 'root')
+            continue;
+        add(branch.relation === 'include' ? 'spf_include' : 'spf_redirect', branch.domain, `SPF ${branch.relation}`, branch.state === 'success' ? 'observed' : 'unavailable');
+    }
+    for (const authorization of dmarcAuthorizations) {
+        add('dmarc_reporting', authorization.destination, `DMARC ${authorization.reportType} reporting`, ['authorized', 'self'].includes(authorization.state) ? 'observed' : 'unavailable');
+    }
+    return output;
+}
+export { SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };

package/lib/domain-posture-parsers.mjs

@@ -0,0 +1,358 @@
+// Pure parsers for the DNS policies used by the owned-domain posture audit.
+// Kept separate from DNS/network I/O so policy edge cases can be tested with
+// synthetic records and the Express/Netlify paths share identical behavior.
+import { createPublicKey } from 'node:crypto';
+function joinTxtRecords(records) {
+    if (!Array.isArray(records))
+        return [];
+    return records
+        .map((record) => Array.isArray(record) ? record.join('') : String(record || ''))
+        .map((record) => record.trim())
+        .filter(Boolean);
+}
+function parseTagList(record) {
+    const tags = {};
+    const duplicates = [];
+    const malformed = [];
+    for (const part of String(record || '').split(';')) {
+        const trimmed = part.trim();
+        if (!trimmed)
+            continue;
+        const equals = trimmed.indexOf('=');
+        if (equals <= 0) {
+            malformed.push(trimmed);
+            continue;
+        }
+        const key = trimmed.slice(0, equals).trim().toLowerCase();
+        const value = trimmed.slice(equals + 1).trim();
+        if (!/^[a-z][a-z0-9_.-]*$/i.test(key)) {
+            malformed.push(trimmed);
+            continue;
+        }
+        if (Object.prototype.hasOwnProperty.call(tags, key))
+            duplicates.push(key);
+        else
+            tags[key] = value;
+    }
+    return { tags, duplicates, malformed };
+}
+function parseSpfRecords(records) {
+    const allRecords = joinTxtRecords(records);
+    const spfRecords = allRecords.filter((record) => /^v=spf1(?:\s|$)/i.test(record));
+    const result = {
+        records: spfRecords,
+        valid: false,
+        record: spfRecords[0] || null,
+        terminalPolicy: null,
+        redirect: null,
+        includes: [],
+        dnsLookupTerms: 0,
+        issues: [],
+    };
+    if (spfRecords.length === 0) {
+        result.issues.push('No SPF record was found.');
+        return result;
+    }
+    if (spfRecords.length > 1) {
+        result.issues.push('Multiple SPF records produce a permanent SPF error.');
+        return result;
+    }
+    const record = spfRecords[0];
+    if (!record)
+        return result;
+    const terms = record.split(/\s+/).slice(1).filter(Boolean);
+    const allIndex = terms.findIndex((term) => /^[+?~-]?all$/i.test(term));
+    const allTerm = allIndex === -1 ? null : terms[allIndex];
+    const redirectTerm = terms.find((term) => /^redirect=/i.test(term));
+    const lookupTermRe = /^[+?~-]?(?:include:|a(?::|\/|$)|mx(?::|\/|$)|ptr(?::|$)|exists:)/i;
+    result.dnsLookupTerms = terms.filter((term) => lookupTermRe.test(term)).length + (redirectTerm ? 1 : 0);
+    result.redirect = redirectTerm ? redirectTerm.slice(redirectTerm.indexOf('=') + 1) : null;
+    result.includes = terms
+        .map((term) => term.match(/^[+?~-]?include:(.+)$/i)?.[1] || '')
+        .filter(Boolean);
+    if (terms.some((term) => /^[+?~-]?ptr(?::|$)/i.test(term))) {
+        result.issues.push('The deprecated ptr mechanism should not be used.');
+    }
+    if (result.dnsLookupTerms > 10) {
+        result.issues.push('The record has more than 10 top-level DNS-querying terms.');
+    }
+    if (allTerm) {
+        const qualifier = /^[?~-]/.test(allTerm) ? (allTerm[0] ?? '+') : '+';
+        result.terminalPolicy = { '-': 'fail', '~': 'softfail', '?': 'neutral', '+': 'pass' }[qualifier] || null;
+        if (allIndex !== terms.length - 1)
+            result.issues.push('Terms after the all mechanism are unreachable.');
+    }
+    else if (result.redirect) {
+        result.terminalPolicy = 'redirect';
+    }
+    else {
+        result.terminalPolicy = 'none';
+        result.issues.push('No all mechanism or redirect modifier defines a terminal policy.');
+    }
+    result.valid = true;
+    return result;
+}
+function parseDmarcRecords(records) {
+    const allRecords = joinTxtRecords(records);
+    const dmarcRecords = allRecords.filter((record) => /^v\s*=\s*dmarc1(?:\s*;|$)/i.test(record));
+    const result = {
+        records: dmarcRecords,
+        valid: false,
+        record: dmarcRecords[0] || null,
+        tags: {},
+        policy: null,
+        subdomainPolicy: null,
+        nonexistentSubdomainPolicy: null,
+        testMode: false,
+        enforced: false,
+        aggregateReporting: false,
+        failureReporting: false,
+        aggregateDestinations: [],
+        failureDestinations: [],
+        legacyPct: null,
+        issues: [],
+    };
+    if (dmarcRecords.length === 0) {
+        result.issues.push('No DMARC policy record was found.');
+        return result;
+    }
+    if (dmarcRecords.length > 1) {
+        result.issues.push('Multiple DMARC policy records make policy discovery fail.');
+        return result;
+    }
+    const parsed = parseTagList(dmarcRecords[0]);
+    result.tags = parsed.tags;
+    if (parsed.duplicates.length)
+        result.issues.push(`Duplicate DMARC tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
+    if (parsed.malformed.length)
+        result.issues.push(`Malformed DMARC field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
+    const allowedPolicies = new Set(['none', 'quarantine', 'reject']);
+    const policy = (parsed.tags.p || 'none').toLowerCase();
+    const subdomainPolicy = (parsed.tags.sp || policy).toLowerCase();
+    const nonexistentPolicy = (parsed.tags.np || parsed.tags.sp || policy).toLowerCase();
+    if (!allowedPolicies.has(policy))
+        result.issues.push(`Unsupported DMARC p value: ${parsed.tags.p}.`);
+    if (!allowedPolicies.has(subdomainPolicy))
+        result.issues.push(`Unsupported DMARC sp value: ${parsed.tags.sp}.`);
+    if (!allowedPolicies.has(nonexistentPolicy))
+        result.issues.push(`Unsupported DMARC np value: ${parsed.tags.np}.`);
+    if (parsed.tags.t && !/^[yn]$/i.test(parsed.tags.t))
+        result.issues.push(`Unsupported DMARC t value: ${parsed.tags.t}.`);
+    if (parsed.tags.pct !== undefined) {
+        const pct = Number(parsed.tags.pct);
+        result.legacyPct = Number.isInteger(pct) && pct >= 0 && pct <= 100 ? pct : null;
+        result.issues.push('The legacy pct tag is historic in the current DMARC specification.');
+    }
+    result.policy = allowedPolicies.has(policy) ? policy : null;
+    result.subdomainPolicy = allowedPolicies.has(subdomainPolicy) ? subdomainPolicy : null;
+    result.nonexistentSubdomainPolicy = allowedPolicies.has(nonexistentPolicy) ? nonexistentPolicy : null;
+    result.testMode = /^y$/i.test(parsed.tags.t || 'n');
+    result.enforced = Boolean(result.policy && result.policy !== 'none' && !result.testMode);
+    result.aggregateReporting = Boolean(parsed.tags.rua);
+    result.failureReporting = Boolean(parsed.tags.ruf);
+    result.aggregateDestinations = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
+    result.failureDestinations = (parsed.tags.ruf || '').split(',').map((value) => value.trim()).filter(Boolean);
+    result.valid = parsed.duplicates.length === 0
+        && parsed.malformed.length === 0
+        && Boolean(result.policy && result.subdomainPolicy && result.nonexistentSubdomainPolicy)
+        && (!parsed.tags.t || /^[yn]$/i.test(parsed.tags.t));
+    return result;
+}
+function parseMtaStsDnsRecords(records) {
+    const allRecords = joinTxtRecords(records);
+    const policyRecords = allRecords.filter((record) => /^v\s*=\s*stsv1(?:\s*;|$)/i.test(record));
+    const result = { records: policyRecords, valid: false, record: policyRecords[0] || null, id: null, issues: [] };
+    if (policyRecords.length === 0) {
+        result.issues.push('No MTA-STS DNS record was found.');
+        return result;
+    }
+    if (policyRecords.length > 1) {
+        result.issues.push('Multiple MTA-STS DNS records make the policy invalid.');
+        return result;
+    }
+    const parsed = parseTagList(policyRecords[0]);
+    result.id = parsed.tags.id || null;
+    if (!result.id)
+        result.issues.push('The MTA-STS DNS record has no policy id.');
+    if (parsed.duplicates.length)
+        result.issues.push(`Duplicate MTA-STS tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
+    if (parsed.malformed.length)
+        result.issues.push(`Malformed MTA-STS field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
+    result.valid = Boolean(result.id) && parsed.duplicates.length === 0 && parsed.malformed.length === 0;
+    return result;
+}
+function parseMtaStsPolicy(text) {
+    const fields = {};
+    const mx = [];
+    const duplicates = [];
+    const malformed = [];
+    for (const line of String(text || '').split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const colon = trimmed.indexOf(':');
+        if (colon <= 0) {
+            malformed.push(trimmed);
+            continue;
+        }
+        const key = trimmed.slice(0, colon).trim().toLowerCase();
+        const value = trimmed.slice(colon + 1).trim();
+        if (key === 'mx')
+            mx.push(value.toLowerCase().replace(/\.+$/, ''));
+        else if (Object.prototype.hasOwnProperty.call(fields, key))
+            duplicates.push(key);
+        else
+            fields[key] = value;
+    }
+    const mode = (fields.mode || '').toLowerCase();
+    const maxAge = /^\d+$/.test(fields.max_age || '') ? Number(fields.max_age) : null;
+    const issues = [];
+    if (fields.version !== 'STSv1')
+        issues.push('The policy version must be STSv1.');
+    if (!['enforce', 'testing', 'none'].includes(mode))
+        issues.push('The policy mode must be enforce, testing, or none.');
+    if (maxAge === null || !Number.isSafeInteger(maxAge))
+        issues.push('The policy max_age must be a non-negative integer.');
+    if (mode !== 'none' && mx.length === 0)
+        issues.push('An enforcing or testing policy needs at least one mx pattern.');
+    if (duplicates.length)
+        issues.push(`Duplicate MTA-STS policy field${duplicates.length === 1 ? '' : 's'}: ${duplicates.join(', ')}.`);
+    if (malformed.length)
+        issues.push(`Malformed MTA-STS policy line${malformed.length === 1 ? '' : 's'}: ${malformed.join(', ')}.`);
+    return {
+        valid: issues.length === 0,
+        version: fields.version || null,
+        mode: mode || null,
+        maxAge,
+        mx,
+        issues,
+    };
+}
+function parseTlsRptRecords(records) {
+    const allRecords = joinTxtRecords(records);
+    const policyRecords = allRecords.filter((record) => /^v\s*=\s*tlsrptv1(?:\s*;|$)/i.test(record));
+    const result = { records: policyRecords, valid: false, record: policyRecords[0] || null, rua: [], issues: [] };
+    if (policyRecords.length === 0) {
+        result.issues.push('No TLS-RPT policy record was found.');
+        return result;
+    }
+    if (policyRecords.length > 1) {
+        result.issues.push('Multiple TLS-RPT policy records make reporting invalid.');
+        return result;
+    }
+    const parsed = parseTagList(policyRecords[0]);
+    result.rua = (parsed.tags.rua || '').split(',').map((value) => value.trim()).filter(Boolean);
+    if (result.rua.length === 0)
+        result.issues.push('The TLS-RPT record has no aggregate report destination.');
+    if (parsed.duplicates.length)
+        result.issues.push(`Duplicate TLS-RPT tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
+    if (parsed.malformed.length)
+        result.issues.push(`Malformed TLS-RPT field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
+    result.valid = result.rua.length > 0 && parsed.duplicates.length === 0 && parsed.malformed.length === 0;
+    return result;
+}
+function parseBimiRecords(records) {
+    const allRecords = joinTxtRecords(records);
+    const bimiRecords = allRecords.filter((record) => /^v\s*=\s*bimi1(?:\s*;|$)/i.test(record));
+    const result = { records: bimiRecords, valid: false, record: bimiRecords[0] || null, logo: null, authority: null, issues: [] };
+    if (bimiRecords.length === 0) {
+        result.issues.push('No default-selector BIMI record was found.');
+        return result;
+    }
+    if (bimiRecords.length > 1) {
+        result.issues.push('Multiple BIMI records were found at the default selector.');
+        return result;
+    }
+    const parsed = parseTagList(bimiRecords[0]);
+    result.logo = parsed.tags.l || null;
+    result.authority = parsed.tags.a || null;
+    if (!result.logo)
+        result.issues.push('The BIMI record has no logo location.');
+    if (result.logo && !/^https:\/\//i.test(result.logo))
+        result.issues.push('The BIMI logo location must use HTTPS.');
+    if (result.authority && !/^https:\/\//i.test(result.authority))
+        result.issues.push('The BIMI authority evidence location must use HTTPS.');
+    if (parsed.duplicates.length)
+        result.issues.push(`Duplicate BIMI tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
+    if (parsed.malformed.length)
+        result.issues.push(`Malformed BIMI field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
+    result.valid = result.issues.length === 0;
+    return result;
+}
+function parseDkimRecords(selector, records) {
+    const allRecords = joinTxtRecords(records);
+    const result = {
+        selector,
+        records: allRecords,
+        valid: false,
+        keyType: null,
+        keyBits: null,
+        keyParseState: 'not_checked',
+        revoked: false,
+        testing: false,
+        issues: [],
+    };
+    if (allRecords.length === 0) {
+        result.issues.push(`No DKIM record was found for selector ${selector}.`);
+        return result;
+    }
+    if (allRecords.length > 1) {
+        result.issues.push(`Multiple TXT records were found for DKIM selector ${selector}.`);
+        return result;
+    }
+    const parsed = parseTagList(allRecords[0]);
+    const version = parsed.tags.v || 'DKIM1';
+    result.keyType = (parsed.tags.k || 'rsa').toLowerCase();
+    result.revoked = parsed.tags.p === '';
+    result.testing = (parsed.tags.t || '').split(':').includes('y');
+    if (version.toUpperCase() !== 'DKIM1')
+        result.issues.push(`Unsupported DKIM version: ${version}.`);
+    if (!Object.prototype.hasOwnProperty.call(parsed.tags, 'p'))
+        result.issues.push('The DKIM record has no public-key p tag.');
+    if (result.revoked)
+        result.issues.push('The DKIM key is revoked (empty p tag).');
+    if (!result.revoked
+        && Object.prototype.hasOwnProperty.call(parsed.tags, 'p')
+        && parsed.tags.p) {
+        const encodedKey = parsed.tags.p.replace(/\s+/g, '');
+        if (encodedKey.length > 16_384 || !/^[A-Za-z0-9+/]+={0,2}$/.test(encodedKey)) {
+            result.keyParseState = 'invalid';
+            result.issues.push('The DKIM public key is not bounded valid base64.');
+        }
+        else {
+            try {
+                const key = createPublicKey({
+                    key: Buffer.from(encodedKey, 'base64'),
+                    format: 'der',
+                    type: 'spki',
+                });
+                const actualType = key.asymmetricKeyType;
+                result.keyParseState = 'parsed';
+                if (actualType === 'rsa' || actualType === 'rsa-pss') {
+                    result.keyBits = key.asymmetricKeyDetails?.modulusLength || null;
+                }
+                else if (actualType === 'ed25519') {
+                    result.keyBits = 256;
+                }
+                if ((result.keyType === 'rsa' && actualType !== 'rsa' && actualType !== 'rsa-pss')
+                    || (result.keyType === 'ed25519' && actualType !== 'ed25519')) {
+                    result.issues.push(`The DKIM k tag declares ${result.keyType}, but the public key is ${actualType || 'an unsupported type'}.`);
+                }
+            }
+            catch {
+                result.keyParseState = 'invalid';
+                result.issues.push('The DKIM public key could not be parsed as SubjectPublicKeyInfo.');
+            }
+        }
+    }
+    if (!['rsa', 'ed25519'].includes(result.keyType || '')) {
+        result.issues.push(`Unsupported DKIM key algorithm: ${result.keyType}.`);
+    }
+    if (parsed.duplicates.length)
+        result.issues.push(`Duplicate DKIM tag${parsed.duplicates.length === 1 ? '' : 's'}: ${parsed.duplicates.join(', ')}.`);
+    if (parsed.malformed.length)
+        result.issues.push(`Malformed DKIM field${parsed.malformed.length === 1 ? '' : 's'}: ${parsed.malformed.join(', ')}.`);
+    result.valid = result.issues.length === 0;
+    return result;
+}
+export { joinTxtRecords, parseTagList, parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, };