@slicedearth/whoisleuth-cli 2.2.0 → 2.3.0

package/docs/cli.md

@@ -75,6 +75,7 @@ whoisleuth bulk domains.txt --csv
 whoisleuth discover example.test --preset common --jsonl
 whoisleuth verify-artifact lookup.json --json --strict-exit
 whoisleuth compare lookup.json --json
+whoisleuth mail-headers message.eml --json
 whoisleuth brief lookup.json
 ```
 
@@ -89,7 +90,7 @@ application:
 
 | Group | Common commands |
 | --- | --- |
-| Investigate | `lookup`, `bulk`, `discover`, `ct-search`, `posture`, `http`, `tls`, `compare`, `brief` |
+| Investigate | `lookup`, `bulk`, `discover`, `ct-search`, `posture`, `http`, `tls`, `compare`, `mail-headers`, `brief` |
 | Respond | `case-pack`, `change-packet`, `sharing-review`, `export` (local handoff from browser-created Cases) |
 | Assure | `dnssec-validate`, `mail-transport`, `domain-control`, `assurance`, `workflow-plan`, `diff`, `inspect-archive`, `verify-artifact` |
 | Utilities | `doctor`, `commands`, `completion`, `manual`, `registry-scaffold` |
@@ -122,6 +123,16 @@ their focused help. They do not use the hosted login or hosted usage controls.
 `lookup --plan` lists planned source families and disclosure targets before
 collection. `doctor` is offline unless `--network` is selected.
 
+### Message-header review
+
+`mail-headers` parses only the bounded header block from a selected message file
+or standard input. It extracts domain-only identity, reported SPF, DKIM, DMARC
+and ARC states, exact-domain alignment, and the bounded `Received` route in its
+reported order. It makes no request and does not retain address local parts,
+display names, subject, body, attachments, or raw header values in its output.
+Authentication states are header claims, not an independent DNS or
+cryptographic validation, and alignment differences can be legitimate.
+
 ## Output and automation
 
 Terminal text is the default. Commands expose JSON, JSONL, CSV, Markdown, HTML

package/lib/bounded-json.mjs

@@ -98,7 +98,7 @@ export function assertBoundedJsonStructure(value, label = 'JSON value', limits =
     };
     visit(value, 0);
 }
-export function scanBoundedJson(raw, limits = {}) {
+export function scanBoundedJson(raw, limits = {}, observeString) {
     const maximumDepth = limits.maximumDepth ?? MAX_BOUNDED_JSON_DEPTH;
     const maximumKeys = limits.maximumKeys ?? MAX_BOUNDED_JSON_KEYS;
     const maximumValues = limits.maximumValues ?? MAX_BOUNDED_JSON_VALUES;
@@ -118,7 +118,7 @@ export function scanBoundedJson(raw, limits = {}) {
             if (character === '"') {
                 index += 1;
                 try {
-                    return JSON.parse(raw.slice(start, index));
+                    return { value: JSON.parse(raw.slice(start, index)), offset: start };
                 }
                 catch {
                     syntaxError();
@@ -160,7 +160,7 @@ export function scanBoundedJson(raw, limits = {}) {
         }
         index += match[0].length;
     };
-    const value = (depth) => {
+    const value = (depth, propertyKey) => {
         values += 1;
         if (values > maximumValues) {
             throw new TypeError(`Artefact JSON exceeds the ${maximumValues}-value limit.`);
@@ -171,7 +171,8 @@ export function scanBoundedJson(raw, limits = {}) {
         whitespace();
         const character = raw[index];
         if (character === '"') {
-            stringToken();
+            const parsedString = stringToken();
+            observeString?.({ ...parsedString, kind: 'value', ...(propertyKey === undefined ? {} : { propertyKey }) });
             return;
         }
         if (character === '{') {
@@ -185,7 +186,8 @@ export function scanBoundedJson(raw, limits = {}) {
             while (index < raw.length) {
                 if (raw[index] !== '"')
                     syntaxError();
-                const key = stringToken();
+                const parsedKey = stringToken();
+                const key = parsedKey.value;
                 if (seen.size >= maximumContainerItems) {
                     throw new TypeError(`Artefact JSON contains a container with more than ${maximumContainerItems} items.`);
                 }
@@ -198,11 +200,12 @@ export function scanBoundedJson(raw, limits = {}) {
                 if (!isSafeJsonObjectKey(key))
                     throw new TypeError('Artefact JSON contains an unsafe object key.');
                 seen.add(key);
+                observeString?.({ ...parsedKey, kind: 'key' });
                 whitespace();
                 if (raw[index] !== ':')
                     syntaxError();
                 index += 1;
-                value(depth + 1);
+                value(depth + 1, key);
                 whitespace();
                 if (raw[index] === '}') {
                     index += 1;

package/lib/dns-convergence-review.mjs

@@ -160,6 +160,7 @@ export function reviewDnsConvergence(inputRaw, generatedAtValue = new Date().toI
         });
     });
     const reasons = Object.freeze([
+        ...(rows.length === 0 ? ['No comparable owner and record-type scope was supplied or observed.'] : []),
         ...rows.filter((row) => row.state !== 'converged').map((row) => `${row.owner} ${row.type} is ${row.state}.`),
         ...latestByObserver.filter((item) => item.state !== 'observed').map((item) => `${item.observer} latest evidence is ${item.state}.`),
     ].slice(0, 200));

package/lib/dns-intelligence.mjs

@@ -189,8 +189,13 @@ function normalizeCaa(records) {
     for (const record of Array.isArray(records) ? records : []) {
         const entry = record && typeof record === 'object' ? record : {};
         const critical = Number(entry.critical);
-        const tag = String(entry.tag || '').trim().toLowerCase();
-        const value = String(entry.value || '').trim();
+        const nodeTags = ['issue', 'issuewild', 'iodef'].filter((tag) => Object.hasOwn(entry, tag));
+        const hasPair = Object.hasOwn(entry, 'tag') || Object.hasOwn(entry, 'value');
+        const tag = hasPair
+            ? String(entry.tag || '').trim().toLowerCase()
+            : nodeTags.length === 1 ? nodeTags[0] : '';
+        const rawValue = hasPair ? entry.value : tag ? entry[tag] : undefined;
+        const value = typeof rawValue === 'string' ? rawValue.trim() : '';
         if (!Number.isInteger(critical) || critical < 0 || critical > 255 || !/^[a-z0-9-]{1,15}$/.test(tag) || !value || value.length > MAX_POLICY_LENGTH || /[\u0000-\u001f\u007f]/.test(value)) {
             discarded += 1;
             continue;
@@ -511,6 +516,35 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
                 records: result.records,
             };
         }
+        if (result.truncated || result.discarded > 0) {
+            return {
+                ...createObservation({
+                    status: 'partial',
+                    observedAt: (options.observedAt || (() => new Date().toISOString()))(),
+                    scanMode: 'deep',
+                    source: 'dns',
+                    durationMs: Math.max(0, now() - started),
+                    complete: false,
+                    truncated: result.truncated,
+                    limitations,
+                    diagnostics: {
+                        tree: {
+                            status: 'partial',
+                            detail: `The CAA answer at ${owner} contained discarded or truncated records, so parent inheritance was not evaluated.`,
+                            count: queries.length,
+                            truncated: result.truncated,
+                            discarded: result.discarded,
+                        },
+                    },
+                }),
+                policyVersion: 1,
+                queryLimit,
+                queriedOwners: queries,
+                effectiveOwner: null,
+                inherited: null,
+                records: [],
+            };
+        }
     }
     return {
         ...createObservation({
@@ -706,7 +740,7 @@ async function collectReverseDnsIntelligence(address, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const now = options.now || Date.now;
     const started = now();
-    const ptr = await query(() => (options.resolver || dns.resolvePtr)(address), normalizePtr, timeoutMs);
+    const ptr = await query(() => (options.resolver || dns.reverse)(address), normalizePtr, timeoutMs);
     const incomplete = ptr.status === 'error' || ptr.truncated || ptr.discarded > 0;
     return {
         ...createObservation({

package/lib/dnssec-chain-validation.mjs

@@ -718,6 +718,9 @@ function validateNegativeProof(response, name, missingType, keys, zone, now, req
         const verification = verifyRrset(response, exactNsec.owner, DNS_TYPE_NSEC, keys, zone, now);
         if (verification.state !== 'valid')
             return verification;
+        if (exactNsec.data.types.has(DNS_TYPE_CNAME)) {
+            return { state: 'unsupported', detail: 'The validated NSEC owner is an alias; the target RRset cannot be treated as authenticated absence without a validated alias walk.' };
+        }
         const delegation = exactNsec.data.types.has(DNS_TYPE_NS) && !exactNsec.data.types.has(DNS_TYPE_SOA);
         if (!exactNsec.data.types.has(missingType) && (!requireDelegation || delegation)) {
             return { state: 'valid', detail: 'A validated NSEC record proved the requested RRset absent.' };
@@ -758,6 +761,9 @@ function validateNegativeProof(response, name, missingType, keys, zone, now, req
                 sawBogus = true;
             continue;
         }
+        if (exact && record.data.types.has(DNS_TYPE_CNAME)) {
+            return { state: 'unsupported', detail: 'The validated NSEC3 owner is an alias; the target RRset cannot be treated as authenticated absence without a validated alias walk.' };
+        }
         if (exact && record.data.types.has(missingType))
             return { state: 'bogus', detail: 'The validated NSEC3 bitmap contains the RR type reported as absent.' };
         if (requireDelegation && exact && (!record.data.types.has(DNS_TYPE_NS) || record.data.types.has(DNS_TYPE_SOA)))

package/lib/domain-change-packet.mjs

@@ -38,23 +38,50 @@ function changeSummary(before, after) {
     const beforeRows = rows(before);
     const afterRows = rows(after);
     const keys = [...new Set([...beforeRows.keys(), ...afterRows.keys()])].sort();
-    return Object.freeze(keys.slice(0, 500).flatMap((key) => {
+    const authorityCollectionComplete = (review) => {
+        const representative = review.authoritativeRecordMatrix[0];
+        return Boolean(representative
+            && representative.observations.length >= 2
+            && representative.observations.every((item) => item.state === 'observed'));
+    };
+    const rowEvidence = (review, row) => {
+        if (!row)
+            return Object.freeze({
+                state: authorityCollectionComplete(review) ? 'complete' : 'unavailable',
+                values: Object.freeze([]),
+            });
+        if (row.observations.some((item) => item.state !== 'observed')) {
+            return Object.freeze({ state: 'partial', values: Object.freeze([]) });
+        }
+        if (row.state === 'different')
+            return Object.freeze({ state: 'inconsistent', values: Object.freeze([]) });
+        if (row.state !== 'aligned')
+            return Object.freeze({ state: 'insufficient', values: Object.freeze([]) });
+        return Object.freeze({
+            state: 'complete',
+            values: Object.freeze([...new Set(row.observations.flatMap((item) => item.values))].sort()),
+        });
+    };
+    const changed = [];
+    for (const key of keys.slice(0, 500)) {
         const left = beforeRows.get(key);
         const right = afterRows.get(key);
-        const leftValues = left?.observations.flatMap((item) => item.values) ?? [];
-        const rightValues = right?.observations.flatMap((item) => item.values) ?? [];
-        const beforeValues = [...new Set(leftValues)].sort();
-        const afterValues = [...new Set(rightValues)].sort();
-        if (JSON.stringify(beforeValues) === JSON.stringify(afterValues))
-            return [];
         const [owner, type] = key.split('\u0000');
-        return [Object.freeze({
-                owner: owner ?? '',
-                type: type ?? '',
-                beforeValues: Object.freeze(beforeValues),
-                afterValues: Object.freeze(afterValues),
-            })];
-    }));
+        const beforeEvidence = rowEvidence(before, left);
+        const afterEvidence = rowEvidence(after, right);
+        if (beforeEvidence.state !== 'complete' || afterEvidence.state !== 'complete') {
+            continue;
+        }
+        if (JSON.stringify(beforeEvidence.values) === JSON.stringify(afterEvidence.values))
+            continue;
+        changed.push(Object.freeze({
+            owner: owner ?? '',
+            type: type ?? '',
+            beforeValues: beforeEvidence.values,
+            afterValues: afterEvidence.values,
+        }));
+    }
+    return Object.freeze(changed);
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
@@ -99,6 +126,7 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         limitations: Object.freeze([
             'This packet is assembled only from analyst-supplied observations and planning metadata and makes no network request or configuration change.',
             'A ready result means the supplied bounded checks passed; it does not prove control, propagation completion, successful recovery, or absence of unobserved dependencies.',
+            'Authoritative record-set changes are reported only when both sides contain complete consistent observations; gate reasons describe incomplete comparisons.',
             'The integrity digest detects later changes to this packet but does not authenticate its author. Use a separately managed signing key when signer authentication is required.',
         ]),
     });

package/lib/domain-control-flight-recorder.mjs

@@ -267,8 +267,11 @@ function values(value, label) {
     const output = new Set();
     for (let index = 0; index < input.length; index += 1) {
         const normalized = text(input[index], `${label}[${index}]`, MAX_FLIGHT_RECORDER_VALUE_LENGTH).toLowerCase();
-        if (normalized && output.size < MAX_FLIGHT_RECORDER_VALUES)
+        if (normalized)
             output.add(normalized);
+        if (output.size > MAX_FLIGHT_RECORDER_VALUES) {
+            throw new TypeError(`${label} must contain at most ${MAX_FLIGHT_RECORDER_VALUES} unique normalized values.`);
+        }
     }
     return [...output].sort(ordinalCompare);
 }

package/lib/domain-control-manifest.mjs

@@ -115,15 +115,13 @@ function hostnameList(value) {
     return [...new Set(value
             .map(domain)
             .filter((item) => item !== null))]
-        .sort()
-        .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
+        .sort();
 }
 function textList(value, maximum = 300) {
     return [...new Set(value
             .map((item) => boundedText(item, maximum)?.toLowerCase() ?? null)
             .filter((item) => item !== null))]
-        .sort()
-        .slice(0, MAX_DOMAIN_CONTROL_RECORDS);
+        .sort();
 }
 function spkiFingerprint(value) {
     if (typeof value !== 'string'
@@ -191,21 +189,22 @@ function boundedDataArray(value, maximum) {
 function fieldValues(field, value) {
     if (field === 'nameservers') {
         const normalized = value.map(domain);
-        return normalized.some((item) => item === null)
-            ? null
-            : hostnameList(normalized);
+        if (normalized.some((item) => item === null))
+            return null;
+        const values = hostnameList(normalized);
+        return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
     }
     if (field === 'mx' || field === 'caa' || field === 'ds') {
         const normalized = value.flatMap((item) => canonicalDomainControlRecordList([item], field));
-        return normalized.length === value.length
-            ? [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS)
-            : null;
+        const values = [...new Set(normalized)].sort();
+        return normalized.length === value.length && values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
     }
     if (field === 'tlsSpkiSha256') {
         const normalized = value.map(spkiFingerprint);
-        return normalized.some((item) => item === null)
-            ? null
-            : [...new Set(normalized)].sort().slice(0, MAX_DOMAIN_CONTROL_RECORDS);
+        if (normalized.some((item) => item === null))
+            return null;
+        const values = [...new Set(normalized)].sort();
+        return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
     }
     if (field === 'registrarLock') {
         return value.every((item) => item === 'required' || item === 'not_required')
@@ -213,9 +212,10 @@ function fieldValues(field, value) {
             : null;
     }
     const normalized = value.map((item) => boundedText(item, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH)?.toLowerCase() ?? null);
-    return normalized.some((item) => item === null)
-        ? null
-        : textList(normalized, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH);
+    if (normalized.some((item) => item === null))
+        return null;
+    const values = textList(normalized, MAX_DOMAIN_CONTROL_REVIEW_TEXT_LENGTH);
+    return values.length <= MAX_DOMAIN_CONTROL_RECORDS ? values : null;
 }
 function normalizeObservation(value) {
     const source = record(value);

package/lib/domain-posture-parsers.mjs

@@ -2,6 +2,7 @@
 // Kept separate from DNS/network I/O so policy edge cases can be tested with
 // synthetic records and the Express/Netlify paths share identical behavior.
 import { createPublicKey } from 'node:crypto';
+import { isIP } from 'node:net';
 function joinTxtRecords(records) {
     if (!Array.isArray(records))
         return [];
@@ -46,6 +47,7 @@ function parseSpfRecords(records) {
         terminalPolicy: null,
         redirect: null,
         includes: [],
+        authorizingTerms: [],
         dnsLookupTerms: 0,
         issues: [],
     };
@@ -61,6 +63,107 @@ function parseSpfRecords(records) {
     if (!record)
         return result;
     const terms = record.split(/\s+/).slice(1).filter(Boolean);
+    let invalidSyntax = false;
+    const modifierNames = new Set();
+    const literalDomain = (value, label) => {
+        if (!value) {
+            result.issues.push(`${label} requires a domain-spec.`);
+            invalidSyntax = true;
+            return false;
+        }
+        if (value.includes('%')) {
+            result.issues.push(`${label} uses SPF macros that this bounded audit does not evaluate.`);
+            return true;
+        }
+        const hostname = value.toLowerCase().replace(/\.$/u, '');
+        if (hostname.length > 253 || !hostname.includes('.') || !hostname.split('.').every((part) => /^[a-z0-9_](?:[a-z0-9_-]{0,61}[a-z0-9_])?$/u.test(part))) {
+            result.issues.push(`${label} has an invalid literal domain-spec.`);
+            return false;
+        }
+        return true;
+    };
+    for (const term of terms) {
+        const qualifier = /^[+?~-]/u.test(term) ? term[0] : '+';
+        const body = qualifier === '+' && term[0] !== '+' ? term : term.slice(1);
+        const lower = body.toLowerCase();
+        const modifier = body.match(/^([a-z][a-z0-9_.-]*)=(.*)$/iu);
+        if (modifier) {
+            const name = modifier[1].toLowerCase();
+            const value = modifier[2];
+            if (modifierNames.has(name)) {
+                result.issues.push(`Duplicate SPF modifier: ${name}.`);
+                invalidSyntax = true;
+            }
+            modifierNames.add(name);
+            if (name === 'redirect') {
+                literalDomain(value, 'The redirect modifier');
+                if (qualifier !== '+') {
+                    result.issues.push('SPF modifiers cannot have a qualifier.');
+                    invalidSyntax = true;
+                }
+                result.authorizingTerms.push(term);
+            }
+            else if (name === 'exp') {
+                literalDomain(value, 'The exp modifier');
+            }
+            else {
+                result.issues.push(`The ${name} SPF modifier is not evaluated by this bounded audit.`);
+            }
+            continue;
+        }
+        if (lower === 'all')
+            continue;
+        const include = body.match(/^include:(.*)$/iu);
+        if (include) {
+            literalDomain(include[1], 'The include mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const exists = body.match(/^exists:(.*)$/iu);
+        if (exists) {
+            literalDomain(exists[1], 'The exists mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const ptr = body.match(/^ptr(?::(.*))?$/iu);
+        if (ptr) {
+            if (ptr[1] !== undefined)
+                literalDomain(ptr[1], 'The ptr mechanism');
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const address = body.match(/^(ip4|ip6):(.*)$/iu);
+        if (address) {
+            const family = address[1].toLowerCase() === 'ip4' ? 4 : 6;
+            const [literal, prefix, ...extra] = address[2].split('/');
+            const maximumPrefix = family === 4 ? 32 : 128;
+            if (extra.length || isIP(literal || '') !== family || (prefix !== undefined && (!/^\d+$/u.test(prefix) || Number(prefix) > maximumPrefix))) {
+                result.issues.push(`The ${address[1].toLowerCase()} mechanism has an invalid address or prefix length.`);
+                invalidSyntax = true;
+            }
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        const hostMechanism = body.match(/^(a|mx)(?::([^/]+))?(?:\/(\d+))?(?:\/\/(\d+))?$/iu);
+        if (hostMechanism) {
+            if (hostMechanism[2] !== undefined)
+                literalDomain(hostMechanism[2], `The ${hostMechanism[1].toLowerCase()} mechanism`);
+            if ((hostMechanism[3] !== undefined && Number(hostMechanism[3]) > 32)
+                || (hostMechanism[4] !== undefined && Number(hostMechanism[4]) > 128)) {
+                result.issues.push(`The ${hostMechanism[1].toLowerCase()} mechanism has an invalid prefix length.`);
+                invalidSyntax = true;
+            }
+            if (qualifier !== '-')
+                result.authorizingTerms.push(term);
+            continue;
+        }
+        result.issues.push(`Unsupported or malformed SPF term: ${term}.`);
+        invalidSyntax = true;
+    }
     const allIndex = terms.findIndex((term) => /^[+?~-]?all$/i.test(term));
     const allTerm = allIndex === -1 ? null : terms[allIndex];
     const redirectTerm = terms.find((term) => /^redirect=/i.test(term));
@@ -89,7 +192,7 @@ function parseSpfRecords(records) {
         result.terminalPolicy = 'none';
         result.issues.push('No all mechanism or redirect modifier defines a terminal policy.');
     }
-    result.valid = true;
+    result.valid = !invalidSyntax;
     return result;
 }
 function parseDmarcRecords(records) {
@@ -321,8 +424,14 @@ function parseDkimRecords(selector, records) {
         }
         else {
             try {
+                const decodedKey = Buffer.from(encodedKey, 'base64');
+                if (result.keyType === 'ed25519' && decodedKey.length !== 32) {
+                    throw new Error('Ed25519 DKIM keys use an exact 32-byte raw public key.');
+                }
                 const key = createPublicKey({
-                    key: Buffer.from(encodedKey, 'base64'),
+                    key: result.keyType === 'ed25519'
+                        ? Buffer.concat([Buffer.from('302a300506032b6570032100', 'hex'), decodedKey])
+                        : decodedKey,
                     format: 'der',
                     type: 'spki',
                 });
@@ -341,7 +450,9 @@ function parseDkimRecords(selector, records) {
             }
             catch {
                 result.keyParseState = 'invalid';
-                result.issues.push('The DKIM public key could not be parsed as SubjectPublicKeyInfo.');
+                result.issues.push(result.keyType === 'ed25519'
+                    ? 'The Ed25519 DKIM public key must be exactly 32 raw bytes.'
+                    : 'The DKIM public key could not be parsed as SubjectPublicKeyInfo.');
             }
         }
     }

package/lib/domain-posture.mjs

@@ -23,6 +23,22 @@ function errorRecord(value) {
 function asMxRecords(records) {
     return records;
 }
+function completeMxRecords(records) {
+    const normalized = [];
+    for (const raw of records) {
+        if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+            return null;
+        const value = raw;
+        const exchange = typeof value.exchange === 'string' ? value.exchange.trim().toLowerCase().replace(/\.+$/u, '') : null;
+        const priority = Number(value.priority);
+        if (exchange === null || !Number.isInteger(priority) || priority < 0 || priority > 65_535)
+            return null;
+        if (exchange && !normalizeAuditDomain(exchange))
+            return null;
+        normalized.push({ exchange, priority });
+    }
+    return normalized;
+}
 function trimTerminalDots(value) {
     let end = value.length;
     while (end > 0 && value.charCodeAt(end - 1) === 46)
@@ -356,7 +372,22 @@ function mtaStsCheck(dnsQuery, policyFetch, mxQuery) {
             remediation: 'Configure the policy host to return Content-Type: text/plain.',
         });
     }
-    const mxHosts = mxQuery.error ? [] : classifyMxRecords(asMxRecords(mxQuery.records)).mxHosts;
+    if (mxQuery.error) {
+        return check('mta_sts', 'MTA-STS', 'info', 'Policy is valid but MX coverage could not be evaluated', {
+            detail: mxQuery.error,
+            records,
+            remediation: 'Retry the MX lookup before concluding that the policy covers every current mail exchanger.',
+        });
+    }
+    const reviewedMx = completeMxRecords(mxQuery.records);
+    if (!reviewedMx) {
+        return check('mta_sts', 'MTA-STS', 'info', 'Policy is valid but MX coverage is incomplete', {
+            detail: 'One or more MX records were malformed or outside the bounded hostname and priority contract.',
+            records,
+            remediation: 'Retry and review the MX evidence before concluding that the policy covers every current mail exchanger.',
+        });
+    }
+    const mxHosts = classifyMxRecords(reviewedMx).mxHosts;
     const unmatched = mxHosts.filter((host) => !policy.mx.some((pattern) => matchesMtaPattern(host, pattern)));
     if (unmatched.length) {
         return check('mta_sts', 'MTA-STS', 'danger', 'Policy does not cover every published MX host', {
@@ -507,7 +538,7 @@ function defensiveMailProfileCheck(profile, input) {
     const mx = input.mx.error ? null : classifyMxRecords(asMxRecords(input.mx.records));
     const requirements = {
         nullMx: mx?.hasNullMx === true,
-        restrictiveSpf: spf?.valid === true && spf.terminalPolicy === 'fail' && spf.dnsLookupTerms === 0,
+        restrictiveSpf: spf?.valid === true && spf.terminalPolicy === 'fail' && spf.authorizingTerms.length === 0,
         rejectingDmarc: dmarc?.valid === true
             && dmarc.policy === 'reject'
             && dmarc.subdomainPolicy === 'reject'
@@ -620,7 +651,7 @@ async function fetchMtaStsPolicy(domain, fetcher = safeFetch) {
             signal: controller.signal,
             headers: whoisleuthRequestHeaders({ Accept: 'text/plain' }),
         }, 0);
-        if (!res.ok) {
+        if (res.status !== 200) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
             // undici's own idle-timeout eventually notices.