@slicedearth/whoisleuth-cli 2.2.0 → 2.4.0

package/lib/dns-delegation-health.mjs

@@ -1,10 +1,11 @@
 // Bounded delegation-health evidence for deep single-domain Lookup. Registry
-// publication, recursive parent-view answers, and direct nameserver queries
+// publication, recursive resolver answers, and direct nameserver queries
 // remain separately attributed. The result never participates in registration
 // availability and never treats a failed query as record absence.
 import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { createObservation } from "../packages/evidence/observation.mjs";
+import { normalizeResolverMxRecord } from "../packages/evidence/domain-control-runtime.mjs";
 import { isValidAsciiHostname } from "./hostname.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const DNS_DELEGATION_HEALTH_VERSION = 1;
@@ -148,10 +149,9 @@ function normaliseAuthorityValueSet(type, value) {
         }
         const source = record(item);
         if (type === 'MX') {
-            const exchange = hostname(source.exchange);
-            const priority = Number(source.priority);
-            if (exchange && Number.isSafeInteger(priority) && priority >= 0 && priority <= 65_535)
-                return [`${priority} ${exchange}`];
+            const mx = normalizeResolverMxRecord(item);
+            if (mx)
+                return [`${mx.priority} ${mx.exchange}`];
             rejected += 1;
             return [];
         }
@@ -291,6 +291,7 @@ function finding(id, label, state, summary, detail, remediation) {
 function skippedDnsDelegationHealth(detail = 'Authoritative delegation checks were not collected for this lookup.') {
     return {
         delegationHealthVersion: DNS_DELEGATION_HEALTH_VERSION,
+        domain: null,
         ...createObservation({
             status: 'skipped',
             scanMode: 'deep',
@@ -326,9 +327,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
         ? parentQuery.status
         : 'error';
     const parentNameservers = hostnames(parentQuery.records);
-    const candidates = [...new Set([...parentNameservers, ...registry.nameservers])]
-        .sort()
-        .slice(0, MAX_AUTHORITIES);
+    const eligibleAuthorities = [...new Set([...parentNameservers, ...registry.nameservers])].sort();
+    const candidates = eligibleAuthorities.slice(0, MAX_AUTHORITIES);
+    const omittedAuthorityCount = eligibleAuthorities.length - candidates.length;
     const resolve4 = options.resolve4 || dns.resolve4;
     const resolve6 = options.resolve6 || dns.resolve6;
     const queryAuthority = options.queryAuthority || defaultAuthorityQuery;
@@ -473,13 +474,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const recordPartial = recordMatrix.filter((row) => row.state === 'partial');
     const recordInsufficient = recordMatrix.filter((row) => row.state === 'insufficient');
     const findings = [
-        finding('parent_registry_ns', 'Parent and registry nameservers', !parentNameservers.length || !registry.nameservers.length
+        finding('parent_registry_ns', 'Recursive and registry nameservers', !parentNameservers.length || !registry.nameservers.length
             ? 'unknown'
             : sameSet(parentNameservers, registry.nameservers) ? 'healthy' : 'warning', !parentNameservers.length || !registry.nameservers.length
             ? 'Comparison is incomplete'
             : sameSet(parentNameservers, registry.nameservers)
-                ? 'Parent view and registry publication agree'
-                : 'Parent view and registry publication differ', `Parent view: ${parentNameservers.join(', ') || 'unavailable'}. Registry publication: ${registry.nameservers.join(', ') || 'unavailable'}.`, 'Confirm the intended delegation with the registry and DNS operator before changing nameservers.'),
+                ? 'Recursive observation and registry publication agree'
+                : 'Recursive observation and registry publication differ', `Recursive resolver: ${parentNameservers.join(', ') || 'unavailable'}. Registry publication: ${registry.nameservers.join(', ') || 'unavailable'}.`, 'Confirm the intended delegation with the registry and DNS operator before changing nameservers.'),
         finding('authority_reachability', 'Direct nameserver reachability', lameAuthorities.length ? 'danger'
             : partialAuthorities.length || unreachableAuthorities.length ? 'warning'
                 : successfulAuthorities.length ? 'healthy' : 'unknown', lameAuthorities.length
@@ -496,7 +497,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ? 'No direct authority answer was available'
             : inconsistentAuthoritySets
                 ? 'Direct nameserver answers are inconsistent'
-                : 'Direct nameserver answers agree with the observed parent view', successfulAuthorities.map((authority) => `${authority.nameserver}: ${authority.nameservers.join(', ') || 'no NS answer'}`).join(' | ') || 'No direct answers.', 'Align the NS set served by every authority with the intended parent delegation before cutover.'),
+                : 'Direct nameserver answers agree with the recursive observation', successfulAuthorities.map((authority) => `${authority.nameserver}: ${authority.nameservers.join(', ') || 'no NS answer'}`).join(' | ') || 'No direct answers.', 'Align the NS set served by every authority with the intended parent delegation before cutover.'),
         finding('authority_soa_consistency', 'Authoritative SOA consistency', retainedSoa.length < 2 || soaSerials.length < 1 || soaPrimaries.length < 1
             ? 'unknown'
             : soaSerialConflict || soaPrimaryConflict ? 'warning' : 'healthy', retainedSoa.length < 2
@@ -530,6 +531,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     ];
     const collectionIncomplete = parentStatus !== 'success'
         || candidates.length === 0
+        || omittedAuthorityCount > 0
         || parentQuery.truncated === true
         || registry.truncated
         || authorities.some((authority) => authority.state !== 'success')
@@ -540,6 +542,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const observedAt = (options.observedAt || (() => new Date().toISOString()))();
     return {
         delegationHealthVersion: DNS_DELEGATION_HEALTH_VERSION,
+        domain,
         ...createObservation({
             status,
             observedAt,
@@ -549,9 +552,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             complete: !collectionIncomplete,
             truncated: parentQuery.truncated === true
                 || registry.truncated
+                || omittedAuthorityCount > 0
                 || (recordCollectionAttempted && recordMatrix.some((row) => row.observations.some((item) => item.truncated))),
             limitations: [
-                'The parent nameserver set is a point-in-time recursive resolver view; registry nameservers and glue come from the separately attributed RDAP publication.',
+                'The initial nameserver set comes from a recursive resolver, not a direct parent-server query; registry nameservers and glue come from the separately attributed RDAP publication.',
+                ...(omittedAuthorityCount > 0
+                    ? [`${candidates.length} of ${eligibleAuthorities.length} eligible nameservers were selected; ${omittedAuthorityCount} were not queried.`]
+                    : []),
                 'Direct queries use at most four selected nameservers and two validated public addresses per nameserver.',
                 'Extended A, AAAA, CAA, and MX comparison uses only one selected validated public address per nameserver and caps each record set at sixteen values.',
                 'A direct answer does not prove global reachability, and a failed query is not evidence that the record is absent.',
@@ -563,6 +570,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ],
             diagnostics: {
                 authorityCount: authorities.length,
+                eligibleAuthorityCount: eligibleAuthorities.length,
+                queriedAuthorityCount: authorities.filter((authority) => authority.attempts.length > 0).length,
+                omittedAuthorityCount,
                 queriedAddressCount: authorities.reduce((sum, authority) => sum + authority.attempts.length, 0),
                 successfulAuthorityCount: successfulAuthorities.length,
                 partialAuthorityCount: partialAuthorities.length,
@@ -576,7 +586,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             ? 'The bounded delegation-health collection completed.'
             : status === 'partial'
                 ? 'The delegation-health collection is partial; review each source state before changing DNS.'
-                : 'The delegation-health collection could not confirm a parent or direct authority view.',
+                : 'The delegation-health collection could not confirm a recursive or direct authority observation.',
         parent: {
             state: parentStatus,
             nameservers: parentNameservers,

package/lib/dns-inheritance-review.mjs

@@ -0,0 +1,217 @@
+import { promises as dns } from 'node:dns';
+import { parse as parseDomain } from 'tldts';
+import { parseDmarcRecords } from "./domain-posture-parsers.mjs";
+import { buildDnssecQuery, DNS_TYPE_NS, normalizeResolverEndpoint, parseDnssecResponse } from "./dnssec-chain-validation.mjs";
+import { defaultTcpExchange } from "./service-binding-dns.mjs";
+import { isValidAsciiHostname } from "./hostname.mjs";
+import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+const MAX_PARENT_SERVERS = 2;
+const MAX_NS = 16;
+const QUERY_TIMEOUT_MS = 2200;
+const REVIEW_TIMEOUT_MS = 10_000;
+const MISSING = new Set(['ENODATA', 'ENOTFOUND', 'ENONAME']);
+function requireDomain(domain) {
+    if (typeof domain !== 'string' || domain.length > 253 || !isValidAsciiHostname(domain) || domain !== domain.toLowerCase()) {
+        throw new TypeError('The additional DNS review requires a normalised domain.');
+    }
+}
+/** Explicit query parameter; malformed opt-ins never broaden collection. */
+export function parseInheritedDnsSelection(value) {
+    if (value === undefined || value === '')
+        return undefined;
+    if (value === '1')
+        return true;
+    throw new TypeError('includeInheritedDns must be 1 when requested.');
+}
+function check(id, label, status, summary, detail, records) {
+    return { id, label, status, summary, detail, records, remediation: '' };
+}
+function policyObservation(owner, observation) {
+    const records = observation.records;
+    let bytes = 0;
+    const admitted = Array.isArray(records) && records.length <= 64 && records.every(raw => {
+        const parts = typeof raw === 'string' ? [raw] : raw;
+        return Array.isArray(parts) && parts.length <= 256 && parts.every(part => {
+            if (typeof part !== 'string' || part.length > 4096)
+                return false;
+            bytes += Buffer.byteLength(part, 'utf8');
+            return bytes <= 65_536;
+        });
+    });
+    const parsed = parseDmarcRecords(admitted ? records : []);
+    const unavailable = Boolean(observation.error) || !admitted;
+    const valid = !unavailable && parsed.valid && ['u', 'n', 'y'].includes(parsed.tags.psd?.toLowerCase() ?? 'u');
+    const state = unavailable ? 'unavailable' : valid ? 'observed' : parsed.records.length ? 'invalid' : 'not found';
+    const description = valid
+        ? `p=${parsed.policy}; sp=${parsed.subdomainPolicy}; np=${parsed.nonexistentSubdomainPolicy}; psd=${parsed.tags.psd?.toLowerCase() ?? 'u'}; test=${parsed.testMode ? 'yes' : 'no'}`
+        : state;
+    const time = typeof observation.observedAt === 'string' && observation.observedAt.length <= 64
+        ? normalizeExplicitIsoTimestamp(observation.observedAt) : null;
+    return { owner, parsed, valid, unavailable, record: `Recursive DNS TXT _dmarc.${owner} · ${time ?? 'time unavailable'} · ${description}` };
+}
+/** RFC 9989 sections 4.10–4.10.2; at most eight owners including the exact name. */
+export async function reviewInheritedDmarc(domain, exact, resolve) {
+    requireDomain(domain);
+    const rows = [policyObservation(domain, exact)];
+    const labels = domain.split('.');
+    let next = labels.length >= 8 ? labels.slice(-7) : labels.slice(1);
+    if (!rows[0].valid && !rows[0].unavailable) {
+        while (next.length) {
+            const owner = next.join('.');
+            const row = policyObservation(owner, await resolve(`_dmarc.${owner}`));
+            rows.push(row);
+            if (row.unavailable || (row.valid && ['n', 'y'].includes(row.parsed.tags.psd?.toLowerCase() ?? '')))
+                break;
+            next = next.slice(1);
+        }
+    }
+    const available = rows.filter(row => row.valid);
+    const explicit = rows[0].valid ? rows[0] : null;
+    const boundary = available.find(row => row.parsed.tags.psd?.toLowerCase() === 'n' || row.parsed.tags.psd?.toLowerCase() === 'y');
+    const organisational = boundary?.parsed.tags.psd?.toLowerCase() === 'y'
+        ? domain.split('.').slice(-(boundary.owner.split('.').length + 1)).join('.')
+        : boundary?.owner ?? available.at(-1)?.owner ?? null;
+    const selected = explicit ?? available.find(row => row.owner === organisational) ?? (boundary?.parsed.tags.psd?.toLowerCase() === 'y' ? boundary : null);
+    const incomplete = rows.some(row => row.unavailable || (!row.valid && row.parsed.records.length === 1));
+    const summary = incomplete ? 'Inherited policy could not be determined from the collected records.'
+        : selected ? `${selected.owner === domain ? 'Exact-name' : 'Inherited'} policy published at _dmarc.${selected.owner}.`
+            : 'No applicable DMARC policy was found in the completed tree walk.';
+    const detail = !incomplete && selected
+        ? selected.owner === domain
+            ? `Published policy: ${selected.parsed.policy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}.`
+            : `For an existing name: ${selected.parsed.subdomainPolicy}. For a nonexistent name: ${selected.parsed.nonexistentSubdomainPolicy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}. Name existence is not inferred from this review.`
+        : 'Invalid or unavailable records do not establish absence or a usable inherited policy.';
+    return check('dmarc_inheritance', 'Inherited DMARC policy', incomplete || !selected ? 'warning' : 'info', summary, `${detail} Discovery follows RFC 9989 with at most eight owners. This is publication evidence, not message authentication or a guarantee of receiver behaviour.`, rows.map(row => row.record));
+}
+function nameservers(value) {
+    if (!Array.isArray(value) || value.length > MAX_NS)
+        return null;
+    const names = value.map(raw => typeof raw === 'string' && raw.length <= 254 ? raw.toLowerCase().replace(/\.$/u, '') : '');
+    return names.every(name => name.length <= 253 && isValidAsciiHostname(name)) ? [...new Set(names)].sort() : null;
+}
+export async function reviewParentDelegation(domain, recursive, dependencies, signal) {
+    requireDomain(domain);
+    const parsed = parseDomain(domain, { allowPrivateDomains: false });
+    const child = parsed.domain;
+    const parent = parsed.publicSuffix;
+    const records = [];
+    let referrals = 0;
+    let differs = false;
+    let parentDiffers = false;
+    let firstReferral = null;
+    let incomplete = false;
+    const observed = recursive.error || domain !== child ? null : nameservers(recursive.records);
+    const finish = () => check('parent_delegation', 'Direct parent delegation', differs || parentDiffers || incomplete || !referrals ? 'warning' : 'info', parentDiffers ? 'Sampled parent servers returned different delegation referrals.'
+        : differs ? 'Parent referral and recursive nameserver observations differ.'
+            : referrals ? `${referrals} parent server${referrals === 1 ? '' : 's'} returned a delegation referral for ${child}.`
+                : 'No direct parent referral was established.', `Registration-domain scope: ${child ?? 'unavailable'}; parent candidate: ${parent ?? 'unavailable'}. At most two discovered parent servers are queried over pinned public-address DNS/TCP, without recursion. This is a sample, not full delegation or DNSSEC validation.${incomplete ? ' Some discovery or direct observations were unavailable or incomplete.' : ''}${!observed ? ' No complete same-scope recursive comparison is available.' : ''}`, records);
+    if (!child || !parent || child === parent)
+        return finish();
+    signal?.throwIfAborted();
+    let discovered;
+    try {
+        discovered = nameservers(await dependencies.resolveNs(parent));
+    }
+    catch {
+        signal?.throwIfAborted();
+        incomplete = true;
+        return finish();
+    }
+    if (!discovered?.length) {
+        incomplete = true;
+        return finish();
+    }
+    records.push(`Recursive DNS NS ${parent} · ${dependencies.now().toISOString()} · ${discovered.length} discovered; ${Math.min(MAX_PARENT_SERVERS, discovered.length)} selected.`);
+    for (const server of discovered.slice(0, MAX_PARENT_SERVERS)) {
+        signal?.throwIfAborted();
+        const resolutions = await Promise.allSettled([dependencies.resolve4(server), dependencies.resolve6(server)]);
+        signal?.throwIfAborted();
+        const failed = resolutions.some(result => result.status === 'fulfilled'
+            ? !Array.isArray(result.value) || result.value.length > 16
+            : !MISSING.has(String(result.reason?.code)));
+        if (failed) {
+            incomplete = true;
+            records.push(`${server}: public-address discovery unavailable or rejected.`);
+            continue;
+        }
+        const addresses = resolutions.flatMap(result => result.status === 'fulfilled' ? result.value : []);
+        const endpoints = addresses.map(normalizeResolverEndpoint);
+        if (!addresses.length || endpoints.some(endpoint => !endpoint)) {
+            incomplete = true;
+            records.push(`${server}: public-address discovery unavailable or rejected.`);
+            continue;
+        }
+        const endpoint = endpoints.filter((value) => value !== null)
+            .sort((a, b) => a.address < b.address ? -1 : a.address > b.address ? 1 : 0)[0];
+        const query = buildDnssecQuery(child, DNS_TYPE_NS);
+        query.writeUInt16BE(0, 2); // No recursion or authenticated-data assertion is requested.
+        try {
+            const responseBytes = await dependencies.exchange(query, endpoint, { timeoutMs: QUERY_TIMEOUT_MS, ...(signal ? { signal } : {}) });
+            signal?.throwIfAborted();
+            if (responseBytes.byteLength > 65_535)
+                throw new RangeError('The DNS response exceeds the wire limit.');
+            const response = parseDnssecResponse(responseBytes, { transactionId: query.readUInt16BE(0), name: child, type: DNS_TYPE_NS });
+            const referred = nameservers(response.records.filter(row => row.section === 'authority' && row.owner === child && row.type === DNS_TYPE_NS && row.class === 1)
+                .flatMap(row => row.data.kind === 'NS' ? [row.data.name] : []));
+            records.push(`Direct DNS/TCP ${server} [${endpoint.address}] · ${dependencies.now().toISOString()} · ${child} NS · response ${response.rcode}.`);
+            if (response.rcode !== 0 || !referred?.length) {
+                incomplete = true;
+                continue;
+            }
+            referrals += 1;
+            if (firstReferral && JSON.stringify(firstReferral) !== JSON.stringify(referred))
+                parentDiffers = true;
+            firstReferral ??= referred;
+            for (const name of referred)
+                records.push(`${server} authority section: ${child} NS ${name}`);
+            if (observed && JSON.stringify(observed) !== JSON.stringify(referred))
+                differs = true;
+        }
+        catch {
+            signal?.throwIfAborted();
+            incomplete = true;
+            records.push(`${server}: bounded direct referral query failed.`);
+        }
+    }
+    return finish();
+}
+export async function collectDnsInheritanceChecks(domain, exact, recursive, options = {}, injected) {
+    requireDomain(domain);
+    options.signal?.throwIfAborted();
+    const timeout = AbortSignal.timeout(REVIEW_TIMEOUT_MS);
+    const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
+    const resolver = injected ? null : new dns.Resolver({ timeout: QUERY_TIMEOUT_MS, tries: 1 });
+    const cancel = () => resolver?.cancel();
+    signal.addEventListener('abort', cancel, { once: true });
+    const dependencies = injected ?? {
+        resolveTxt: (name) => resolver.resolveTxt(name), resolveNs: (name) => resolver.resolveNs(name),
+        resolve4: (name) => resolver.resolve4(name), resolve6: (name) => resolver.resolve6(name),
+        exchange: defaultTcpExchange, now: () => new Date(),
+    };
+    const resolve = async (owner) => {
+        signal.throwIfAborted();
+        if (owner.length > 253)
+            return { records: [], error: 'The DNS question exceeds the name limit.' };
+        try {
+            return { records: await dependencies.resolveTxt(owner), error: null, observedAt: dependencies.now().toISOString() };
+        }
+        catch (error) {
+            options.signal?.throwIfAborted();
+            return { records: [], error: MISSING.has(String(error?.code)) ? null : 'DNS observation unavailable.', observedAt: dependencies.now().toISOString() };
+        }
+    };
+    const operations = [reviewInheritedDmarc(domain, exact, resolve), reviewParentDelegation(domain, recursive, dependencies, signal)];
+    try {
+        return await Promise.all(operations);
+    }
+    catch {
+        options.signal?.throwIfAborted();
+        const settled = await Promise.allSettled(operations);
+        return settled.map((result, index) => result.status === 'fulfilled' ? result.value : check(index === 0 ? 'dmarc_inheritance' : 'parent_delegation', index === 0 ? 'Inherited DMARC policy' : 'Direct parent delegation', 'warning', 'The additional review could not complete.', 'No absence or effective-policy conclusion is available from the incomplete review.', []));
+    }
+    finally {
+        await Promise.allSettled(operations);
+        signal.removeEventListener('abort', cancel);
+        cancel();
+    }
+}

package/lib/dns-intelligence.mjs

@@ -5,11 +5,13 @@
 import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { classifyMxRecords } from "./dns-mx.mjs";
+import { normalizeResolverMxRecord } from "../packages/evidence/domain-control-runtime.mjs";
 import { collectDnsDelegationHealth, skippedDnsDelegationHealth, } from "./dns-delegation-health.mjs";
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { resolveServiceBindingRecords } from "./service-binding-dns.mjs";
+import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
 const DNS_TIMEOUT_MS = 5000;
 const MAX_RECORDS_PER_TYPE = MAX_LOOKUP_DNS_RECORDS_PER_TYPE;
 const MAX_PTR_RECORDS = MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS;
@@ -123,7 +125,7 @@ function boundedUnique(values, limit = MAX_RECORDS_PER_TYPE) {
 }
 function normalizeAddresses(records, family) {
     const values = [];
-    let discarded = 0;
+    let discarded = Array.isArray(records) ? 0 : 1;
     for (const record of Array.isArray(records) ? records : []) {
         const value = typeof record === 'string' ? record : record && typeof record === 'object' ? record.address : null;
         if (typeof value !== 'string' || net.isIP(value) !== family)
@@ -135,7 +137,7 @@ function normalizeAddresses(records, family) {
 }
 function normalizeHostnames(records) {
     const values = [];
-    let discarded = 0;
+    let discarded = Array.isArray(records) ? 0 : 1;
     for (const record of Array.isArray(records) ? records : []) {
         const value = normalizeHostname(record);
         if (value)
@@ -147,19 +149,15 @@ function normalizeHostnames(records) {
 }
 function normalizeMx(records) {
     const byKey = new Map();
-    let discarded = 0;
+    let discarded = Array.isArray(records) ? 0 : 1;
     for (const record of Array.isArray(records) ? records : []) {
-        if (!record || typeof record !== 'object') {
-            discarded += 1;
-            continue;
-        }
-        const value = record;
-        const exchange = value.exchange === '' || value.exchange === '.' ? '' : normalizeHostname(value.exchange);
-        const priority = Number(value.priority);
-        if (exchange === null || !Number.isInteger(priority) || priority < 0 || priority > 65535) {
+        const value = normalizeResolverMxRecord(record);
+        if (!value) {
             discarded += 1;
             continue;
         }
+        const { priority } = value;
+        const exchange = value.exchange === '.' ? '' : value.exchange;
         byKey.set(`${priority}:${exchange}`, { priority, exchange });
     }
     const values = [...byKey.values()].sort((a, b) => a.priority - b.priority || a.exchange.localeCompare(b.exchange));
@@ -167,7 +165,7 @@ function normalizeMx(records) {
 }
 function normalizeTxtPolicies(records, prefix) {
     const values = [];
-    let discarded = 0;
+    let discarded = Array.isArray(records) ? 0 : 1;
     for (const chunks of Array.isArray(records) ? records : []) {
         if (!Array.isArray(chunks) || chunks.some((chunk) => typeof chunk !== 'string')) {
             discarded += 1;
@@ -185,12 +183,17 @@ function normalizeTxtPolicies(records, prefix) {
 }
 function normalizeCaa(records) {
     const byKey = new Map();
-    let discarded = 0;
+    let discarded = Array.isArray(records) ? 0 : 1;
     for (const record of Array.isArray(records) ? records : []) {
         const entry = record && typeof record === 'object' ? record : {};
         const critical = Number(entry.critical);
-        const tag = String(entry.tag || '').trim().toLowerCase();
-        const value = String(entry.value || '').trim();
+        const nodeTags = ['issue', 'issuewild', 'iodef'].filter((tag) => Object.hasOwn(entry, tag));
+        const hasPair = Object.hasOwn(entry, 'tag') || Object.hasOwn(entry, 'value');
+        const tag = hasPair
+            ? String(entry.tag || '').trim().toLowerCase()
+            : nodeTags.length === 1 ? nodeTags[0] : '';
+        const rawValue = hasPair ? entry.value : tag ? entry[tag] : undefined;
+        const value = typeof rawValue === 'string' ? rawValue.trim() : '';
         if (!Number.isInteger(critical) || critical < 0 || critical > 255 || !/^[a-z0-9-]{1,15}$/.test(tag) || !value || value.length > MAX_POLICY_LENGTH || /[\u0000-\u001f\u007f]/.test(value)) {
             discarded += 1;
             continue;
@@ -390,10 +393,11 @@ function withTimeout(factory, timeoutMs) {
 async function query(factory, normalize, timeoutMs) {
     try {
         const normalized = normalize(await withTimeout(factory, timeoutMs));
+        const unusable = !normalized.records.length && (normalized.truncated || normalized.discarded > 0);
         return {
-            status: normalized.records.length ? 'success' : 'not_found',
+            status: unusable ? 'error' : normalized.records.length ? 'success' : 'not_found',
             records: normalized.records,
-            error: null,
+            error: unusable ? 'The returned record family could not be retained completely; absence is unknown.' : null,
             truncated: normalized.truncated,
             discarded: normalized.discarded || 0,
         };
@@ -404,6 +408,12 @@ async function query(factory, normalize, timeoutMs) {
         return { status: 'error', records: [], error: boundedError(error), truncated: false, discarded: 0 };
     }
 }
+function completeQuery(result) {
+    return result.status !== 'error' && !result.truncated && result.discarded === 0;
+}
+function observedPresence(result) {
+    return result.records.length > 0 ? true : completeQuery(result) ? false : null;
+}
 async function collectEffectiveCaaPolicy(domain, options = {}) {
     const normalizedDomain = normalizeHostname(domain);
     const queryLimit = Math.max(1, Math.min(MAX_CAA_TREE_QUERIES, Math.floor(options.queryLimit || MAX_CAA_TREE_QUERIES)));
@@ -454,7 +464,7 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
             truncated: result.truncated,
             discarded: result.discarded,
         });
-        if (result.status === 'error') {
+        if (result.status === 'error' && !result.truncated && result.discarded === 0) {
             return {
                 ...createObservation({
                     status: index === 0 ? 'error' : 'partial',
@@ -511,6 +521,35 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
                 records: result.records,
             };
         }
+        if (result.truncated || result.discarded > 0) {
+            return {
+                ...createObservation({
+                    status: 'partial',
+                    observedAt: (options.observedAt || (() => new Date().toISOString()))(),
+                    scanMode: 'deep',
+                    source: 'dns',
+                    durationMs: Math.max(0, now() - started),
+                    complete: false,
+                    truncated: result.truncated,
+                    limitations,
+                    diagnostics: {
+                        tree: {
+                            status: 'partial',
+                            detail: `The CAA answer at ${owner} contained discarded or truncated records, so parent inheritance was not evaluated.`,
+                            count: queries.length,
+                            truncated: result.truncated,
+                            discarded: result.discarded,
+                        },
+                    },
+                }),
+                policyVersion: 1,
+                queryLimit,
+                queriedOwners: queries,
+                effectiveOwner: null,
+                inherited: null,
+                records: [],
+            };
+        }
     }
     return {
         ...createObservation({
@@ -542,6 +581,10 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     };
 }
 async function collectDnsIntelligence(domain, options = {}) {
+    const registrationDomain = options.registrationDomain ?? domain;
+    if (options.registrationDomain !== undefined && canonicalRegistrableDomain(domain) !== registrationDomain) {
+        throw new TypeError('DNS registration context must match the hostname being observed.');
+    }
     const resolvers = options.resolvers || {};
     const includeExtendedContext = options.includeExtendedContext === true;
     const includeInheritedCaa = options.includeInheritedCaa === true;
@@ -572,8 +615,11 @@ async function collectDnsIntelligence(domain, options = {}) {
     const httpsPromise = includeExtendedContext
         ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs })), normalizeServiceBindings, timeoutMs)
         : Promise.resolve(null);
+    const registrationNsPromise = includeExtendedContext && registrationDomain !== domain
+        ? query(invoke('resolveNs', dns.resolveNs, registrationDomain), normalizeHostnames, timeoutMs)
+        : nsPromise;
     const delegationPromise = includeExtendedContext
-        ? nsPromise.then((parentNameservers) => collectDnsDelegationHealth(domain, parentNameservers, {
+        ? registrationNsPromise.then((parentNameservers) => collectDnsDelegationHealth(registrationDomain, parentNameservers, {
             registryEvidence: options.registryEvidence,
             resolve4: (resolvers.resolve4 || dns.resolve4),
             resolve6: (resolvers.resolve6 || dns.resolve6),
@@ -611,7 +657,8 @@ async function collectDnsIntelligence(domain, options = {}) {
         || discardedCount > 0
         || (caaPolicy !== null && caaPolicy.complete !== true)
         || (delegation !== null && delegation.status !== 'success');
-    const classifiedMx = mx.status === 'error' ? null : classifyMxRecords(mx.records);
+    const classifiedMx = classifyMxRecords(mx.records);
+    const mxComplete = completeQuery(mx);
     return {
         ...createObservation({
             status: errorCount === values.length ? 'error' : incomplete ? 'partial' : 'success',
@@ -669,11 +716,11 @@ async function collectDnsIntelligence(domain, options = {}) {
             ...(soa ? { soa: soa.records } : {}),
             ...(https ? { https: https.records } : {}),
         },
-        hasMx: classifiedMx ? classifiedMx.hasMx : null,
-        hasNullMx: classifiedMx ? classifiedMx.hasNullMx : null,
-        mxHosts: classifiedMx ? classifiedMx.mxHosts : [],
-        hasSpf: spf.status === 'error' ? null : spf.records.length > 0,
-        hasDmarc: dmarc.status === 'error' ? null : dmarc.records.length > 0,
+        hasMx: classifiedMx.hasMx ? true : mxComplete ? false : null,
+        hasNullMx: mxComplete ? classifiedMx.hasNullMx : null,
+        mxHosts: classifiedMx.mxHosts,
+        hasSpf: observedPresence(spf),
+        hasDmarc: observedPresence(dmarc),
         delegation,
         ...(caaPolicy ? { caaPolicy } : {}),
     };
@@ -706,7 +753,7 @@ async function collectReverseDnsIntelligence(address, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const now = options.now || Date.now;
     const started = now();
-    const ptr = await query(() => (options.resolver || dns.resolvePtr)(address), normalizePtr, timeoutMs);
+    const ptr = await query(() => (options.resolver || dns.reverse)(address), normalizePtr, timeoutMs);
     const incomplete = ptr.status === 'error' || ptr.truncated || ptr.discarded > 0;
     return {
         ...createObservation({

package/lib/dns-mx.mjs

@@ -14,7 +14,7 @@ function classifyMxRecords(records) {
     // of configuration. Not currently used for scoring (both cases already
     // correctly score as hasMx: false); exposed for callers that want to tell
     // the two apart.
-    const hasNullMx = records.length > 0 && realRecords.length === 0;
+    const hasNullMx = records.length === 1 && records[0]?.priority === 0 && realRecords.length === 0;
     return {
         hasMx: realRecords.length > 0,
         hasNullMx,

package/lib/dnssec-chain-validation.mjs

@@ -718,6 +718,9 @@ function validateNegativeProof(response, name, missingType, keys, zone, now, req
         const verification = verifyRrset(response, exactNsec.owner, DNS_TYPE_NSEC, keys, zone, now);
         if (verification.state !== 'valid')
             return verification;
+        if (exactNsec.data.types.has(DNS_TYPE_CNAME)) {
+            return { state: 'unsupported', detail: 'The validated NSEC owner is an alias; the target RRset cannot be treated as authenticated absence without a validated alias walk.' };
+        }
         const delegation = exactNsec.data.types.has(DNS_TYPE_NS) && !exactNsec.data.types.has(DNS_TYPE_SOA);
         if (!exactNsec.data.types.has(missingType) && (!requireDelegation || delegation)) {
             return { state: 'valid', detail: 'A validated NSEC record proved the requested RRset absent.' };
@@ -758,6 +761,9 @@ function validateNegativeProof(response, name, missingType, keys, zone, now, req
                 sawBogus = true;
             continue;
         }
+        if (exact && record.data.types.has(DNS_TYPE_CNAME)) {
+            return { state: 'unsupported', detail: 'The validated NSEC3 owner is an alias; the target RRset cannot be treated as authenticated absence without a validated alias walk.' };
+        }
         if (exact && record.data.types.has(missingType))
             return { state: 'bogus', detail: 'The validated NSEC3 bitmap contains the RR type reported as absent.' };
         if (requireDelegation && exact && (!record.data.types.has(DNS_TYPE_NS) || record.data.types.has(DNS_TYPE_SOA)))

package/lib/dnssec-evidence-validation.mjs

@@ -130,6 +130,9 @@ function signatureTimeState(value, observedAt) {
 }
 function validateDnssecEvidence(input) {
     const normalizedOwner = ownerName(input.ownerName);
+    const missingDs = input.dsRecords === undefined;
+    const malformedContainers = [input.dsRecords, input.dnskeyRecords, input.rrSigRecords]
+        .filter((value) => value !== undefined && !Array.isArray(value)).length;
     const rawDs = Array.isArray(input.dsRecords) ? input.dsRecords : [];
     const rawDnskeys = Array.isArray(input.dnskeyRecords) ? input.dnskeyRecords : [];
     const rawRrsigs = Array.isArray(input.rrSigRecords) ? input.rrSigRecords : [];
@@ -138,7 +141,8 @@ function validateDnssecEvidence(input) {
     const rrsigs = rawRrsigs.slice(0, MAX_DNSSEC_RECORDS).map(normalizeRrsig).filter((item) => item !== null);
     const rejectedCount = Math.min(rawDs.length, MAX_DNSSEC_RECORDS) - dsRecords.length
         + Math.min(rawDnskeys.length, MAX_DNSSEC_RECORDS) - dnskeys.length
-        + Math.min(rawRrsigs.length, MAX_DNSSEC_RECORDS) - rrsigs.length;
+        + Math.min(rawRrsigs.length, MAX_DNSSEC_RECORDS) - rrsigs.length
+        + malformedContainers;
     const truncated = rawDs.length > MAX_DNSSEC_RECORDS
         || rawDnskeys.length > MAX_DNSSEC_RECORDS
         || rawRrsigs.length > MAX_DNSSEC_RECORDS;
@@ -166,7 +170,11 @@ function validateDnssecEvidence(input) {
             limitations: Object.freeze(limitations),
         });
     }
-    const incompleteInput = rejectedCount > 0 || truncated;
+    const incompleteInput = missingDs || rejectedCount > 0 || truncated;
+    if (missingDs)
+        findings.push('No DS record collection was supplied. Omitted input is not a verified empty collection.');
+    if (malformedContainers)
+        findings.push(`${malformedContainers} record collection container(s) had an invalid type; their contents are unknown.`);
     if (input.delegationSigned === false && dsRecords.length === 0 && !incompleteInput) {
         findings.push('The supplied delegation state was unsigned and no DS records were supplied.');
         return Object.freeze({
@@ -217,7 +225,7 @@ function validateDnssecEvidence(input) {
         findings.push('The retained subset contains no usable DS record, but omitted or rejected records prevent a definitive unsigned conclusion.');
     }
     if (rejectedCount > 0)
-        findings.push(`${rejectedCount} malformed record(s) were rejected.`);
+        findings.push(`${rejectedCount} malformed record(s) or collection container(s) were rejected.`);
     if (truncated)
         findings.push('The supplied record set exceeded the review bound and was truncated.');
     const completeLocalRelationship = dsRecords.length > 0