@slicedearth/whoisleuth-cli 2.4.0 → 2.6.0

package/lib/dns-delegation-health.mjs

@@ -6,7 +6,7 @@ import { promises as dns } from 'node:dns';
 import * as net from 'node:net';
 import { createObservation } from "../packages/evidence/observation.mjs";
 import { normalizeResolverMxRecord } from "../packages/evidence/domain-control-runtime.mjs";
-import { isValidAsciiHostname } from "./hostname.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 const DNS_DELEGATION_HEALTH_VERSION = 1;
 const MAX_AUTHORITIES = 4;
@@ -99,15 +99,19 @@ function withTimeout(promise, timeoutMs) {
     });
 }
 async function defaultAuthorityQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const [nameservers, soa] = await Promise.allSettled([
         resolver.resolveNs(input.domain),
         resolver.resolveSoa(input.domain),
-    ]);
+    ]).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
     const reason = nameservers.status === 'rejected'
         ? nameservers.reason
         : soa.status === 'rejected'
@@ -188,18 +192,21 @@ function normaliseAuthorityValues(type, value) {
     return normaliseAuthorityValueSet(type, value).values;
 }
 async function defaultAuthorityRecordQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const queries = [
         ['A', resolver.resolve4(input.domain)],
         ['AAAA', resolver.resolve6(input.domain)],
         ['CAA', resolver.resolveCaa(input.domain)],
         ['MX', resolver.resolveMx(input.domain)],
     ];
-    return Promise.all(queries.map(async ([type, promise]) => {
+    const result = await Promise.all(queries.map(async ([type, promise]) => {
         try {
             const response = await withTimeout(promise, input.timeoutMs);
             const normalised = normaliseAuthorityValueSet(type, response);
@@ -224,7 +231,9 @@ async function defaultAuthorityRecordQuery(input) {
                 discarded: 0,
             };
         }
-    }));
+    })).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
+    return result;
 }
 function authorityRecordMatrix(authorities) {
     const types = ['A', 'AAAA', 'CAA', 'MX'];
@@ -318,6 +327,7 @@ function skippedDnsDelegationHealth(detail = 'Authoritative delegation checks we
     };
 }
 async function collectDnsDelegationHealth(domainValue, parentQueryValue, options = {}) {
+    options.signal?.throwIfAborted();
     const domain = hostname(domainValue);
     if (!domain)
         return skippedDnsDelegationHealth('The domain was not eligible for authoritative delegation checks.');
@@ -338,7 +348,8 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const timeoutMs = Math.max(250, Math.min(5000, Number(options.timeoutMs) || DNS_DELEGATION_TIMEOUT_MS));
     const now = options.now || Date.now;
     const started = now();
-    const authorities = await Promise.all(candidates.map(async (nameserver) => {
+    const pending = candidates.map(async (nameserver) => {
+        options.signal?.throwIfAborted();
         const glue = registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses ?? [];
         const resolved = glue.length
             ? glue
@@ -350,10 +361,11 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 : [])
                 .map(publicAddress)
                 .filter((address) => address !== null);
+        options.signal?.throwIfAborted();
         const addresses = [...new Set(resolved)].slice(0, MAX_AUTHORITY_ADDRESSES);
         const attempts = await Promise.all(addresses.map(async (address) => {
             try {
-                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs }), timeoutMs);
+                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs);
                 const query = record(raw);
                 const code = boundedText(query.errorCode, 40);
                 const error = boundedText(query.error, MAX_ERROR_LENGTH);
@@ -384,6 +396,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 };
             }
         }));
+        options.signal?.throwIfAborted();
         const successful = attempts.find((attempt) => attempt.state === 'success');
         const partial = attempts.find((attempt) => attempt.state === 'partial');
         const retained = successful ?? partial;
@@ -391,7 +404,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
         const recordAddress = retained?.address ?? addresses[0];
         if (queryAuthorityRecords && recordAddress) {
             try {
-                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs }), timeoutMs))
+                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs))
                     .filter((item) => ['A', 'AAAA', 'CAA', 'MX'].includes(item.type))
                     .slice(0, 4)
                     .map((item) => {
@@ -428,6 +441,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 }));
             }
         }
+        options.signal?.throwIfAborted();
         return {
             nameserver,
             addressSource: glue.length ? 'registry_glue' : 'recursive_address',
@@ -445,7 +459,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             recordSets,
             attempts,
         };
-    }));
+    });
+    const authorities = await Promise.all(pending).finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const successfulAuthorities = authorities.filter((authority) => authority.state === 'success');
     const partialAuthorities = authorities.filter((authority) => authority.state === 'partial');
     const lameAuthorities = authorities.filter((authority) => authority.state === 'lame');
@@ -465,8 +481,10 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             .filter((primary) => primary !== null))];
     const soaSerialConflict = soaSerials.length > 1;
     const soaPrimaryConflict = soaPrimaries.length > 1;
-    const inBailiwick = candidates.filter((nameserver) => (nameserver === domain || nameserver.endsWith(`.${domain}`)));
-    const missingGlue = inBailiwick.filter((nameserver) => (!(registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses.length)));
+    const glueInventoryComplete = (parentStatus === 'success' && parentNameservers.length > 0 && parentQuery.truncated !== true)
+        || (registry.nameservers.length > 0 && !registry.truncated);
+    const inBailiwick = eligibleAuthorities.filter((nameserver) => (nameserver === domain || nameserver.endsWith(`.${domain}`)));
+    const unobservedGlue = inBailiwick.filter((nameserver) => (!(registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses.length)));
     const dnssecMismatch = (registry.delegationSigned === true && registry.dsRecordCount === 0) || (registry.delegationSigned === false && registry.dsRecordCount > 0);
     const recordMatrix = authorityRecordMatrix(authorities);
     const recordCollectionAttempted = authorities.some((authority) => authority.recordSets.length > 0);
@@ -507,11 +525,13 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 : soaPrimaryConflict
                     ? 'Authoritative servers published different SOA primary nameservers'
                     : 'Observed authority SOA serials and primary nameservers agree', retainedSoa.map((entry) => (`${entry.nameserver}: serial ${entry.soa.serial ?? 'unavailable'}, primary ${entry.soa.nsname ?? 'unavailable'}, refresh ${entry.soa.refresh ?? 'unavailable'}, retry ${entry.soa.retry ?? 'unavailable'}, expire ${entry.soa.expire ?? 'unavailable'}`)).join(' | ') || 'No complete SOA observation was available.', 'Confirm zone propagation and the intended SOA primary before relying on a DNS change or secondary-server state.'),
-        finding('in_bailiwick_glue', 'In-bailiwick glue', !inBailiwick.length ? 'healthy' : missingGlue.length ? 'warning' : 'healthy', !inBailiwick.length
-            ? 'No in-bailiwick nameserver requires registry glue'
-            : missingGlue.length
-                ? 'Registry glue was not observed for every in-bailiwick nameserver'
-                : 'Registry publication includes observed glue for each in-bailiwick nameserver', missingGlue.length ? `Missing observed glue: ${missingGlue.join(', ')}.` : `In-bailiwick nameservers: ${inBailiwick.join(', ') || 'none'}.`, 'Publish current A and AAAA glue at the registry for every in-bailiwick nameserver.'),
+        finding('in_bailiwick_glue', 'In-bailiwick glue', !glueInventoryComplete || unobservedGlue.length ? 'unknown' : 'healthy', !glueInventoryComplete
+            ? 'The delegated nameserver inventory is unavailable or incomplete'
+            : !inBailiwick.length
+                ? 'No in-bailiwick nameserver requires registry glue'
+                : unobservedGlue.length
+                    ? 'Registry address publication does not establish glue for every in-bailiwick nameserver'
+                    : 'Registry publication includes observed glue for each in-bailiwick nameserver', unobservedGlue.length ? `No address publication retained for: ${unobservedGlue.join(', ')}. Optional RDAP address fields and recursive NS answers do not establish that parent-zone glue is absent.` : `In-bailiwick nameservers: ${inBailiwick.join(', ') || 'none'}.`, 'Verify parent-zone glue with the registry or DNS operator before deciding whether an update is needed.'),
         finding('dnssec_delegation', 'DNSSEC delegation publication', dnssecMismatch ? 'warning'
             : registry.delegationSigned === null && registry.dsRecordCount === 0 ? 'unknown' : 'healthy', dnssecMismatch
             ? 'Registry DNSSEC fields are internally inconsistent'

package/lib/dns-inheritance-review.mjs

@@ -1,20 +1,16 @@
 import { promises as dns } from 'node:dns';
 import { parse as parseDomain } from 'tldts';
-import { parseDmarcRecords } from "./domain-posture-parsers.mjs";
+import { validateDmarcExternalReporting } from "./domain-posture-analysis.mjs";
+import { requireDmarcDomain, walkDmarcTree } from "./dmarc-discovery.mjs";
 import { buildDnssecQuery, DNS_TYPE_NS, normalizeResolverEndpoint, parseDnssecResponse } from "./dnssec-chain-validation.mjs";
 import { defaultTcpExchange } from "./service-binding-dns.mjs";
-import { isValidAsciiHostname } from "./hostname.mjs";
-import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
+import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 const MAX_PARENT_SERVERS = 2;
 const MAX_NS = 16;
 const QUERY_TIMEOUT_MS = 2200;
 const REVIEW_TIMEOUT_MS = 10_000;
+export const MAX_DMARC_REVIEW_QUERIES = 32;
 const MISSING = new Set(['ENODATA', 'ENOTFOUND', 'ENONAME']);
-function requireDomain(domain) {
-    if (typeof domain !== 'string' || domain.length > 253 || !isValidAsciiHostname(domain) || domain !== domain.toLowerCase()) {
-        throw new TypeError('The additional DNS review requires a normalised domain.');
-    }
-}
 /** Explicit query parameter; malformed opt-ins never broaden collection. */
 export function parseInheritedDnsSelection(value) {
     if (value === undefined || value === '')
@@ -26,53 +22,11 @@ export function parseInheritedDnsSelection(value) {
 function check(id, label, status, summary, detail, records) {
     return { id, label, status, summary, detail, records, remediation: '' };
 }
-function policyObservation(owner, observation) {
-    const records = observation.records;
-    let bytes = 0;
-    const admitted = Array.isArray(records) && records.length <= 64 && records.every(raw => {
-        const parts = typeof raw === 'string' ? [raw] : raw;
-        return Array.isArray(parts) && parts.length <= 256 && parts.every(part => {
-            if (typeof part !== 'string' || part.length > 4096)
-                return false;
-            bytes += Buffer.byteLength(part, 'utf8');
-            return bytes <= 65_536;
-        });
-    });
-    const parsed = parseDmarcRecords(admitted ? records : []);
-    const unavailable = Boolean(observation.error) || !admitted;
-    const valid = !unavailable && parsed.valid && ['u', 'n', 'y'].includes(parsed.tags.psd?.toLowerCase() ?? 'u');
-    const state = unavailable ? 'unavailable' : valid ? 'observed' : parsed.records.length ? 'invalid' : 'not found';
-    const description = valid
-        ? `p=${parsed.policy}; sp=${parsed.subdomainPolicy}; np=${parsed.nonexistentSubdomainPolicy}; psd=${parsed.tags.psd?.toLowerCase() ?? 'u'}; test=${parsed.testMode ? 'yes' : 'no'}`
-        : state;
-    const time = typeof observation.observedAt === 'string' && observation.observedAt.length <= 64
-        ? normalizeExplicitIsoTimestamp(observation.observedAt) : null;
-    return { owner, parsed, valid, unavailable, record: `Recursive DNS TXT _dmarc.${owner} · ${time ?? 'time unavailable'} · ${description}` };
-}
 /** RFC 9989 sections 4.10–4.10.2; at most eight owners including the exact name. */
 export async function reviewInheritedDmarc(domain, exact, resolve) {
-    requireDomain(domain);
-    const rows = [policyObservation(domain, exact)];
-    const labels = domain.split('.');
-    let next = labels.length >= 8 ? labels.slice(-7) : labels.slice(1);
-    if (!rows[0].valid && !rows[0].unavailable) {
-        while (next.length) {
-            const owner = next.join('.');
-            const row = policyObservation(owner, await resolve(`_dmarc.${owner}`));
-            rows.push(row);
-            if (row.unavailable || (row.valid && ['n', 'y'].includes(row.parsed.tags.psd?.toLowerCase() ?? '')))
-                break;
-            next = next.slice(1);
-        }
-    }
-    const available = rows.filter(row => row.valid);
+    const { rows, available, boundary, incomplete, organisationalDomain } = await walkDmarcTree(domain, exact, resolve, 'policy');
     const explicit = rows[0].valid ? rows[0] : null;
-    const boundary = available.find(row => row.parsed.tags.psd?.toLowerCase() === 'n' || row.parsed.tags.psd?.toLowerCase() === 'y');
-    const organisational = boundary?.parsed.tags.psd?.toLowerCase() === 'y'
-        ? domain.split('.').slice(-(boundary.owner.split('.').length + 1)).join('.')
-        : boundary?.owner ?? available.at(-1)?.owner ?? null;
-    const selected = explicit ?? available.find(row => row.owner === organisational) ?? (boundary?.parsed.tags.psd?.toLowerCase() === 'y' ? boundary : null);
-    const incomplete = rows.some(row => row.unavailable || (!row.valid && row.parsed.records.length === 1));
+    const selected = explicit ?? available.find(row => row.owner === organisationalDomain) ?? (boundary?.psd === 'y' ? boundary : null);
     const summary = incomplete ? 'Inherited policy could not be determined from the collected records.'
         : selected ? `${selected.owner === domain ? 'Exact-name' : 'Inherited'} policy published at _dmarc.${selected.owner}.`
             : 'No applicable DMARC policy was found in the completed tree walk.';
@@ -90,7 +44,7 @@ function nameservers(value) {
     return names.every(name => name.length <= 253 && isValidAsciiHostname(name)) ? [...new Set(names)].sort() : null;
 }
 export async function reviewParentDelegation(domain, recursive, dependencies, signal) {
-    requireDomain(domain);
+    requireDmarcDomain(domain);
     const parsed = parseDomain(domain, { allowPrivateDomains: false });
     const child = parsed.domain;
     const parent = parsed.publicSuffix;
@@ -175,8 +129,8 @@ export async function reviewParentDelegation(domain, recursive, dependencies, si
     }
     return finish();
 }
-export async function collectDnsInheritanceChecks(domain, exact, recursive, options = {}, injected) {
-    requireDomain(domain);
+export async function collectDnsInheritanceReview(domain, exact, recursive, options = {}, injected) {
+    requireDmarcDomain(domain);
     options.signal?.throwIfAborted();
     const timeout = AbortSignal.timeout(REVIEW_TIMEOUT_MS);
     const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
@@ -188,10 +142,13 @@ export async function collectDnsInheritanceChecks(domain, exact, recursive, opti
         resolve4: (name) => resolver.resolve4(name), resolve6: (name) => resolver.resolve6(name),
         exchange: defaultTcpExchange, now: () => new Date(),
     };
-    const resolve = async (owner) => {
+    let questions = 0;
+    const cache = new Map([[`_dmarc.${domain}`, Promise.resolve(exact)]]);
+    const query = async (owner) => {
         signal.throwIfAborted();
         if (owner.length > 253)
             return { records: [], error: 'The DNS question exceeds the name limit.' };
+        questions += 1;
         try {
             return { records: await dependencies.resolveTxt(owner), error: null, observedAt: dependencies.now().toISOString() };
         }
@@ -200,17 +157,50 @@ export async function collectDnsInheritanceChecks(domain, exact, recursive, opti
             return { records: [], error: MISSING.has(String(error?.code)) ? null : 'DNS observation unavailable.', observedAt: dependencies.now().toISOString() };
         }
     };
-    const operations = [reviewInheritedDmarc(domain, exact, resolve), reviewParentDelegation(domain, recursive, dependencies, signal)];
+    const resolve = (owner) => {
+        options.signal?.throwIfAborted();
+        const existing = cache.get(owner);
+        if (existing)
+            return existing;
+        if (questions >= MAX_DMARC_REVIEW_QUERIES)
+            return Promise.resolve({ records: [], error: 'The shared DMARC query budget was reached.' });
+        const pending = query(owner);
+        cache.set(owner, pending);
+        return pending;
+    };
+    const organisations = new Map();
+    const boundaryRecords = new Map();
+    const boundaryResults = new Map();
+    const resolveOrganisationalDomain = (owner) => {
+        const existing = organisations.get(owner);
+        if (existing)
+            return existing;
+        const pending = (async () => {
+            const walk = await walkDmarcTree(owner, await resolve(`_dmarc.${owner}`), resolve, 'organisation');
+            for (const row of walk.rows)
+                if (cache.has(`_dmarc.${row.owner}`))
+                    boundaryRecords.set(row.owner, row.record);
+            boundaryResults.set(owner, `${owner}: organisational domain ${walk.organisationalDomain ?? 'unknown'}.`);
+            return walk.organisationalDomain;
+        })();
+        organisations.set(owner, pending);
+        return pending;
+    };
+    const operations = [
+        reviewInheritedDmarc(domain, exact, resolve),
+        reviewParentDelegation(domain, recursive, dependencies, signal),
+        validateDmarcExternalReporting(domain, exact, resolve, resolveOrganisationalDomain),
+    ];
     try {
-        return await Promise.all(operations);
-    }
-    catch {
+        const [policy, parent, reporting] = await Promise.allSettled(operations);
         options.signal?.throwIfAborted();
-        const settled = await Promise.allSettled(operations);
-        return settled.map((result, index) => result.status === 'fulfilled' ? result.value : check(index === 0 ? 'dmarc_inheritance' : 'parent_delegation', index === 0 ? 'Inherited DMARC policy' : 'Direct parent delegation', 'warning', 'The additional review could not complete.', 'No absence or effective-policy conclusion is available from the incomplete review.', []));
+        const checks = [policy, parent].map((result, index) => result.status === 'fulfilled' ? result.value : check(index === 0 ? 'dmarc_inheritance' : 'parent_delegation', index === 0 ? 'Inherited DMARC policy' : 'Direct parent delegation', 'warning', 'The additional review could not complete.', 'No absence or effective-policy conclusion is available from the incomplete review.', []));
+        const dmarcAuthorizations = reporting.status === 'fulfilled' ? reporting.value : [];
+        if (organisations.size)
+            checks.push(check('dmarc_reporting_boundaries', 'DMARC reporting boundaries', reporting.status === 'rejected' || dmarcAuthorizations.some(item => !['self', 'authorized'].includes(item.state)) ? 'warning' : 'info', 'Reporting destinations were reviewed using DNS-derived organisational boundaries.', `${questions} additional DMARC TXT questions used; the shared limit is ${MAX_DMARC_REVIEW_QUERIES} within ten seconds. Each tree walk examines at most eight owners. Unavailable boundaries remain unknown; a missing optional authorisation record does not establish a configuration error.`, [...boundaryResults.values(), ...boundaryRecords.values()]));
+        return { checks, dmarcAuthorizations };
     }
     finally {
-        await Promise.allSettled(operations);
         signal.removeEventListener('abort', cancel);
         cancel();
     }

package/lib/dns-intelligence.mjs

@@ -1,5 +1,5 @@
 // Bounded DNS evidence for investigative deep scans. This collector keeps
-// authoritative absence distinct from resolver failure, preserves only record
+// resolver-reported negative answers distinct from failures, preserves only record
 // types that aid domain triage, and never treats shared infrastructure as proof
 // of common ownership or maliciousness.
 import { promises as dns } from 'node:dns';
@@ -11,7 +11,8 @@ import { createObservation } from "../packages/evidence/observation.mjs";
 import { MAX_LOOKUP_DNS_RECORDS_PER_TYPE, MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS, } from "./lookup-network-evidence-bounds.mjs";
 import { isPrivateAddress } from "./safe-fetch.mjs";
 import { resolveServiceBindingRecords } from "./service-binding-dns.mjs";
-import { canonicalRegistrableDomain } from "./registrable-domain.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { DNS_QUERY_OUTCOMES, dnsQueryFailureOutcome } from "../packages/evidence/dns-query-outcome.mjs";
 const DNS_TIMEOUT_MS = 5000;
 const MAX_RECORDS_PER_TYPE = MAX_LOOKUP_DNS_RECORDS_PER_TYPE;
 const MAX_PTR_RECORDS = MAX_LOOKUP_REVERSE_DNS_PTR_RECORDS;
@@ -24,7 +25,6 @@ const MAX_SERVICE_ALPN_IDS = 16;
 const MAX_SERVICE_ADDRESS_HINTS = 8;
 const MAX_CAA_TREE_QUERIES = 8;
 const DNS_CONTROL_CHARACTER_RE = /[\u0000-\u001f\u007f]/u;
-const MISSING_CODES = new Set(['ENODATA', 'ENOTFOUND', 'ENONAME']);
 function skippedDnsIntelligence(detail = 'DNS intelligence is disabled by deployment policy.', { includeExtendedContext = false, includeInheritedCaa = false, } = {}) {
     const skipped = { status: 'skipped', error: null, truncated: false, discarded: 0 };
     const recordTypes = ['a', 'aaaa', 'cname', 'ns', 'mx', 'spf', 'dmarc', 'caa'];
@@ -386,7 +386,7 @@ function normalizePtr(records) {
 }
 function withTimeout(factory, timeoutMs) {
     return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => reject(new Error('DNS query timed out')), timeoutMs);
+        const timer = setTimeout(() => reject(Object.assign(new Error('DNS query timed out'), { code: 'ETIMEOUT' })), timeoutMs);
         Promise.resolve().then(factory).then((value) => { clearTimeout(timer); resolve(value); }, (error) => { clearTimeout(timer); reject(error); });
     });
 }
@@ -396,6 +396,7 @@ async function query(factory, normalize, timeoutMs) {
         const unusable = !normalized.records.length && (normalized.truncated || normalized.discarded > 0);
         return {
             status: unusable ? 'error' : normalized.records.length ? 'success' : 'not_found',
+            detail: unusable ? 'invalid_response' : normalized.records.length ? 'records' : 'empty_answer',
             records: normalized.records,
             error: unusable ? 'The returned record family could not be retained completely; absence is unknown.' : null,
             truncated: normalized.truncated,
@@ -403,9 +404,9 @@ async function query(factory, normalize, timeoutMs) {
         };
     }
     catch (error) {
-        if (error && typeof error === 'object' && MISSING_CODES.has(String(error.code)))
-            return { status: 'not_found', records: [], error: null, truncated: false, discarded: 0 };
-        return { status: 'error', records: [], error: boundedError(error), truncated: false, discarded: 0 };
+        const detail = dnsQueryFailureOutcome(error && typeof error === 'object' ? error.code : undefined);
+        const missing = DNS_QUERY_OUTCOMES[detail].status === 'not_found';
+        return { status: missing ? 'not_found' : 'error', detail, records: [], error: missing ? null : boundedError(error), truncated: false, discarded: 0 };
     }
 }
 function completeQuery(result) {
@@ -415,6 +416,7 @@ function observedPresence(result) {
     return result.records.length > 0 ? true : completeQuery(result) ? false : null;
 }
 async function collectEffectiveCaaPolicy(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const normalizedDomain = normalizeHostname(domain);
     const queryLimit = Math.max(1, Math.min(MAX_CAA_TREE_QUERIES, Math.floor(options.queryLimit || MAX_CAA_TREE_QUERIES)));
     const now = options.now || Date.now;
@@ -454,9 +456,11 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const queries = [];
     for (const [index, owner] of owners.entries()) {
+        options.signal?.throwIfAborted();
         const result = index === 0 && options.directResult
             ? options.directResult
             : await query(() => resolver(owner), normalizeCaa, timeoutMs);
+        options.signal?.throwIfAborted();
         queries.push({
             owner,
             status: result.status,
@@ -581,6 +585,7 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     };
 }
 async function collectDnsIntelligence(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const registrationDomain = options.registrationDomain ?? domain;
     if (options.registrationDomain !== undefined && canonicalRegistrableDomain(domain) !== registrationDomain) {
         throw new TypeError('DNS registration context must match the hostname being observed.');
@@ -591,7 +596,10 @@ async function collectDnsIntelligence(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const now = options.now || Date.now;
     const started = now();
-    const invoke = (name, fallback, value = domain) => () => (resolvers[name] || fallback)(value);
+    const invoke = (name, fallback, value = domain) => () => {
+        options.signal?.throwIfAborted();
+        return (resolvers[name] || fallback)(value);
+    };
     const aPromise = query(invoke('resolve4', dns.resolve4), (records) => normalizeAddresses(records, 4), timeoutMs);
     const aaaaPromise = query(invoke('resolve6', dns.resolve6), (records) => normalizeAddresses(records, 6), timeoutMs);
     const cnamePromise = query(invoke('resolveCname', dns.resolveCname), normalizeHostnames, timeoutMs);
@@ -606,6 +614,7 @@ async function collectDnsIntelligence(domain, options = {}) {
             directResult,
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
@@ -613,7 +622,7 @@ async function collectDnsIntelligence(domain, options = {}) {
         ? query(invoke('resolveSoa', dns.resolveSoa), normalizeSoa, timeoutMs)
         : Promise.resolve(null);
     const httpsPromise = includeExtendedContext
-        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs })), normalizeServiceBindings, timeoutMs)
+        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs, ...(options.signal ? { signal: options.signal } : {}) })), normalizeServiceBindings, timeoutMs)
         : Promise.resolve(null);
     const registrationNsPromise = includeExtendedContext && registrationDomain !== domain
         ? query(invoke('resolveNs', dns.resolveNs, registrationDomain), normalizeHostnames, timeoutMs)
@@ -626,10 +635,11 @@ async function collectDnsIntelligence(domain, options = {}) {
             ...(options.queryAuthority ? { queryAuthority: options.queryAuthority } : {}),
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
-    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all([
+    const pending = [
         aPromise,
         aaaaPromise,
         cnamePromise,
@@ -642,7 +652,12 @@ async function collectDnsIntelligence(domain, options = {}) {
         soaPromise,
         httpsPromise,
         delegationPromise,
-    ]);
+    ];
+    // A rejected continuation must not release the lookup while sibling queries
+    // are still running. Their existing bounded resolver deadlines remain active.
+    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all(pending)
+        .finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const queries = {
         a, aaaa, cname, ns, mx, spf, dmarc, caa,
         ...(soa ? { soa } : {}),
@@ -683,6 +698,7 @@ async function collectDnsIntelligence(domain, options = {}) {
             diagnostics: {
                 ...Object.fromEntries(Object.entries(queries).map(([name, item]) => [name, {
                         status: item.status,
+                        detail: item.detail,
                         error: item.error,
                         truncated: item.truncated,
                         discarded: item.discarded,

package/lib/dns-query-coverage.mjs

@@ -0,0 +1,40 @@
+import { exactKeys, requireRecord } from "./bounded-contract-normalizers.mjs";
+const QUERY_KEYS = new Set(['owner', 'type', 'state']);
+/** A positive legacy record proves its own query scope, never another type's absence. */
+export function normaliseDnsQueryCoverage(value, options) {
+    const { label, maximum, state, records } = options;
+    if (options.legacy) {
+        return Object.freeze([...new Map(records.map((record) => [
+                `${record.owner}\u0000${record.type}`,
+                Object.freeze({ owner: record.owner, type: record.type, state }),
+            ])).values()]);
+    }
+    if (!Array.isArray(value) || value.length > maximum)
+        throw new TypeError(`${label} must contain no more than ${maximum} query outcomes.`);
+    const byKey = new Map();
+    for (const [index, raw] of value.entries()) {
+        const path = `${label}[${index}]`;
+        const item = requireRecord(raw, path);
+        exactKeys(item, QUERY_KEYS, path);
+        const owner = options.owner(item.owner, `${path}.owner`);
+        const type = options.type(item.type, `${path}.type`);
+        if (item.state !== 'observed' && item.state !== 'partial' && item.state !== 'unavailable')
+            throw new TypeError(`${path}.state is unsupported.`);
+        if ((state === 'unavailable' && item.state !== 'unavailable') || (state === 'observed' && item.state !== 'observed')) {
+            throw new TypeError(`${path}.state contradicts the snapshot state.`);
+        }
+        const key = `${owner}\u0000${type}`;
+        if (byKey.has(key))
+            throw new TypeError(`${path} duplicates an owner and type.`);
+        byKey.set(key, Object.freeze({ owner, type, state: item.state }));
+    }
+    for (const record of records) {
+        const query = byKey.get(`${record.owner}\u0000${record.type}`);
+        if (!query || query.state === 'unavailable')
+            throw new TypeError(`${label} must declare an observed or partial query for every supplied record.`);
+    }
+    return Object.freeze([...byKey.values()]);
+}
+export function dnsQueryState(queries, owner, type) {
+    return queries.find((query) => query.owner === owner && query.type === type)?.state ?? 'not_queried';
+}

package/lib/domain-assurance.mjs

@@ -243,7 +243,7 @@ function buildRecoveryDependencies(input) {
     };
 }
 const RETIREMENT_CHECKS = Object.freeze([
-    ['autoRenewDisabled', 'Auto-renew is intentionally configured', true],
+    ['autoRenewDisabled', 'Auto-renew is disabled as declared', true],
     ['registrarLockMaintained', 'Registrar lock remains enabled', true],
     ['websiteRetired', 'Web service is retired or intentionally redirected', true],
     ['mailRetired', 'Mail service is retired', true],

package/lib/domain-change-packet.mjs

@@ -5,9 +5,10 @@ import { SORTED_JSON_V2, sha256ArtifactDigestV2 } from "../packages/evidence/art
 export const DOMAIN_CHANGE_PACKET_INPUT_SCHEMA = 'whoisleuth.domain-change-packet.input';
 export const DOMAIN_CHANGE_PACKET_SCHEMA = 'whoisleuth.domain-change-packet';
 export const DOMAIN_CHANGE_PACKET_INPUT_VERSION = 1;
-export const DOMAIN_CHANGE_PACKET_VERSION = 3;
+export const DOMAIN_CHANGE_PACKET_VERSION = 4;
 export const DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS = Object.freeze({
     2: 1,
+    3: 2,
     [DOMAIN_CHANGE_PACKET_VERSION]: DOMAIN_CHANGE_REVIEW_VERSION,
 });
 export const SUPPORTED_DOMAIN_CHANGE_PACKET_VERSIONS = Object.freeze(Object.keys(DOMAIN_CHANGE_PACKET_REVIEW_VERSIONS).map(Number));
@@ -43,16 +44,10 @@ function changeSummary(before, after) {
     const beforeRows = rows(before);
     const afterRows = rows(after);
     const keys = [...new Set([...beforeRows.keys(), ...afterRows.keys()])].sort();
-    const authorityCollectionComplete = (review) => {
-        const representative = review.authoritativeRecordMatrix[0];
-        return Boolean(representative
-            && representative.observations.length >= 2
-            && representative.observations.every((item) => item.state === 'observed'));
-    };
-    const rowEvidence = (review, row) => {
+    const rowEvidence = (row) => {
         if (!row)
             return Object.freeze({
-                state: authorityCollectionComplete(review) ? 'complete' : 'unavailable',
+                state: 'unavailable',
                 values: Object.freeze([]),
             });
         if (row.observations.some((item) => item.state !== 'observed')) {
@@ -68,13 +63,15 @@ function changeSummary(before, after) {
         });
     };
     const changed = [];
+    const reasons = keys.length > 500 ? ['The comparison exceeds 500 owner and record-type pairs.'] : [];
     for (const key of keys.slice(0, 500)) {
         const left = beforeRows.get(key);
         const right = afterRows.get(key);
         const [owner, type] = key.split('\u0000');
-        const beforeEvidence = rowEvidence(before, left);
-        const afterEvidence = rowEvidence(after, right);
+        const beforeEvidence = rowEvidence(left);
+        const afterEvidence = rowEvidence(right);
         if (beforeEvidence.state !== 'complete' || afterEvidence.state !== 'complete') {
+            reasons.push(`Comparison evidence is incomplete for ${owner} ${type}.`);
             continue;
         }
         if (JSON.stringify(beforeEvidence.values) === JSON.stringify(afterEvidence.values))
@@ -86,7 +83,7 @@ function changeSummary(before, after) {
             afterValues: afterEvidence.values,
         }));
     }
-    return Object.freeze(changed);
+    return Object.freeze({ changed: Object.freeze(changed), reasons: Object.freeze(reasons) });
 }
 export async function buildDomainChangePacket(inputRaw, generatedAtValue = new Date().toISOString()) {
     const input = record(inputRaw, 'Domain change packet input');
@@ -107,11 +104,13 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
     const preChange = reviewDomainChange(input.preChange, generatedAt);
     const postChange = reviewDomainChange(input.postChange, generatedAt);
     const assurance = buildDomainAssurance(input.assurance, generatedAt);
+    const comparison = changeSummary(preChange, postChange);
     const assuranceReasons = assurance.result.review.reasons;
     const gateReasons = Object.freeze([
         ...preChange.gate.reasons.map((reason) => `Pre-change evidence: ${reason}`),
         ...postChange.gate.reasons.map((reason) => `Post-change evidence: ${reason}`),
         ...assuranceReasons.map((reason) => `Change plan: ${reason}`),
+        ...comparison.reasons,
     ].slice(0, 100));
     const unsigned = Object.freeze({
         schema: DOMAIN_CHANGE_PACKET_SCHEMA,
@@ -122,7 +121,7 @@ export async function buildDomainChangePacket(inputRaw, generatedAtValue = new D
         state: gateReasons.length ? 'review' : 'ready',
         gate: Object.freeze({ pass: gateReasons.length === 0, reasons: gateReasons }),
         summary: Object.freeze({
-            changedAuthoritativeRecordSets: changeSummary(preChange, postChange),
+            changedAuthoritativeRecordSets: comparison.changed,
             preChangeState: preChange.state,
             postChangeState: postChange.state,
             assuranceState: assurance.result.review.state,