@slicedearth/whoisleuth-cli 2.5.1 → 2.7.0

package/lib/dns-delegation-health.mjs

@@ -99,15 +99,19 @@ function withTimeout(promise, timeoutMs) {
     });
 }
 async function defaultAuthorityQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const [nameservers, soa] = await Promise.allSettled([
         resolver.resolveNs(input.domain),
         resolver.resolveSoa(input.domain),
-    ]);
+    ]).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
     const reason = nameservers.status === 'rejected'
         ? nameservers.reason
         : soa.status === 'rejected'
@@ -188,18 +192,21 @@ function normaliseAuthorityValues(type, value) {
     return normaliseAuthorityValueSet(type, value).values;
 }
 async function defaultAuthorityRecordQuery(input) {
+    input.signal?.throwIfAborted();
     const resolver = new dns.Resolver({
         timeout: Math.max(250, Math.min(input.timeoutMs, DNS_DELEGATION_TIMEOUT_MS)),
         tries: 1,
     });
     resolver.setServers([net.isIP(input.address) === 6 ? `[${input.address}]:53` : input.address]);
+    const cancelled = () => resolver.cancel();
+    input.signal?.addEventListener('abort', cancelled, { once: true });
     const queries = [
         ['A', resolver.resolve4(input.domain)],
         ['AAAA', resolver.resolve6(input.domain)],
         ['CAA', resolver.resolveCaa(input.domain)],
         ['MX', resolver.resolveMx(input.domain)],
     ];
-    return Promise.all(queries.map(async ([type, promise]) => {
+    const result = await Promise.all(queries.map(async ([type, promise]) => {
         try {
             const response = await withTimeout(promise, input.timeoutMs);
             const normalised = normaliseAuthorityValueSet(type, response);
@@ -224,7 +231,9 @@ async function defaultAuthorityRecordQuery(input) {
                 discarded: 0,
             };
         }
-    }));
+    })).finally(() => { input.signal?.removeEventListener('abort', cancelled); resolver.cancel(); });
+    input.signal?.throwIfAborted();
+    return result;
 }
 function authorityRecordMatrix(authorities) {
     const types = ['A', 'AAAA', 'CAA', 'MX'];
@@ -318,6 +327,7 @@ function skippedDnsDelegationHealth(detail = 'Authoritative delegation checks we
     };
 }
 async function collectDnsDelegationHealth(domainValue, parentQueryValue, options = {}) {
+    options.signal?.throwIfAborted();
     const domain = hostname(domainValue);
     if (!domain)
         return skippedDnsDelegationHealth('The domain was not eligible for authoritative delegation checks.');
@@ -338,7 +348,8 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
     const timeoutMs = Math.max(250, Math.min(5000, Number(options.timeoutMs) || DNS_DELEGATION_TIMEOUT_MS));
     const now = options.now || Date.now;
     const started = now();
-    const authorities = await Promise.all(candidates.map(async (nameserver) => {
+    const pending = candidates.map(async (nameserver) => {
+        options.signal?.throwIfAborted();
         const glue = registry.nameserverDetails.find((item) => item.name === nameserver)?.addresses ?? [];
         const resolved = glue.length
             ? glue
@@ -350,10 +361,11 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 : [])
                 .map(publicAddress)
                 .filter((address) => address !== null);
+        options.signal?.throwIfAborted();
         const addresses = [...new Set(resolved)].slice(0, MAX_AUTHORITY_ADDRESSES);
         const attempts = await Promise.all(addresses.map(async (address) => {
             try {
-                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs }), timeoutMs);
+                const raw = await withTimeout(queryAuthority({ domain, nameserver, address, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs);
                 const query = record(raw);
                 const code = boundedText(query.errorCode, 40);
                 const error = boundedText(query.error, MAX_ERROR_LENGTH);
@@ -384,6 +396,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 };
             }
         }));
+        options.signal?.throwIfAborted();
         const successful = attempts.find((attempt) => attempt.state === 'success');
         const partial = attempts.find((attempt) => attempt.state === 'partial');
         const retained = successful ?? partial;
@@ -391,7 +404,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
         const recordAddress = retained?.address ?? addresses[0];
         if (queryAuthorityRecords && recordAddress) {
             try {
-                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs }), timeoutMs))
+                recordSets = (await withTimeout(queryAuthorityRecords({ domain, nameserver, address: recordAddress, timeoutMs, ...(options.signal ? { signal: options.signal } : {}) }), timeoutMs))
                     .filter((item) => ['A', 'AAAA', 'CAA', 'MX'].includes(item.type))
                     .slice(0, 4)
                     .map((item) => {
@@ -428,6 +441,7 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
                 }));
             }
         }
+        options.signal?.throwIfAborted();
         return {
             nameserver,
             addressSource: glue.length ? 'registry_glue' : 'recursive_address',
@@ -445,7 +459,9 @@ async function collectDnsDelegationHealth(domainValue, parentQueryValue, options
             recordSets,
             attempts,
         };
-    }));
+    });
+    const authorities = await Promise.all(pending).finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const successfulAuthorities = authorities.filter((authority) => authority.state === 'success');
     const partialAuthorities = authorities.filter((authority) => authority.state === 'partial');
     const lameAuthorities = authorities.filter((authority) => authority.state === 'lame');

package/lib/dns-inheritance-review.mjs

@@ -5,6 +5,7 @@ import { requireDmarcDomain, walkDmarcTree } from "./dmarc-discovery.mjs";
 import { buildDnssecQuery, DNS_TYPE_NS, normalizeResolverEndpoint, parseDnssecResponse } from "./dnssec-chain-validation.mjs";
 import { defaultTcpExchange } from "./service-binding-dns.mjs";
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
+import { normalizeDmarcPolicyContext } from "../packages/evidence/dmarc-policy-context.mjs";
 const MAX_PARENT_SERVERS = 2;
 const MAX_NS = 16;
 const QUERY_TIMEOUT_MS = 2200;
@@ -35,7 +36,19 @@ export async function reviewInheritedDmarc(domain, exact, resolve) {
             ? `Published policy: ${selected.parsed.policy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}.`
             : `For an existing name: ${selected.parsed.subdomainPolicy}. For a nonexistent name: ${selected.parsed.nonexistentSubdomainPolicy}. Test mode: ${selected.parsed.testMode ? 'yes' : 'no'}. Name existence is not inferred from this review.`
         : 'Invalid or unavailable records do not establish absence or a usable inherited policy.';
-    return check('dmarc_inheritance', 'Inherited DMARC policy', incomplete || !selected ? 'warning' : 'info', summary, `${detail} Discovery follows RFC 9989 with at most eight owners. This is publication evidence, not message authentication or a guarantee of receiver behaviour.`, rows.map(row => row.record));
+    const effective = !incomplete ? selected : null;
+    return {
+        ...check('dmarc_inheritance', 'Inherited DMARC policy', incomplete || !selected ? 'warning' : 'info', summary, `${detail} Discovery follows RFC 9989 with at most eight owners. This is publication evidence, not message authentication or a guarantee of receiver behaviour.`, rows.map(row => row.record)),
+        dmarcPolicyContext: normalizeDmarcPolicyContext({
+            version: 1, source: 'recursive_dns_txt', complete: !incomplete,
+            relation: effective ? effective.owner === domain ? 'exact' : 'inherited' : 'undetermined',
+            owner: effective?.owner ?? null, observedAt: effective?.observedAt ?? null,
+            policy: effective?.parsed.policy ?? null, subdomainPolicy: effective?.parsed.subdomainPolicy ?? null,
+            nonexistentPolicy: effective?.parsed.nonexistentSubdomainPolicy ?? null,
+            psd: effective?.psd ?? null, testMode: effective?.parsed.testMode ?? null,
+            discovery: rows.map(row => ({ owner: row.owner, state: row.state, observedAt: row.observedAt })),
+        }, domain),
+    };
 }
 function nameservers(value) {
     if (!Array.isArray(value) || value.length > MAX_NS)

package/lib/dns-intelligence.mjs

@@ -416,6 +416,7 @@ function observedPresence(result) {
     return result.records.length > 0 ? true : completeQuery(result) ? false : null;
 }
 async function collectEffectiveCaaPolicy(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const normalizedDomain = normalizeHostname(domain);
     const queryLimit = Math.max(1, Math.min(MAX_CAA_TREE_QUERIES, Math.floor(options.queryLimit || MAX_CAA_TREE_QUERIES)));
     const now = options.now || Date.now;
@@ -455,9 +456,11 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const queries = [];
     for (const [index, owner] of owners.entries()) {
+        options.signal?.throwIfAborted();
         const result = index === 0 && options.directResult
             ? options.directResult
             : await query(() => resolver(owner), normalizeCaa, timeoutMs);
+        options.signal?.throwIfAborted();
         queries.push({
             owner,
             status: result.status,
@@ -582,6 +585,7 @@ async function collectEffectiveCaaPolicy(domain, options = {}) {
     };
 }
 async function collectDnsIntelligence(domain, options = {}) {
+    options.signal?.throwIfAborted();
     const registrationDomain = options.registrationDomain ?? domain;
     if (options.registrationDomain !== undefined && canonicalRegistrableDomain(domain) !== registrationDomain) {
         throw new TypeError('DNS registration context must match the hostname being observed.');
@@ -592,7 +596,10 @@ async function collectDnsIntelligence(domain, options = {}) {
     const timeoutMs = options.timeoutMs || DNS_TIMEOUT_MS;
     const now = options.now || Date.now;
     const started = now();
-    const invoke = (name, fallback, value = domain) => () => (resolvers[name] || fallback)(value);
+    const invoke = (name, fallback, value = domain) => () => {
+        options.signal?.throwIfAborted();
+        return (resolvers[name] || fallback)(value);
+    };
     const aPromise = query(invoke('resolve4', dns.resolve4), (records) => normalizeAddresses(records, 4), timeoutMs);
     const aaaaPromise = query(invoke('resolve6', dns.resolve6), (records) => normalizeAddresses(records, 6), timeoutMs);
     const cnamePromise = query(invoke('resolveCname', dns.resolveCname), normalizeHostnames, timeoutMs);
@@ -607,6 +614,7 @@ async function collectDnsIntelligence(domain, options = {}) {
             directResult,
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
@@ -614,7 +622,7 @@ async function collectDnsIntelligence(domain, options = {}) {
         ? query(invoke('resolveSoa', dns.resolveSoa), normalizeSoa, timeoutMs)
         : Promise.resolve(null);
     const httpsPromise = includeExtendedContext
-        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs })), normalizeServiceBindings, timeoutMs)
+        ? query(invoke('resolveHttps', (value) => resolveServiceBindingRecords(value, 'HTTPS', { timeoutMs, ...(options.signal ? { signal: options.signal } : {}) })), normalizeServiceBindings, timeoutMs)
         : Promise.resolve(null);
     const registrationNsPromise = includeExtendedContext && registrationDomain !== domain
         ? query(invoke('resolveNs', dns.resolveNs, registrationDomain), normalizeHostnames, timeoutMs)
@@ -627,10 +635,11 @@ async function collectDnsIntelligence(domain, options = {}) {
             ...(options.queryAuthority ? { queryAuthority: options.queryAuthority } : {}),
             timeoutMs,
             now,
+            ...(options.signal ? { signal: options.signal } : {}),
             ...(options.observedAt ? { observedAt: options.observedAt } : {}),
         }))
         : Promise.resolve(null);
-    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all([
+    const pending = [
         aPromise,
         aaaaPromise,
         cnamePromise,
@@ -643,7 +652,12 @@ async function collectDnsIntelligence(domain, options = {}) {
         soaPromise,
         httpsPromise,
         delegationPromise,
-    ]);
+    ];
+    // A rejected continuation must not release the lookup while sibling queries
+    // are still running. Their existing bounded resolver deadlines remain active.
+    const [a, aaaa, cname, ns, mx, spf, dmarc, caa, caaPolicy, soa, https, delegation] = await Promise.all(pending)
+        .finally(() => Promise.allSettled(pending));
+    options.signal?.throwIfAborted();
     const queries = {
         a, aaaa, cname, ns, mx, spf, dmarc, caa,
         ...(soa ? { soa } : {}),

package/lib/domain-posture-analysis.mjs

@@ -4,6 +4,48 @@
 import { parse as parseDomain } from 'tldts';
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { parseDmarcRecords, parseDmarcReportingAuthorization, parseReportingDestination, parseSpfRecords } from "./domain-posture-parsers.mjs";
+const SPF_PERMISSIVE_PATH_ISSUE = 'Observed permissive +all evidence on a potentially reachable positive SPF include or redirect path; review sender authorisation.';
+// This is a conservative universal-result check for unconditional all/include
+// chains, not a sender evaluator. Conditional mechanisms remain unknown.
+function spfStaticResult(policy) {
+    const parsed = policy.parsed;
+    if (!parsed?.valid)
+        return { everySender: null, permissive: false };
+    let uncertain = false, permissive = false;
+    const finish = (result) => ({
+        everySender: !uncertain ? result : null,
+        permissive,
+    });
+    for (const mechanism of parsed.mechanisms) {
+        if (mechanism.kind === 'all') {
+            if (mechanism.qualifier === '+')
+                permissive = true;
+            return finish(mechanism.qualifier);
+        }
+        if (mechanism.kind === 'include') {
+            const child = policy.children.get(mechanism.includeIndex);
+            const result = child ? spfStaticResult(child) : { everySender: null, permissive: false };
+            if (mechanism.qualifier === '+' && result.permissive)
+                permissive = true;
+            if (result.everySender === '+')
+                return finish(mechanism.qualifier);
+            if (result.everySender !== null)
+                continue; // Only child pass matches include.
+            uncertain = true;
+        }
+        else {
+            // Without sender evaluation, even a literal mechanism remains conditional.
+            uncertain = true;
+        }
+    }
+    if (parsed.redirect) {
+        const child = policy.children.get(parsed.includes.length);
+        const result = child ? spfStaticResult(child) : { everySender: null, permissive: false };
+        permissive ||= result.permissive;
+        return result.everySender === null ? { everySender: null, permissive } : finish(result.everySender);
+    }
+    return { everySender: null, permissive };
+}
 const SPF_LOOKUP_LIMIT = 10;
 const SPF_VOID_LOOKUP_LIMIT = 2;
 const SPF_MAX_DEPTH = 5;
@@ -41,6 +83,7 @@ function branchFor(item, state, terminalPolicy, dnsLookupTerms, issues) {
     };
 }
 async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
+    const rootPolicy = { parsed: null, children: new Map() };
     const queue = [{
             domain: rootDomain,
             parent: null,
@@ -49,6 +92,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             path: [rootDomain],
             records: rootQuery.records,
             error: rootQuery.error,
+            policy: rootPolicy,
         }];
     const branches = [];
     const issues = [];
@@ -100,6 +144,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
         branches.push(branchFor(item, parsed.valid ? 'success' : 'invalid', parsed.terminalPolicy, parsed.dnsLookupTerms, parsed.issues));
         if (!parsed.valid)
             continue;
+        item.policy.parsed = parsed;
         if (dnsLookupTerms > SPF_LOOKUP_LIMIT) {
             boundReached = true;
             issues.push(`The expanded policy declares more than ${SPF_LOOKUP_LIMIT} DNS-querying terms.`);
@@ -111,7 +156,9 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             ...parsed.includes.map((domain) => ({ relation: 'include', domain })),
             ...(parsed.redirect ? [{ relation: 'redirect', domain: parsed.redirect }] : []),
         ];
-        for (const dependency of dependencies) {
+        for (const [dependencyIndex, dependency] of dependencies.entries()) {
+            const policy = { parsed: null, children: new Map() };
+            item.policy.children.set(dependencyIndex, policy);
             const normalized = strictHostname(dependency.domain);
             if (!normalized) {
                 branches.push(branchFor({
@@ -120,6 +167,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
                     relation: dependency.relation,
                     depth: item.depth + 1,
                     path: item.path,
+                    policy,
                 }, 'invalid', null, 0, ['The SPF dependency is not a literal public hostname; macros are not expanded by this audit.']));
                 continue;
             }
@@ -129,6 +177,7 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
                 relation: dependency.relation,
                 depth: item.depth + 1,
                 path: [...item.path, normalized],
+                policy,
             });
         }
     }
@@ -145,6 +194,8 @@ async function expandSpfPolicy(rootDomain, rootQuery, resolveTxt) {
             : incomplete
                 ? 'partial'
                 : 'complete';
+    if (rootPolicy.parsed?.terminalPolicy !== 'pass' && spfStaticResult(rootPolicy).permissive)
+        issues.unshift(SPF_PERMISSIVE_PATH_ISSUE);
     return {
         version: 1,
         state,
@@ -293,4 +344,4 @@ function buildExternalDependencies({ domain, nameservers, mx, spfExpansion, dmar
         || left.target.localeCompare(right.target)
         || left.source.localeCompare(right.source)));
 }
-export { SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };
+export { SPF_PERMISSIVE_PATH_ISSUE, SPF_LOOKUP_LIMIT, SPF_MAX_DEPTH, SPF_VOID_LOOKUP_LIMIT, buildExternalDependencies, expandSpfPolicy, reportDestinationDomain, validateDmarcExternalReporting, };

package/lib/domain-posture-parsers.mjs

@@ -48,6 +48,7 @@ function parseSpfRecords(records) {
         terminalPolicy: null,
         redirect: null,
         includes: [],
+        mechanisms: [],
         authorizingTerms: [],
         dnsLookupTerms: 0,
         issues: [],
@@ -175,6 +176,14 @@ function parseSpfRecords(records) {
     result.includes = terms
         .map((term) => term.match(/^[+?~-]?include:(.+)$/i)?.[1] || '')
         .filter(Boolean);
+    let includeIndex = 0;
+    result.mechanisms = terms.filter(term => !/^[+?~-]?[a-z][a-z0-9_.-]*=/iu.test(term)).map(term => {
+        const qualifier = (/^[+?~-]/u.test(term) ? term[0] : '+');
+        const body = /^[+?~-]/u.test(term) ? term.slice(1) : term;
+        const include = body.match(/^include:(.+)$/iu);
+        return { kind: /^all$/iu.test(body) ? 'all' : include ? 'include' : 'other', qualifier,
+            includeIndex: include ? includeIndex++ : null };
+    });
     if (terms.some((term) => /^[+?~-]?ptr(?::|$)/i.test(term))) {
         result.issues.push('The deprecated ptr mechanism should not be used.');
     }

package/lib/domain-posture.mjs

@@ -12,7 +12,7 @@ import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.
 import { DOMAIN_POSTURE_COMPARISON_VERSION, MAX_POSTURE_CHECK_RECORDS, POSTURE_CHECK_SOURCES } from "../packages/evidence/domain-posture-context.mjs";
 import { canonicalPostureRecords } from "../packages/evidence/domain-control-runtime.mjs";
 import { parseSpfRecords, parseDmarcRecords, parseMtaStsDnsRecords, parseMtaStsPolicy, parseTlsRptRecords, parseBimiRecords, parseDkimRecords, } from "./domain-posture-parsers.mjs";
-import { buildExternalDependencies, expandSpfPolicy, validateDmarcExternalReporting, } from "./domain-posture-analysis.mjs";
+import { SPF_PERMISSIVE_PATH_ISSUE, buildExternalDependencies, expandSpfPolicy, validateDmarcExternalReporting, } from "./domain-posture-analysis.mjs";
 const DNS_TIMEOUT_MS = 6000;
 const POLICY_TIMEOUT_MS = 7000;
 const MAX_POLICY_BYTES = 64 * 1024;
@@ -156,7 +156,8 @@ function spfCheck(query, expansion) {
             remediation: 'Replace +all with an explicit sender allowlist and a restrictive terminal policy.',
         });
     }
-    if (parsed.terminalPolicy === 'fail' && parsed.issues.length === 0 && (!expansion || expansion.state === 'complete')) {
+    const permissiveExpansion = expansion?.issues.includes(SPF_PERMISSIVE_PATH_ISSUE) ?? false;
+    if (parsed.terminalPolicy === 'fail' && parsed.issues.length === 0 && !permissiveExpansion && (!expansion || expansion.state === 'complete')) {
         return check('spf', 'SPF', 'pass', 'Restrictive fail-all policy', { detail: details.join(' '), records: parsed.records });
     }
     if (expansion && expansion.state !== 'complete') {
@@ -166,6 +167,12 @@ function spfCheck(query, expansion) {
             remediation: 'Review unresolved, invalid, cyclic, or budget-limited include and redirect branches before treating the policy as complete.',
         });
     }
+    if (permissiveExpansion) {
+        return check('spf', 'SPF', 'warning', 'SPF authorisation needs review', {
+            detail: details.join(' '), records: parsed.records,
+            remediation: 'Review the positive include or redirect path containing +all; complete collection does not establish restrictive sender authorisation.',
+        });
+    }
     if (parsed.terminalPolicy === 'redirect') {
         return check('spf', 'SPF', 'info', 'Policy delegates evaluation with redirect', {
             detail: details.join(' '), records: parsed.records,
@@ -301,6 +308,11 @@ function dnssecDelegationConsistencyCheck(input, registry) {
     }
     const value = String(input.value || '').toLowerCase();
     const hasDsRecords = registry.dsRecordCount > 0;
+    if (registry.dsDataTruncated) {
+        return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Retained DS evidence is incomplete', {
+            detail: 'The normalised registry response reported truncated DS data, so delegation consistency is inconclusive.',
+        });
+    }
     if (value === 'signed' && hasDsRecords) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'pass', 'Signed state and retained DS records agree', {
             detail: `${registry.dsRecordCount} registry DS record${registry.dsRecordCount === 1 ? '' : 's'} retained.`,
@@ -311,11 +323,6 @@ function dnssecDelegationConsistencyCheck(input, registry) {
             detail: 'This is a consistency result, not a recommendation to leave DNSSEC disabled.',
         });
     }
-    if (registry.dsDataTruncated) {
-        return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'info', 'Retained DS evidence is incomplete', {
-            detail: 'The normalised registry response reported truncated DS data, so apparent disagreement is inconclusive.',
-        });
-    }
     if (value === 'signed' && !hasDsRecords) {
         return check('dnssec_delegation_consistency', 'DNSSEC delegation consistency', 'warning', 'Signed state reported without retained DS records', {
             detail: 'This can reflect registry publication differences or incomplete upstream data and should be reviewed before changing delegation.',
@@ -360,13 +367,25 @@ function matchesMtaPattern(host, pattern) {
     }
     return normalizedHost === normalizedPattern;
 }
+function mailPolicyApplicability(mxQuery) {
+    if (mxQuery.error)
+        return { hasMx: false, detail: 'Receiving-mail applicability is unknown because the MX lookup failed.' };
+    const records = completeMxRecords(mxQuery.records);
+    if (!records)
+        return { hasMx: false, detail: 'Receiving-mail applicability is unknown because the MX evidence is incomplete.' };
+    const { hasMx, hasNullMx } = classifyMxRecords(records);
+    return { hasMx, detail: hasMx ? '' : hasNullMx
+            ? 'Null MX explicitly declares that this domain does not accept inbound mail.'
+            : 'No MX records were observed. This alone does not establish that the domain cannot receive mail.' };
+}
 function mtaStsCheck(dnsQuery, policyFetch, mxQuery) {
     if (dnsQuery.error)
         return queryFailureCheck('mta_sts', 'MTA-STS', dnsQuery.error);
     const dnsPolicy = parseMtaStsDnsRecords(dnsQuery.records);
-    const hasMx = !mxQuery.error && classifyMxRecords(asMxRecords(mxQuery.records)).hasMx;
     if (dnsPolicy.records.length === 0) {
+        const { hasMx, detail } = mailPolicyApplicability(mxQuery);
         return check('mta_sts', 'MTA-STS', hasMx ? 'warning' : 'info', 'No MTA-STS policy advertised', {
+            detail,
             remediation: hasMx ? 'Publish _mta-sts and serve a valid policy over HTTPS to require authenticated TLS for inbound mail.' : '',
         });
     }
@@ -436,9 +455,9 @@ function tlsRptCheck(query, mxQuery) {
         return queryFailureCheck('tls_rpt', 'TLS-RPT', query.error);
     const parsed = parseTlsRptRecords(query.records);
     if (parsed.records.length === 0) {
-        const hasMx = !mxQuery.error && classifyMxRecords(asMxRecords(mxQuery.records)).hasMx;
+        const { hasMx, detail } = mailPolicyApplicability(mxQuery);
         return check('tls_rpt', 'TLS-RPT', hasMx ? 'warning' : 'info', 'No SMTP TLS reporting policy', {
-            detail: hasMx ? '' : 'The domain has no receiving mail exchanger, so SMTP TLS reporting is not currently actionable.',
+            detail,
             remediation: hasMx ? 'Publish a v=TLSRPTv1 record at _smtp._tls with a monitored rua destination.' : '',
         });
     }

package/lib/evidence-export-privacy.mjs

@@ -13,7 +13,7 @@ const PUBLIC_LOOKUP_AVAILABILITY_ANALYSIS_KEYS = new Set([
     'expiresInDays', 'privacyProtected', 'dnssec', 'activityStatus',
     'websiteProbeStatus', 'websiteProbeDetail', 'http', 'deepScanComplete',
     'faviconHash', 'faviconPHash', 'pageTitle', 'hasPasswordField',
-    'phishingLanguageMatch', 'hasExternalFormAction', 'externalAssetHosts',
+    'phishingLanguageMatch', 'hasExternalFormAction', 'hasExternalPasswordForm', 'externalAssetHosts',
     'pageIdentity', 'credentialSurfaceProfile', 'structuredDataIdentity',
     'technologyProfile', 'pageRoleProfile', 'clientBehaviorProfile',
     'securityPosture', 'dns', 'tls', 'hasMx', 'hasNullMx', 'mxHosts', 'hasSpf',
@@ -105,6 +105,7 @@ const LOOKUP_AVAILABILITY_PORTABLE_NESTED_KEYS = new Set([
     // Credential, structured identity, role, behaviour, technology, and posture
     // projections. Only fixed categories/counts and bounded descriptions enter.
     'credentialSurfaceVersion', 'methods', 'actions', 'missing', 'get', 'post',
+    'formAttribution', 'unassociatedInputs', 'index', 'destinations', 'relationship', 'origin',
     'dialog', 'other', 'sameOrigin', 'external', 'cleartext', 'unclassified',
     'inputs', 'classifiedCount', 'categories', 'password', 'email', 'username',
     'one_time_code', 'payment', 'inputsObserved', 'classifiedInputs',
@@ -322,6 +323,8 @@ function projectLookupEvidenceAvailabilityValue(value, path, state, depth, legac
         return value;
     if (typeof value === 'string') {
         const normalizedParent = normalizedEvidenceKey(path.at(-1) || '');
+        if (path.join('.') === 'credentialSurfaceProfile.formAttribution.forms.destinations.origin')
+            return portableOrigin(value);
         if (PORTABLE_URL_KEYS.has(normalizedParent))
             return portableUri(value, legacyUris);
         if (PORTABLE_ORIGIN_COLLECTION_KEYS.has(normalizedParent))
@@ -344,7 +347,7 @@ function projectLookupEvidenceAvailabilityValue(value, path, state, depth, legac
         const boundedCount = Number.isSafeInteger(item)
             && Number(item) >= 0
             && Number(item) <= LOOKUP_EVIDENCE_PORTABLE_MAX_ARRAY_ITEMS;
-        const credentialCategoryCount = parentPath === 'credentialSurfaceProfile.inputs.categories'
+        const credentialCategoryCount = ['credentialSurfaceProfile.inputs.categories', 'credentialSurfaceProfile.formAttribution.forms.categories'].includes(parentPath)
             && boundedCount;
         const sanClassCount = parentPath === 'tls.certificate.subjectAltNames.classes'
             && LOOKUP_AVAILABILITY_TLS_SAN_CLASS_KEYS.has(key)

package/lib/evidence-export.mjs

@@ -6,7 +6,7 @@ import { buildRegistryInsights } from "./registry-insights.mjs";
 import { buildPortableGeneratorMetadata } from "../packages/analysis/portable-generator.mjs";
 import { assertBoundedJsonStructure } from "../packages/analysis/bounded-json.mjs";
 import { normalizeExplicitIsoTimestamp } from "../packages/evidence/observation.mjs";
-import { LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, } from "../packages/contracts/lookup-evidence.mjs";
+import { LOOKUP_EVIDENCE_SCHEMA, LOOKUP_EVIDENCE_SCHEMA_VERSION, AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION, } from "../packages/contracts/lookup-evidence.mjs";
 export * from "../packages/contracts/lookup-evidence.mjs";
 import { isValidAsciiHostname } from "../packages/contracts/domain-name.mjs";
 import { validLookupObservationScope } from "../packages/evidence/lookup-target.mjs";
@@ -705,6 +705,7 @@ const LOOKUP_WHOIS_PORTABLE_SCALARS = Object.freeze({
     failedHop: nullableText(253),
     conflictingHop: nullableText(253),
 });
+const WHOIS_REGISTRATION_STATUS = enumeration(new Set(['registered', 'not_found', 'inconclusive']));
 const LOOKUP_REGISTRY_INSIGHT_PORTABLE_KEYS = new Set([
     'version', 'contactDisclosure', 'lifecycle', 'reconciliation', 'publications',
     'rdapCapabilities',
@@ -815,11 +816,16 @@ export function projectLookupEvidenceRdapPublication(value) {
     return output;
 }
 /** Positive portable projection for normalized WHOIS publication fields. */
-export function projectLookupEvidenceWhoisPublication(value) {
+export function projectLookupEvidenceWhoisPublication(value, schemaVersion = LOOKUP_EVIDENCE_SCHEMA_VERSION) {
     const input = recordOrNull(value);
     if (!input)
         return null;
     const output = projectedKnownScalarRecord(input, LOOKUP_WHOIS_PORTABLE_SCALARS) || {};
+    if (schemaVersion >= AUTHORITY_AWARE_LOOKUP_EVIDENCE_SCHEMA_VERSION && Object.hasOwn(input, 'registrationStatus')) {
+        const status = WHOIS_REGISTRATION_STATUS(input.registrationStatus);
+        if (status !== undefined)
+            output.registrationStatus = status;
+    }
     if (Object.hasOwn(input, 'lifecycle')) {
         output.lifecycle = projectedKnownScalarRecord(input.lifecycle, LOOKUP_RDAP_LIFECYCLE_SCALARS);
     }
@@ -884,7 +890,7 @@ function projectedWhoisChainHop(value) {
     };
 }
 /** Exact positive projection for one current-schema WHOIS source wrapper. */
-export function projectLookupEvidenceWhoisSourcePublication(value) {
+export function projectLookupEvidenceWhoisSourcePublication(value, schemaVersion = LOOKUP_EVIDENCE_SCHEMA_VERSION) {
     const source = recordOrNull(value);
     if (!source)
         return null;
@@ -895,7 +901,7 @@ export function projectLookupEvidenceWhoisSourcePublication(value) {
             error: boundedSourceError(source.error, 'WHOIS source reported an error.'),
         };
     const hasPublication = status === 'complete' || status === 'partial';
-    const parsed = hasPublication ? projectLookupEvidenceWhoisPublication(source.parsed) : null;
+    const parsed = hasPublication ? projectLookupEvidenceWhoisPublication(source.parsed, schemaVersion) : null;
     if (status === 'complete' && parsed === null)
         return null;
     return {

package/lib/evidence-report.mjs

@@ -1,4 +1,5 @@
 import { registryAccessProfileLabel } from "./registry-access.mjs";
+import { isSupportedRegistryInsightsVersion } from "../packages/contracts/registry-insights.mjs";
 import { dnsAddressFamilyEvidence } from "../packages/evidence/dns-query-outcome.mjs";
 import { buildPortableGeneratorMetadata, portableGeneratorAttribution, } from "../packages/analysis/portable-generator.mjs";
 import { technologyEvidenceRoles, } from "./technology-evidence-role.mjs";
@@ -267,6 +268,7 @@ function buildLookupEvidenceReport(document, options = {}) {
                 reportField('Redirects', http.redirectCount),
                 reportField('Page title', availability.pageTitle),
                 reportField('Password field observed', yesNoUnknown(availability.hasPasswordField)),
+                reportField('Password form declares external destination', yesNoUnknown(availability.hasExternalPasswordForm)),
                 reportField('Authoritative nameserver evidence', listText(availability.nameservers)),
                 reportField('Observed edge, CDN, reverse proxy or WAF', reportTechnologyNames(technologyFindings, 'observed_edge')),
                 reportField('Application-platform indicators', reportTechnologyNames(technologyFindings, 'application_platform')),
@@ -385,7 +387,7 @@ function buildLookupEvidenceReport(document, options = {}) {
             reportField('Standing limitations', listText(registrarStanding.limitations)),
             reportField('Review steps', listText(registrarStanding.nextActions)),
         ] : [],
-        registryInterpretation: registryInsights.version === 1 ? [
+        registryInterpretation: isSupportedRegistryInsightsVersion(registryInsights.version) ? [
             reportField('Lifecycle', displayLabel(registryLifecycle.label)),
             reportField('Raw lifecycle statuses', listText(registryLifecycle.rawStatuses)),
             reportField('Client registration lock observed', yesNoUnknown(registryLocks.client)),

package/lib/favicon.mjs

@@ -146,13 +146,18 @@ function isFaviconImage(bytes) {
 }
 // Returns the favicon bytes for one candidate URL (a real fetch, or an inline
 // data: decode), or null if it can't be retrieved/used.
-async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
+async function fetchFaviconBytes(url, headers, fetcher, timeoutMs, signal) {
+    signal?.throwIfAborted();
     if (/^data:/i.test(url))
         return decodeDataUri(url);
     const controller = new AbortController();
     const timeout = setTimeout(() => controller.abort(), timeoutMs);
     try {
-        const res = await fetcher(url, { signal: controller.signal, headers });
+        const res = await fetcher(url, { signal: signal ? AbortSignal.any([signal, controller.signal]) : controller.signal, headers });
+        if (signal?.aborted) {
+            await res.body?.cancel().catch(() => { });
+            signal.throwIfAborted();
+        }
         if (!res.ok) {
             // Not reading this body - release it explicitly instead of leaving an
             // unconsumed stream (and the connection it's tied to) open until
@@ -165,10 +170,12 @@ async function fetchFaviconBytes(url, headers, fetcher, timeoutMs) {
         // headers immediately and then trickle or stall the body forever, hanging
         // this worker with no deadline once disarmed.
         const { bytes, truncated } = await readBytesCapped(res, MAX_FAVICON_BYTES);
+        signal?.throwIfAborted();
         // A truncated or empty file can't be hashed meaningfully.
         return truncated || bytes.length === 0 ? null : bytes;
     }
     catch {
+        signal?.throwIfAborted();
         return null;
     }
     finally {
@@ -196,7 +203,8 @@ function buildFaviconCandidates(domain, html = '', options = {}) {
     add(`http://${domain}/favicon.svg`);
     return candidates.slice(0, MAX_FAVICON_CANDIDATES);
 }
-async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS } = {}) {
+async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetcher = safeFetch, timeoutMs = FAVICON_FETCH_TIMEOUT_MS, signal } = {}) {
+    signal?.throwIfAborted();
     const headers = whoisleuthRequestHeaders();
     const candidates = buildFaviconCandidates(domain, html, {
         ...(baseUrl !== undefined ? { baseUrl } : {}),
@@ -207,7 +215,8 @@ async function fetchFaviconHash(domain, { html = '', baseUrl, htmlAnalysis, fetc
         : FAVICON_FETCH_TIMEOUT_MS;
     for (const url of candidates) {
         // eslint-disable-next-line no-await-in-loop
-        const bytes = await fetchFaviconBytes(url, headers, fetcher, requestTimeoutMs);
+        const bytes = await fetchFaviconBytes(url, headers, fetcher, requestTimeoutMs, signal);
+        signal?.throwIfAborted();
         if (bytes && isFaviconImage(bytes)) {
             return {
                 hash: crypto.createHash('sha256').update(bytes).digest('hex'),