@tryghost/domain-validator 3.0.0 → 4.0.1

package/README.md

@@ -1,19 +1,23 @@
 # Domain Validator
 
 ## Installation
+
 1. Make sure that `gstenv` is green. See [Dev Environment](https://github.com/TryGhost/Team/blob/master/Engineering/Dev%20Environment.md) for docs.
 2. `git clone` this repo & `cd` into it as usual
 3. Run `yarn` to install top-level dependencies.
 
 ## Run
+
 - Use: `yarn dev`
 - View: [http://localhost:9999](http://localhost:9999)
 
 ## Test
+
 - `yarn lint` run just eslint
 - `yarn test` run lint && tests
 
 ## Publish
+
 - `yarn ship`
 
 # Copyright & License

package/bin/dv.js

@@ -3,7 +3,7 @@ const validator = require('../');
 
 prettyCLI
     .configure({
-        name: 'dv'
+        name: 'dv',
     })
     .groupOrder([
         'Sources:',
@@ -12,20 +12,19 @@ prettyCLI
         'Arguments:',
         'Required Options:',
         'Options:',
-        'Global Options:'
+        'Global Options:',
     ])
     .positional('<domain>', {
         paramsDesc: 'The domain you want to check',
-        mustExist: true
+        mustExist: true,
     })
     .positional('<subdomain>', {
         paramsDesc: 'The expected Ghost(Pro) subdomain',
-        mustExist: true
+        mustExist: true,
     })
     .parseAndExit()
     .then((argv) => {
         validator
             .validate(argv.subdomain, argv.domain)
-            .then(report => prettyCLI.ui.log(require('util').inspect(report, false, null))
-            );
+            .then((report) => prettyCLI.ui.log(require('util').inspect(report, false, null)));
     });

package/bin/req.js

@@ -3,7 +3,7 @@ const request = require('../lib/request');
 
 prettyCLI
     .configure({
-        name: 'req'
+        name: 'req',
     })
     .groupOrder([
         'Sources:',
@@ -12,16 +12,18 @@ prettyCLI
         'Arguments:',
         'Required Options:',
         'Options:',
-        'Global Options:'
+        'Global Options:',
     ])
     .positional('<domain>', {
         paramsDesc: 'The domain you want to request',
-        mustExist: true
+        mustExist: true,
     })
     .parseAndExit()
     .then((argv) => {
         request
             .domain(argv.domain)
-            .then(res => prettyCLI.ui.log('result', require('util').inspect(res, false, null)))
-            .catch(err => prettyCLI.ui.log.error('Error', require('util').inspect(err, false, null)));
+            .then((res) => prettyCLI.ui.log('result', require('util').inspect(res, false, null)))
+            .catch((err) =>
+                prettyCLI.ui.log.error('Error', require('util').inspect(err, false, null)),
+            );
     });

package/lib/caa.js

@@ -2,36 +2,42 @@ const dns = require('@tryghost/dns');
 const debug = require('@tryghost/debug')('dv:caa');
 
 /**
- * Check if the domain's CAA records allow the given issuer.
+ * Check whether the domain's CAA records allow any of the given issuers.
  *
  * @param {string} customdomain
- * @param {string} issuer - CA identity to check (e.g. 'certainly.com')
- * @returns {Promise<{isCaaValid: boolean, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
+ * @param {string[]} issuers - CA identities in preference order (e.g. ['certainly.com', 'letsencrypt.org'])
+ * @returns {Promise<{isCaaValid: boolean, caaChosenIssuer: string|null, caaSource: string|null, caaAllowedIssuers: string[], caaError: string|null}>}
  */
-module.exports.validate = (customdomain, issuer) => {
-    debug('Checking CAA for ' + customdomain + ' against ' + issuer);
-    return dns.caa(customdomain, {issuer}).then((result) => {
-        return {
-            isCaaValid: result.allowed,
-            caaSource: result.source,
-            caaAllowedIssuers: result.allowedIssuers,
-            caaError: result.error
-        };
-    }).catch((err) => {
-        // Fail open: dns.caa fails open internally on DNS errors, but guard
-        // against unexpected throws (bad arguments, future regressions) so
-        // CAA can never take down the rest of the validity report. Tolerate
-        // non-Error rejections (null/undefined/strings) so this handler
-        // itself can never throw.
-        const message = (err && typeof err.message === 'string')
-            ? err.message
-            : String(err || 'UNKNOWN');
-        debug('Unexpected CAA error: ' + message);
-        return {
-            isCaaValid: true,
-            caaSource: null,
-            caaAllowedIssuers: [],
-            caaError: message
-        };
-    });
+module.exports.validate = (customdomain, issuers) => {
+    // Tolerate a missing issuers arg here so we still enter the .catch below
+    // and fail open. dns.caa will throw a clear ValidationError on bad input.
+    debug('Checking CAA for ' + customdomain + ' against ' + (issuers || []).join(', '));
+    return dns
+        .caa(customdomain, { issuers })
+        .then((result) => {
+            return {
+                isCaaValid: result.allowed,
+                caaChosenIssuer: result.matchedIssuer,
+                caaSource: result.source,
+                caaAllowedIssuers: result.allowedIssuers,
+                caaError: result.error,
+            };
+        })
+        .catch((err) => {
+            // Fail open: dns.caa fails open internally on DNS errors, but guard
+            // against unexpected throws (bad arguments, future regressions) so
+            // CAA can never take down the rest of the validity report. Tolerate
+            // non-Error rejections (null/undefined/strings) so this handler
+            // itself can never throw.
+            const message =
+                err && typeof err.message === 'string' ? err.message : String(err || 'UNKNOWN');
+            debug('Unexpected CAA error: ' + message);
+            return {
+                isCaaValid: true,
+                caaChosenIssuer: issuers && issuers[0] ? issuers[0] : null,
+                caaSource: null,
+                caaAllowedIssuers: [],
+                caaError: message,
+            };
+        });
 };

package/lib/dns.js

@@ -10,7 +10,7 @@ const responseObject = {
     isDnsValidForSSL: false,
     sslRating: null,
     message: null,
-    raw: null
+    raw: null,
 };
 
 // Ghost(Pro) specific logic, using extra values
@@ -20,28 +20,32 @@ _private.handleDnsReport = function handleDnsReport(dnsResult, subdomain, isGhos
     const response = _.clone(responseObject);
 
     switch (dnsResult.validity.dns) {
-    // CASE: correct - we have a Ghost(Pro) subdomain, check it against what we expect
-    case 'correct':
-        // CASE: mismatch - there is a CNAME, but it's not what we expected
-        if (cname !== subdomain) {
-            // CNAME is incorrect, revise the validity
-            dnsResult.validity.dns = 'mismatch';
-            dnsResult.validity.ssl = 'D';
-            dnsResult.validity.reason = `CNAME mismatch, ${prodomain} subdomain is incorrect.`
-                + ' Expected: ' + subdomain + ' Actual: ' + cname;
-        }
-        break;
-    // CASE: obfuscated - we need to do one last check before giving up on this!
-    case 'obfuscated':
-        if (isGhostPro) {
-            dnsResult.validity.ssl = 'B';
-            dnsResult.validity.reason = 'DNS is obfuscated, but does resolve to Ghost(Pro)';
-        } else {
-            dnsResult.validity.ssl = 'D';
-            dnsResult.validity.dns = 'missing';
-            dnsResult.validity.reason = 'DNS is obfuscated and does not resolve to Ghost(Pro)';
-        }
-        break;
+        // CASE: correct - we have a Ghost(Pro) subdomain, check it against what we expect
+        case 'correct':
+            // CASE: mismatch - there is a CNAME, but it's not what we expected
+            if (cname !== subdomain) {
+                // CNAME is incorrect, revise the validity
+                dnsResult.validity.dns = 'mismatch';
+                dnsResult.validity.ssl = 'D';
+                dnsResult.validity.reason =
+                    `CNAME mismatch, ${prodomain} subdomain is incorrect.` +
+                    ' Expected: ' +
+                    subdomain +
+                    ' Actual: ' +
+                    cname;
+            }
+            break;
+        // CASE: obfuscated - we need to do one last check before giving up on this!
+        case 'obfuscated':
+            if (isGhostPro) {
+                dnsResult.validity.ssl = 'B';
+                dnsResult.validity.reason = 'DNS is obfuscated, but does resolve to Ghost(Pro)';
+            } else {
+                dnsResult.validity.ssl = 'D';
+                dnsResult.validity.dns = 'missing';
+                dnsResult.validity.reason = 'DNS is obfuscated and does not resolve to Ghost(Pro)';
+            }
+            break;
     }
 
     response.isDnsValid = dnsResult.validity.dns === 'correct';
@@ -56,9 +60,8 @@ _private.handleDnsReport = function handleDnsReport(dnsResult, subdomain, isGhos
 
 module.exports.validate = (subdomain, customdomain, isGhostPro, prodomain) => {
     debug('Validating ' + customdomain);
-    return dns(customdomain, {cname: prodomain})
-        .then((dnsResult) => {
-            debug('Response received');
-            return _private.handleDnsReport(dnsResult, subdomain, isGhostPro, prodomain);
-        });
+    return dns(customdomain, { cname: prodomain }).then((dnsResult) => {
+        debug('Response received');
+        return _private.handleDnsReport(dnsResult, subdomain, isGhostPro, prodomain);
+    });
 };

package/lib/pro.js

@@ -13,18 +13,21 @@ const responseObject = {
     isProxy: false,
     isProxyValid: null,
     // [proxyErrors], optional
-    raw: null
+    raw: null,
 };
 
 // Attempt to detect if the results look like a proxy
 _private.detectProxy = (headers, proto) => {
     if (
         // If x-forwarded-host was originally set, this is a proxy. "- [Invalid]" means original value was empty
-        (_.has(headers, 'x-ghost-forwarded-host') && headers['x-ghost-forwarded-host'] !== '- [Invalid]')
+        (_.has(headers, 'x-ghost-forwarded-host') &&
+            headers['x-ghost-forwarded-host'] !== '- [Invalid]') ||
         // If x-amz-cf-id is set, then this is cloudfront and therefore is a proxy
-        || _.has(headers, 'x-amz-cf-id')
+        _.has(headers, 'x-amz-cf-id') ||
         // If we are making an https request and get http back, this must be a proxy
-        || (proto === 'https' && _.has(headers, 'x-ghost-forwarded-proto') && headers['x-ghost-forwarded-proto'] !== proto)
+        (proto === 'https' &&
+            _.has(headers, 'x-ghost-forwarded-proto') &&
+            headers['x-ghost-forwarded-proto'] !== proto)
     ) {
         return true;
     }
@@ -35,43 +38,49 @@ _private.detectProxy = (headers, proto) => {
 _private.validateProxy = (headers, subdomain, customdomain, subdirectory, prodomain) => {
     const proxyResult = {
         isValid: true,
-        errors: []
+        errors: [],
     };
 
     // Forwarded Host must match the custom domain
-    if (!_.has(headers, 'x-ghost-forwarded-host') || headers['x-ghost-forwarded-host'] !== customdomain) {
+    if (
+        !_.has(headers, 'x-ghost-forwarded-host') ||
+        headers['x-ghost-forwarded-host'] !== customdomain
+    ) {
         proxyResult.isValid = false;
-        proxyResult.errors.push(
-            {
-                'x-forwarded-host': {
-                    actual: headers['x-ghost-forwarded-host'],
-                    expected: customdomain
-                }
-            });
+        proxyResult.errors.push({
+            'x-forwarded-host': {
+                actual: headers['x-ghost-forwarded-host'],
+                expected: customdomain,
+            },
+        });
     }
 
     // Proto must be https
-    if (!_.has(headers, 'x-ghost-forwarded-proto') || headers['x-ghost-forwarded-proto'] !== 'https') {
+    if (
+        !_.has(headers, 'x-ghost-forwarded-proto') ||
+        headers['x-ghost-forwarded-proto'] !== 'https'
+    ) {
         proxyResult.isValid = false;
-        proxyResult.errors.push(
-            {
-                'x-forwarded-proto': {
-                    actual: headers['x-ghost-forwarded-proto'],
-                    expected: 'https'
-                }
-            });
+        proxyResult.errors.push({
+            'x-forwarded-proto': {
+                actual: headers['x-ghost-forwarded-proto'],
+                expected: 'https',
+            },
+        });
     }
 
     // Host must match the pro domain
-    if (!_.has(headers, 'x-ghost-host') || headers['x-ghost-host'] !== `${subdomain}.${prodomain}`) {
+    if (
+        !_.has(headers, 'x-ghost-host') ||
+        headers['x-ghost-host'] !== `${subdomain}.${prodomain}`
+    ) {
         proxyResult.isValid = false;
-        proxyResult.errors.push(
-            {
-                host: {
-                    actual: headers['x-ghost-host'],
-                    expected: `${subdomain}.${prodomain}`
-                }
-            });
+        proxyResult.errors.push({
+            host: {
+                actual: headers['x-ghost-host'],
+                expected: `${subdomain}.${prodomain}`,
+            },
+        });
     }
 
     // If we have a subdirectory, this _must_ be a proxy
@@ -79,8 +88,8 @@ _private.validateProxy = (headers, subdomain, customdomain, subdirectory, prodom
         proxyResult.errors.push({
             subdirectory: {
                 actual: 'invalid proxy',
-                expected: 'valid proxy'
-            }
+                expected: 'valid proxy',
+            },
         });
     }
 
@@ -111,7 +120,9 @@ _private.buildResponse = (result, proto, subdomain, customdomain, subdirectory,
         if (subdomain && prodomain) {
             validRedirectDomains.push(`${subdomain}.${prodomain}`);
         }
-        response.isGhostProRedirect = response.redirect.every(redirect => validRedirectDomains.includes(new URL(redirect.headers.location).hostname));
+        response.isGhostProRedirect = response.redirect.every((redirect) =>
+            validRedirectDomains.includes(new URL(redirect.headers.location).hostname),
+        );
     }
 
     // If we find the x-ghost-cache-status header, we're seeing Ghost(Pro)
@@ -123,12 +134,19 @@ _private.buildResponse = (result, proto, subdomain, customdomain, subdirectory,
     }
 
     // Ensure that we only set isGhostPro to true if the redirect only uses valid domains
-    response.isGhostPro = response.isGhostPro && (!response.hasRedirect || response.isGhostProRedirect);
+    response.isGhostPro =
+        response.isGhostPro && (!response.hasRedirect || response.isGhostProRedirect);
 
     response.isProxy = _private.detectProxy(headers, proto);
 
     // Generate a proxy report
-    const proxyResult = _private.validateProxy(headers, subdomain, customdomain, subdirectory, prodomain);
+    const proxyResult = _private.validateProxy(
+        headers,
+        subdomain,
+        customdomain,
+        subdirectory,
+        prodomain,
+    );
 
     // If we have a detectable proxy, or a subdirectory, we must have a valid proxy config
     if (response.isProxy || subdirectory) {
@@ -146,29 +164,43 @@ _private.buildResponse = (result, proto, subdomain, customdomain, subdirectory,
 };
 
 // Predicate check to see if we should test HTTP
-_private.isCertificateError = error => /certificate/.test(error.context);
+_private.isCertificateError = (error) => /certificate/.test(error.context);
 
 // Checks a Pro site using the provided details, and returning a responseObject
 module.exports.validate = (proto, subdomain, customdomain, subdirectory, prodomain) => {
     const firstAttemptUrl = _private.buildUrl(proto, customdomain, subdirectory);
 
     debug('Validating ' + firstAttemptUrl);
-    return request.domain(firstAttemptUrl)
+    return request
+        .domain(firstAttemptUrl)
         .then((result) => {
             debug('Response received');
-            return _private.buildResponse(result, proto, subdomain, customdomain, subdirectory, prodomain);
+            return _private.buildResponse(
+                result,
+                proto,
+                subdomain,
+                customdomain,
+                subdirectory,
+                prodomain,
+            );
         })
         .catch(() => {
             const secondAttemptUrl = _private.buildUrl('http', customdomain, subdirectory);
 
             debug('Validating ' + secondAttemptUrl);
-            return request.domain(secondAttemptUrl)
-                .then((result) => {
-                    debug('HTTP response received');
-                    const response = _private.buildResponse(result, 'http', subdomain, customdomain, subdirectory, prodomain);
-                    response.isHTTPOnly = true;
-                    return response;
-                });
+            return request.domain(secondAttemptUrl).then((result) => {
+                debug('HTTP response received');
+                const response = _private.buildResponse(
+                    result,
+                    'http',
+                    subdomain,
+                    customdomain,
+                    subdirectory,
+                    prodomain,
+                );
+                response.isHTTPOnly = true;
+                return response;
+            });
         })
         .catch((error) => {
             const response = _.clone(responseObject);

package/lib/request.js

@@ -7,7 +7,7 @@ const debug = require('@tryghost/debug')('dv:request');
 // Use 3rd party DNS resolver
 const http = require('http');
 const https = require('https');
-const {Resolver} = require('dns').promises;
+const { Resolver } = require('dns').promises;
 const resolver = new Resolver();
 resolver.setServers(['1.1.1.1', '1.0.0.1']);
 const semverMajor = require('semver/functions/major');
@@ -18,12 +18,14 @@ const staticLookup = () => async (hostname, _options, callback) => {
         const ips = await resolver.resolve(hostname);
 
         if (ips.length === 0) {
-            return callback(new errors.InternalServerError({message: `Unable to resolve ${hostname}`}));
+            return callback(
+                new errors.InternalServerError({ message: `Unable to resolve ${hostname}` }),
+            );
         }
 
         if (nodeVersion >= 20) {
             // Node 20+ uses a different callback signature
-            callback(null, [{address: ips[0], family: 4}]);
+            callback(null, [{ address: ips[0], family: 4 }]);
         } else {
             // Node 18 and below use the old callback signature
             callback(null, ips[0], 4);
@@ -42,19 +44,19 @@ module.exports.domain = (url) => {
         followRedirect: false,
         // Don't allow the request to go on for more than 15 seconds
         timeout: {
-            request: 15000
+            request: 15000,
         },
         // If the network errors, retry 1 time:
         retry: {
-            limit: 1
+            limit: 1,
         },
         headers: {
-            'X-Ghost-Proxy': true
+            'X-Ghost-Proxy': true,
         },
         agent: {
-            http: new http.Agent({lookup: staticLookup()}),
-            https: new https.Agent({lookup: staticLookup()})
-        }
+            http: new http.Agent({ lookup: staticLookup() }),
+            https: new https.Agent({ lookup: staticLookup() }),
+        },
     };
 
     const responses = [];
@@ -66,14 +68,21 @@ module.exports.domain = (url) => {
         const statusCode = res.statusCode;
         const headers = {};
 
-        _.reduce(res.headers, (updatedHeaders = {}, value, name) => {
-            if (_.startsWith(name, 'x-ghost') || _.includes(['server', 'location', 'x-amz-cf-id'], name)) {
-                updatedHeaders[name] = value;
-            }
-            return updatedHeaders;
-        }, headers);
+        _.reduce(
+            res.headers,
+            (updatedHeaders = {}, value, name) => {
+                if (
+                    _.startsWith(name, 'x-ghost') ||
+                    _.includes(['server', 'location', 'x-amz-cf-id'], name)
+                ) {
+                    updatedHeaders[name] = value;
+                }
+                return updatedHeaders;
+            },
+            headers,
+        );
 
-        responses.push({statusCode, headers});
+        responses.push({ statusCode, headers });
 
         if (statusCode.toString()[0] === '3') {
             numHops += 1;
@@ -82,23 +91,25 @@ module.exports.domain = (url) => {
                 return;
             }
 
-            return got.head(res.headers.location, options)
-                .then(handleResponse);
+            return got.head(res.headers.location, options).then(handleResponse);
         }
     }
 
     return new Promise(function (resolve, reject) {
         debug('starting request');
-        return got.head(url, options)
+        return got
+            .head(url, options)
             .then(handleResponse)
             .then(() => resolve(responses))
             .catch((error) => {
-                reject(new errors.BadRequestError({
-                    message: 'Domain could not be requested',
-                    property: url,
-                    context: error.message,
-                    code: error.code
-                }));
+                reject(
+                    new errors.BadRequestError({
+                        message: 'Domain could not be requested',
+                        property: url,
+                        context: error.message,
+                        code: error.code,
+                    }),
+                );
             });
     });
 };

package/lib/validate.js

@@ -11,7 +11,7 @@ const validityReportObject = {
     input: {
         subdomain: '',
         customdomain: '',
-        subdirectory: ''
+        subdirectory: '',
     },
     isResponding: false,
     isHTTPOnly: false,
@@ -24,22 +24,26 @@ const validityReportObject = {
     isDnsValidForSSL: false,
     sslRating: null,
     isCaaValid: true,
+    caaChosenIssuer: null,
     caaSource: null,
     caaAllowedIssuers: [],
     caaError: null,
-    message: ''
+    message: '',
 };
 
-_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer) => {
+_private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuers) => {
     const checkResult = {};
     debug('starting pro');
-    return pro.validate('https', subdomain, customdomain, subdirectory, prodomain)
+    return pro
+        .validate('https', subdomain, customdomain, subdirectory, prodomain)
         .then((proResult) => {
             checkResult.pro = proResult;
             debug('got pro, starting dns');
             return Promise.all([
                 dns.validate(subdomain, customdomain, checkResult.pro.isGhostPro, prodomain),
-                caaIssuer ? caa.validate(customdomain, caaIssuer) : Promise.resolve(null)
+                caaIssuers && caaIssuers.length > 0
+                    ? caa.validate(customdomain, caaIssuers)
+                    : Promise.resolve(null),
             ]);
         })
         .then(([dnsResult, caaResult]) => {
@@ -60,51 +64,66 @@ _private.doChecks = (subdomain, customdomain, subdirectory, prodomain, caaIssuer
  * @param {string} customdomain
  * @param {string} subdirectory
  * @param {string} [prodomain=ghost.io]
- * @param {string} [caaIssuer] - CA identity to check CAA records against (e.g. 'certainly.com').
- *                               When omitted, CAA is not checked and isCaaValid defaults to true.
+ * @param {string[]} [caaIssuers] - CA identities to check CAA records against, in preference order
+ *                                  (e.g. ['certainly.com', 'letsencrypt.org']). When omitted or
+ *                                  empty, CAA is not checked and isCaaValid defaults to true.
  */
-module.exports.validate = (subdomain, customdomain, subdirectory, prodomain = 'ghost.io', caaIssuer) => _private
-    .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuer)
-    .then(function (result) {
-        // Deep clone so nested mutable fields (input, caaAllowedIssuers)
-        // can't leak across validation calls via the shared template.
-        const validityReport = _.cloneDeep(validityReportObject);
+module.exports.validate = (
+    subdomain,
+    customdomain,
+    subdirectory,
+    prodomain = 'ghost.io',
+    caaIssuers,
+) =>
+    _private
+        .doChecks(subdomain, customdomain, subdirectory, prodomain, caaIssuers)
+        .then(function (result) {
+            // Deep clone so nested mutable fields (input, caaAllowedIssuers)
+            // can't leak across validation calls via the shared template.
+            const validityReport = _.cloneDeep(validityReportObject);
 
-        // Store the inputted details
-        validityReport.input.subdomain = subdomain;
-        validityReport.input.customdomain = customdomain;
-        validityReport.input.subdirectory = subdirectory;
+            // Store the inputted details
+            validityReport.input.subdomain = subdomain;
+            validityReport.input.customdomain = customdomain;
+            validityReport.input.subdirectory = subdirectory;
 
-        // Copy over all the values from result.pro
-        _.merge(validityReport, _.omit(result.pro, 'raw'));
-        // Do a few last DNS-related checks, and then output validity values
-        _.merge(validityReport, _.omit(result.dns, 'raw'));
+            // Copy over all the values from result.pro
+            _.merge(validityReport, _.omit(result.pro, 'raw'));
+            // Do a few last DNS-related checks, and then output validity values
+            _.merge(validityReport, _.omit(result.dns, 'raw'));
 
-        if (result.caa) {
-            _.merge(validityReport, result.caa);
+            if (result.caa) {
+                _.merge(validityReport, result.caa);
 
-            // CAA blocking issuance means SSL can't be provisioned going forward,
-            // even if DNS currently points at Ghost — treat it like a DNS failure.
-            if (!validityReport.isCaaValid) {
-                validityReport.isDnsValidForSSL = false;
-                validityReport.sslRating = 'D';
-                validityReport.message = 'CAA record does not allow ' + caaIssuer
-                    + ' (allowed: ' + (validityReport.caaAllowedIssuers.join(', ') || 'none')
-                    + ', source: ' + validityReport.caaSource + ')';
+                // CAA blocking issuance means SSL can't be provisioned going forward,
+                // even if DNS currently points at Ghost — treat it like a DNS failure.
+                if (!validityReport.isCaaValid) {
+                    validityReport.isDnsValidForSSL = false;
+                    validityReport.sslRating = 'D';
+                    validityReport.message =
+                        'CAA record does not allow any of ' +
+                        caaIssuers.join(', ') +
+                        ' (allowed: ' +
+                        (validityReport.caaAllowedIssuers.join(', ') || 'none') +
+                        ', source: ' +
+                        validityReport.caaSource +
+                        ')';
+                }
             }
-        }
 
-        if (validityReport.isProxy) {
-            const proxyMessage = validityReport.isProxyValid ? 'Found a valid proxy' : 'Found invalid proxy config';
-            validityReport.message = validityReport.message
-                ? validityReport.message + '; ' + proxyMessage
-                : proxyMessage;
-        }
+            if (validityReport.isProxy) {
+                const proxyMessage = validityReport.isProxyValid
+                    ? 'Found a valid proxy'
+                    : 'Found invalid proxy config';
+                validityReport.message = validityReport.message
+                    ? validityReport.message + '; ' + proxyMessage
+                    : proxyMessage;
+            }
 
-        validityReport.raw = {
-            pro: result.pro.raw,
-            dns: result.dns.raw
-        };
+            validityReport.raw = {
+                pro: result.pro.raw,
+                dns: result.dns.raw,
+            };
 
-        return validityReport;
-    });
+            return validityReport;
+        });

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "@tryghost/domain-validator",
-  "version": "3.0.0",
+  "version": "4.0.1",
+  "license": "MIT",
+  "author": "Ghost Foundation",
   "repository": {
     "type": "git",
-    "url": "ssh://git@github.com/TryGhost/Pro",
+    "url": "ssh://git@github.com/TryGhost/Pro-Packages",
     "directory": "packages/domain-validator"
   },
-  "author": "Ghost Foundation",
-  "license": "MIT",
-  "main": "lib/validate.js",
   "bin": {
     "dv": "./bin/dv.js"
   },
@@ -17,26 +16,27 @@
     "lib",
     "index.js"
   ],
-  "scripts": {
-    "dv": "node bin/dv.js",
-    "req": "node bin/req.js",
-    "lint": "eslint . --ext .js --cache",
-    "posttest": "yarn lint",
-    "test": "NODE_ENV=testing mocha -- $(find test -name '*.test.js')"
-  },
-  "devDependencies": {
-    "mocha": "11.7.5",
-    "should": "13.2.3",
-    "sinon": "21.0.3"
-  },
+  "main": "lib/validate.js",
   "dependencies": {
     "@tryghost/debug": "2.0.3",
-    "@tryghost/dns": "^0.7.0",
     "@tryghost/errors": "3.0.3",
     "@tryghost/pretty-cli": "3.0.3",
     "bluebird": "3.7.2",
     "got": "11.8.6",
-    "lodash": "4.17.23"
+    "lodash": "4.17.23",
+    "semver": "7.7.4",
+    "@tryghost/dns": "^0.8.1"
+  },
+  "devDependencies": {
+    "mocha": "11.7.5",
+    "should": "13.2.3",
+    "sinon": "21.0.3"
   },
-  "gitHead": "c5d1ebb864969de89c1e8a8dcac3f577bceee1dd"
-}
+  "scripts": {
+    "dv": "node bin/dv.js",
+    "req": "node bin/req.js",
+    "lint": "oxlint -c ../../.oxlintrc.json .",
+    "posttest": "pnpm lint",
+    "test": "NODE_ENV=testing mocha -- $(find test -name '*.test.js')"
+  }
+}