@wraps.dev/cli 2.24.0 → 2.25.0

package/README.md

@@ -502,7 +502,7 @@ DMARC (TXT)
 Policy for how receivers handle emails failing DKIM/SPF checks
 
   TXT    _dmarc.example.com
-  →      v=DMARC1; p=quarantine; rua=mailto:postmaster@example.com
+  →      v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@example.com
 ```
 
 ## Hosting Provider Integration

package/dist/cli.js

@@ -3047,7 +3047,7 @@ async function previewDNSChanges(hostedZoneId, domain, dkimTokens, region, custo
   });
   const dmarcName = `_dmarc.${domain}`;
   const dmarcRuaDomain = mailFromDomain || domain;
-  const proposedDMARC = `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`;
+  const proposedDMARC = `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`;
   const existingDMARC = findExistingRecord(existingRecords, dmarcName, "TXT");
   const existingDMARCValue = getRecordValue(existingDMARC);
   let dmarcStatus = "new";
@@ -3209,7 +3209,7 @@ async function createSelectedDNSRecords(hostedZoneId, domain, dkimTokens, region
         TTL: 1800,
         ResourceRecords: [
           {
-            Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+            Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
           }
         ]
       }
@@ -3332,7 +3332,7 @@ async function createDNSRecords(hostedZoneId, domain, dkimTokens, region, custom
       TTL: 1800,
       ResourceRecords: [
         {
-          Value: `"v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          Value: `"v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         }
       ]
     }
@@ -3556,7 +3556,7 @@ var init_cloudflare = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -3942,7 +3942,7 @@ var init_vercel = __esm({
           const dmarcSuccess = await this.createRecord(
             `_dmarc.${domain}`,
             "TXT",
-            `v=DMARC1; p=quarantine; rua=mailto:postmaster@${mailFromDomain || domain}`
+            `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${mailFromDomain || domain}`
           );
           if (dmarcSuccess) {
             recordsCreated++;
@@ -4211,7 +4211,7 @@ function buildEmailDNSRecords(data) {
   records.push({
     name: `_dmarc.${domain}`,
     type: "TXT",
-    value: `v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}`,
+    value: `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}`,
     category: "dmarc"
   });
   if (customTrackingDomain) {
@@ -6263,7 +6263,7 @@ Verification should complete within a few minutes.`,
         ),
         "",
         pc10.bold("DMARC Record (TXT):"),
-        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+        `  ${pc10.cyan(`_dmarc.${domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
       );
       if (outputs.mailFromDomain) {
         dnsLines.push(
@@ -6492,7 +6492,7 @@ ${domainStrings.join("\n")}`);
           ),
           "",
           pc10.bold("DMARC Record (TXT):"),
-          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; rua=mailto:postmaster@${dmarcRuaDomain}"`
+          `  ${pc10.cyan(`_dmarc.${domain.domain}`)} ${pc10.dim("TXT")} "v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:postmaster@${dmarcRuaDomain}"`
         );
       }
       if (domain.mailFromDomain && domain.mailFromStatus !== "SUCCESS") {
@@ -15408,6 +15408,9 @@ async function checkDmarc(domain) {
     valid: false,
     policy: null,
     subdomainPolicy: null,
+    nonExistentSubdomainPolicy: null,
+    testing: false,
+    psd: null,
     percentage: 100,
     reportingEnabled: false,
     ruaAddresses: [],
@@ -15460,6 +15463,21 @@ function parseDmarcRecord(record, result) {
   } else {
     result.subdomainPolicy = result.policy;
   }
+  const np = tags.get("np");
+  if (np) {
+    if (["none", "quarantine", "reject"].includes(np)) {
+      result.nonExistentSubdomainPolicy = np;
+    } else {
+      result.warnings.push(`Invalid non-existent subdomain policy (np): ${np}`);
+    }
+  }
+  if (tags.get("t") === "y") {
+    result.testing = true;
+  }
+  const psd = tags.get("psd");
+  if (psd && ["y", "n", "u"].includes(psd)) {
+    result.psd = psd;
+  }
   const pct = tags.get("pct");
   if (pct) {
     const pctNum = Number.parseInt(pct, 10);
@@ -15468,7 +15486,9 @@ function parseDmarcRecord(record, result) {
     } else {
       result.percentage = pctNum;
       if (pctNum < 100) {
-        result.warnings.push(`Only ${pctNum}% of messages subject to policy`);
+        result.warnings.push(
+          `pct=${pctNum} is deprecated (DMARCbis receivers ignore it; enforcement is all-or-nothing). Use t=y while testing instead.`
+        );
       }
     }
   }
@@ -15533,6 +15553,17 @@ function parseDmarcRecord(record, result) {
   if (result.subdomainPolicy === "none" && result.policy !== "none") {
     result.warnings.push("Subdomain policy is less strict than domain policy");
   }
+  const enforcing = result.policy === "quarantine" || result.policy === "reject";
+  if (result.testing && result.policy !== "none") {
+    result.warnings.push(
+      "t=y (testing) is set \u2014 receivers will not enforce the policy"
+    );
+  }
+  if (enforcing && !result.nonExistentSubdomainPolicy) {
+    result.warnings.push(
+      "No np= set \u2014 add np=reject to block spoofing from non-existent subdomains (DMARCbis)"
+    );
+  }
   if (!result.reportingEnabled) {
     result.warnings.push("No aggregate reporting configured (rua=)");
   }
@@ -16686,11 +16717,18 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC policy is none (not enforcing)"
     });
   }
-  if (dmarc.percentage < 100) {
+  if (dmarc.testing && dmarc.policy !== "none") {
     deductions.push({
       check: "dmarc",
       points: 2,
-      reason: `DMARC pct=${dmarc.percentage} (not 100%)`
+      reason: "DMARC testing mode (t=y) \u2014 receivers won't enforce the policy"
+    });
+  }
+  if (dmarc.percentage < 100) {
+    deductions.push({
+      check: "dmarc",
+      points: 1,
+      reason: `DMARC pct=${dmarc.percentage} is deprecated (DMARCbis receivers ignore it; enforcement is inconsistent)`
     });
   }
   if (!dmarc.reportingEnabled) {
@@ -16707,6 +16745,13 @@ function collectDmarcIssues(dmarc, deductions, bonuses) {
       reason: "DMARC strict alignment configured"
     });
   }
+  if ((dmarc.policy === "quarantine" || dmarc.policy === "reject") && dmarc.nonExistentSubdomainPolicy === "reject") {
+    bonuses.push({
+      check: "dmarc",
+      points: 1,
+      reason: "np=reject blocks non-existent subdomain spoofing (DMARCbis)"
+    });
+  }
 }
 function collectInfraIssues(checks, deductions, bonuses) {
   if (checks.mx.exists) {