domma-cms 1.8.15 → 1.8.16

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [1.8.16] - 2026-10-16
+
+- **Fixed: the mail server setting could be used to probe the server's own network.** An admin could set the outgoing mail server in Site Settings to any internal address and port, and "Send test email" showed the mail library's own error, which says what is listening there. On sites a Domma CMS Manager hosts (signed-only), the mail server must now be `localhost`, `127.0.0.1`, `::1` or a public mail server, on port 25, 465, 587 or 2525; a private or internal address is refused when the setting is saved and when mail is sent, and the connection goes to the address that was checked, so a second DNS answer cannot point it somewhere else. Mailboxes in the mail tools follow the same rules there (IMAP on 143 or 993), and are checked at every connection rather than only when saved. On every site, a failed test email now says "Could not send the test email. Check the mail server settings." and the full error goes to the server log only; the same goes for the failed-email notice and the mail tools' connection errors. Self-hosted sites can still send through an internal relay.
+
+- **Fixed: the Security Tool's health check could be pointed at another server.** It fetched the address the incoming request named. It now checks only the site's own address (Security 1.2.1).
+
 ## [1.8.15] - 2026-10-16
 
 - **Fixed: a view or filter on a MongoDB collection could run JavaScript inside the database server.** A saved view, the view editor's live results, a `[view]` or `[collection]` on a page, a collection filter, an `/api/v1` query or an API Builder endpoint could carry `$where`, `$function`, `$accumulator` and the like - hidden at any depth - and MongoDB would run it. Every query is now checked in one place before MongoDB sees it, and refused with a plain message if it holds anything that runs code, writes (`$out`, `$merge`), reads beyond the site's own collections (`$unionWith`, `$graphLookup`, a `$lookup` into another database or something that is not one of the site's collections) or uses a name like `__proto__`. A view is checked when it is saved, too. Ordinary filters and views work as before; a `$lookup` that names a collection by its plain name (`people` rather than `cms_people`) now works on MongoDB as it already did on files. An entry id sent as anything but text (`{"$ne": ""}` in an Action's run request, say) no longer picks whichever MongoDB entry matched first.

package/CLAUDE.md

@@ -136,6 +136,12 @@ Collection entry I/O is delegated to a storage adapter. Schema management is alw
   connection pinned to the checked address, never this server's own addresses, redirects re-checked, ports 80/443.
   `server.json` `outboundAllowPrivate` (`true` or a list of hosts/addresses/CIDRs) lifts it for self-hosters and is
   ignored when `codePolicy.signedOnly()`. `wpImport/fetch.js` shares its address rules and pinned request
+- **Mail hosts a user typed go through `services/mailHost.js` `resolveMailHost()`** (outbound.js's address rules). On a
+  signed-only site: `localhost`/`127.0.0.1`/`::1` or a public server, ports 25/465/587/2525 (IMAP 143/993), connected by
+  the checked address with the name as TLS `servername`; nothing the site sets lifts it. `email.js` `createTransport()`
+  does it per send there; self-hosted site SMTP is unchecked (internal relays are normal). The mail plugins' connections
+  (`_lib/mail` imapPool, send.js) re-check and pin through `hostGuard.js` `pinMailHost()`. Send errors reach the browser
+  as plain words only (`email.js` `mailFailure()` logs the raw text): the server's words say what listens on a port.
 
 ## Roles & Permissions
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.8.15",
+  "version": "1.8.16",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/plugins/_lib/mail/hostGuard.js

@@ -11,14 +11,22 @@
  * the admin chose) or `allowPrivateMailHosts` is set for a site whose mail
  * server really is on its LAN.
  *
- * The pure half is `isPrivateAddress` / `isLocalName` in unsubscribe.js; this
- * module adds the lookup, which the tests inject.
+ * The address rules are core's (services/outbound.js `isBlockedAddress`, and
+ * services/mailHost.js on a signed-only site, where nothing above lifts them);
+ * `isLocalName` is unsubscribe.js's. Checking a name and then connecting by
+ * name lets a second DNS answer point the connection inward, so the
+ * connections themselves (imapPool.js, send.js) go through `pinMailHost()`:
+ * checked again, and connected to the address that was checked.
  *
  * @module _lib/mail/hostGuard
  */
 import dns from 'node:dns/promises';
 import net from 'node:net';
-import {isLocalName, isPrivateAddress} from './unsubscribe.js';
+import {getConfig} from '../../../server/config.js';
+import {isBlockedAddress} from '../../../server/services/outbound.js';
+import {MailHostRefused, normaliseMailHost, resolveMailHost} from '../../../server/services/mailHost.js';
+import {signedOnly} from '../../../server/services/codePolicy.js';
+import {isLocalName} from './unsubscribe.js';
 
 const REFUSED = 'That server is on this machine\'s own network, so the site will not connect to it. '
     + 'Use the mail server\'s public name, or ask the site administrator to allow private mail hosts.';
@@ -30,33 +38,58 @@ const REFUSED = 'That server is on this machine\'s own network, so the site will
  * @returns {string}
  */
 export function normaliseHost(host) {
-    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+    return normaliseMailHost(host);
+}
+
+/** Does `allowPrivate` / `ownSmtpHost` let this (self-hosted) site reach the name anywhere? */
+function exempt(name, {allowPrivate, ownSmtpHost}) {
+    return allowPrivate === true || (!!ownSmtpHost && normaliseHost(ownSmtpHost) === name);
 }
 
 /**
- * Check one host.
+ * Check one host (the save and "test these details" routes).
+ *
+ * On a signed-only (hosted) site the rules are core's services/mailHost.js and
+ * nothing the site's admin sets lifts them: loopback names or public servers,
+ * on the mail ports when `port` is given. `allowPrivate` and `ownSmtpHost`
+ * count on self-hosted sites only.
+ *
+ * Passing is not the end of it: every connection checks again and connects to
+ * the address it checked (`pinMailHost`), so a name that resolves differently
+ * later (DNS rebinding) is caught there.
  *
  * @param   {string} host
  * @param   {object} [options]
  * @param   {boolean} [options.allowPrivate]  - the site's `allowPrivateMailHosts` setting
  * @param   {string}  [options.ownSmtpHost]   - the site's configured outgoing server; always allowed
- * @param   {(host: string) => Promise<{address: string}[]>} [options.lookup] - DNS, injectable
+ * @param   {number}  [options.port]          - checked against the mail ports on a signed-only site
+ * @param   {'smtp'|'imap'} [options.kind]    - which mail ports
+ * @param   {boolean} [options.signed]        - codePolicy.signedOnly() when omitted
+ * @param   {Function} [options.lookup] - DNS, injectable
  * @returns {Promise<{ok: true} | {ok: false, error: string}>}
  */
-export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup} = {}) {
+export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '', lookup, port, kind = 'imap', signed} = {}) {
     const name = normaliseHost(host);
     if (!name) return {ok: false, error: 'A server is required.'};
-    if (allowPrivate) return {ok: true};
-    if (ownSmtpHost && normaliseHost(ownSmtpHost) === name) return {ok: true};
+    if (signed ?? signedOnly()) {
+        try {
+            await resolveMailHost(name, port, {kind, signed: true, anyPort: port === undefined, ...(lookup && {lookup})});
+            return {ok: true};
+        } catch (err) {
+            if (err.mailHostRefused) return {ok: false, error: err.message};
+            return {ok: true}; // unresolvable: the connection attempt says so
+        }
+    }
+    if (exempt(name, {allowPrivate, ownSmtpHost})) return {ok: true};
 
     if (net.isIP(name)) {
-        return isPrivateAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
+        return isBlockedAddress(name) ? {ok: false, error: REFUSED} : {ok: true};
     }
     if (isLocalName(name)) return {ok: false, error: REFUSED};
 
     let answers;
     try {
-        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true})))(name);
+        answers = await (lookup ?? ((h) => dns.lookup(h, {all: true, verbatim: true})))(name, {all: true, verbatim: true});
     } catch {
         // Unresolvable: let the connection attempt say so in its own words.
         // The check is about where a name points, not whether it exists.
@@ -65,10 +98,61 @@ export async function checkMailHost(host, {allowPrivate = false, ownSmtpHost = '
     // Every answer must be public: a name with one private A record among
     // public ones is exactly the rebinding trick the check exists for.
     const addresses = (answers ?? []).map(a => (typeof a === 'string' ? a : a?.address)).filter(Boolean);
-    if (addresses.some(isPrivateAddress)) return {ok: false, error: REFUSED};
+    if (addresses.some(isBlockedAddress)) return {ok: false, error: REFUSED};
     return {ok: true};
 }
 
+/**
+ * Is `allowPrivateMailHosts` on for a mail plugin on this site? Read from
+ * config/plugins.json for the connections made without a plugin's config in
+ * hand (email-pro's SMTP test). Never consulted on a signed-only site.
+ *
+ * @returns {boolean}
+ */
+export function pluginsAllowPrivate() {
+    try {
+        const plugins = getConfig('plugins') || {};
+        return ['mail-reader', 'email-pro'].some(n => plugins[n]?.settings?.allowPrivateMailHosts === true);
+    } catch {
+        return false;
+    }
+}
+
+/**
+ * Check a host at the moment of connecting, and say which address to connect
+ * to - the address that was checked, so a second DNS answer cannot swap an
+ * internal one in (DNS rebinding). The name is returned as `servername` for
+ * TLS (SNI and the certificate check).
+ *
+ * @param   {string} host
+ * @param   {number} port
+ * @param   {object} [options]
+ * @param   {'smtp'|'imap'} [options.kind='imap']
+ * @param   {boolean} [options.allowPrivate] - pluginsAllowPrivate() when omitted
+ * @param   {string}  [options.ownSmtpHost]  - siteSmtpHost(getConfig) when omitted
+ * @param   {boolean} [options.signed]
+ * @param   {Function} [options.lookup]
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws  {Error} MailHostRefused (`mailHostRefused`), or code ENOTFOUND
+ */
+export async function pinMailHost(host, port, {kind = 'imap', allowPrivate, ownSmtpHost, signed, lookup} = {}) {
+    const name = normaliseHost(host);
+    const isSigned = signed ?? signedOnly();
+    const opts = {kind, signed: isSigned, ...(lookup && {lookup})};
+    if (isSigned) return resolveMailHost(name, port, opts);
+    const free = exempt(name, {
+        allowPrivate: allowPrivate ?? pluginsAllowPrivate(),
+        ownSmtpHost: ownSmtpHost ?? siteSmtpHost(getConfig)
+    });
+    if (!free && !net.isIP(name) && isLocalName(name)) throw new MailHostRefused(REFUSED);
+    try {
+        return await resolveMailHost(name, port, {...opts, checkAddresses: !free});
+    } catch (err) {
+        if (err.mailHostRefused) throw new MailHostRefused(REFUSED);
+        throw err;
+    }
+}
+
 /**
  * The site's own outgoing server, from config/site.json `smtp.host` (what
  * core `createTransport` sends with), read through a getter so a test can

package/plugins/_lib/mail/imapPool.js

@@ -27,6 +27,7 @@
  * @module mail-reader/services/imapPool
  */
 import {ImapFlow} from 'imapflow';
+import {pinMailHost} from './hostGuard.js';
 
 /**
  * Identify a connection's target. A change to any of these means the cached
@@ -98,8 +99,16 @@ export function createPool(config) {
             auth = {user: auth.user, accessToken: r.accessToken};
         }
 
+        // Checked here, at every connect, and connected to the checked address
+        // (the name kept for TLS) - see hostGuard.js pinMailHost.
+        const pinned = await pinMailHost(connection.host, connection.port, {kind: 'imap', allowPrivate: config.allowPrivateMailHosts === true});
+
         const attempt = async (withAuth) => {
-            const client = new ImapFlow(clientOptions({...connection, auth: withAuth}));
+            const client = new ImapFlow({
+                ...clientOptions({...connection, auth: withAuth}),
+                host: pinned.address,
+                ...(pinned.servername && {servername: pinned.servername})
+            });
             prepare(client);
             try {
                 await client.connect();
@@ -300,7 +309,10 @@ export function createPool(config) {
     // Never hold the process open on account of an idle mail connection.
     reaper.unref?.();
 
-    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient, get size() {
+    return {withClient, withMailbox, test, release, releaseUser, closeAll, connectClient,
+        // What send.js passes to hostGuard.js pinMailHost for this plugin's outgoing servers.
+        mailHostOptions: {allowPrivate: config.allowPrivateMailHosts === true},
+        get size() {
         return pool.size;
     }};
 }
@@ -321,7 +333,7 @@ export function createPool(config) {
  */
 export function describeError(err, connection = {}) {
     if (!err) return 'Unknown error.';
-    if (err.needsReconnect) return err.message;
+    if (err.needsReconnect || err.mailHostRefused) return err.message;
     // A signed-in (OAuth2) mailbox has no password to blame.
     if ((err.authenticationFailed || err.code === 'EAUTH' || err.code === 'EOAUTH2') && (connection.auth?.accessToken !== undefined || connection.auth?.type === 'OAuth2')) {
         return 'The mail server refused the sign-in. If it keeps happening, Reconnect the mailbox.';
@@ -366,6 +378,16 @@ export function describeError(err, connection = {}) {
         case 'ECONNRESET':
             return 'The mail server did not respond in time.';
         default:
-            return err.message || 'The mail server connection failed.';
+            // Words that are ours, or a mail server's answer to a command after
+            // it greeted and (for IMAP) signed us in - those say nothing about
+            // what else listens on a host and port.
+            if (err.name === 'MailKeyError' || err.responseStatus === 'NO' || err.responseStatus === 'BAD'
+                || err.code === 'EENVELOPE' || err.code === 'EMESSAGE') {
+                return err.message || 'The mail server connection failed.';
+            }
+            // Anything else stays out of the browser: a greeting, a banner or a
+            // socket error is exactly what a port scan reads. The log has it.
+            console.warn(`[mail] connection to ${connection.host || 'the mail server'}:${connection.port || '?'} failed${err.code ? ` (${err.code})` : ''}: ${err.message || err}`);
+            return 'The mail server connection failed. Check the server settings.';
     }
 }

package/plugins/_lib/mail/poller.js

@@ -13,6 +13,7 @@
  * @module _lib/mail/poller
  */
 import {selectDuePolls} from './pollSchedule.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. Finer than any poll interval. */
 const TICK_MS = 30_000;
@@ -49,7 +50,7 @@ export function createPoller({listAccounts, syncAccount, defaultMinutes, logger,
         } catch (err) {
             const failures = (entry.failures ?? 0) + 1;
             state.set(account.id, {
-                lastAttemptAt: Date.now(), failures, running: false, lastError: err.message
+                lastAttemptAt: Date.now(), failures, running: false, lastError: describeError(err)
             });
             // Warn, not error: a mail server being unreachable is an ordinary
             // condition, and the backoff already handles it.

package/plugins/_lib/mail/readRoutes.js

@@ -240,7 +240,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
     }
 
     /** Where this server may be asked to connect - see hostGuard.js. */
-    const guardHost = (host) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig)});
+    const guardHost = (host, port) => checkMailHost(host, {allowPrivate: config.allowPrivateMailHosts === true, ownSmtpHost: siteSmtpHost(getConfig), port, kind: 'imap'});
     // Each test is a connection attempt whose answer says what is listening: a few a minute per address is plenty.
     const testLimit = {config: {rateLimit: {max: 10, timeWindow: '1 minute'}}};
 
@@ -258,7 +258,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
 
         const result = accounts.validate(request.body ?? {}, null);
         if (!result.ok) return reply.code(400).send({error: result.error});
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, null, result.value);
@@ -277,7 +277,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
         const result = accounts.validate(request.body ?? {}, existing);
         if (!result.ok) return reply.code(400).send({error: result.error});
         // A signed-in mailbox's servers are the provider's and cannot be edited here.
-        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host);
+        const where = result.value.oauth ? {ok: true} : await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         const saved = await accounts.saveAccount(uid, request.params.id, result.value);
@@ -343,7 +343,7 @@ export function registerReadRoutes(fastify, {auth, hooks, config, pool, pluginNa
                 throw err;
             }
         }
-        const where = await guardHost(result.value.host);
+        const where = await guardHost(result.value.host, result.value.port);
         if (!where.ok) return reply.code(400).send({error: where.error});
 
         let pass = result.value.password;

package/plugins/_lib/mail/scheduler.js

@@ -24,6 +24,7 @@
  */
 import * as accounts from './accounts.js';
 import {sendMessage} from './send.js';
+import {describeError} from './imapPool.js';
 
 /** How often the ticker looks for work. */
 const TICK_MS = 5_000;
@@ -118,11 +119,13 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             // the sender is told (the send-failed notice) instead of waiting.
             const giveUp = err?.needsReconnect || (item.attempts ?? 1) >= MAX_ATTEMPTS;
             await store.finishSend(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : err.message}
+                // describeError: a queue item is read in the browser, and the mail
+                // server's own words are for the log (they say what listens on a port).
+                ? {status: 'failed', error: err?.needsReconnect ? reconnectReason(err) : describeError(err)}
                 // Back to pending, a little later. `finishedAt` is set either
                 // way, which is harmless on a retry and is what tells a
                 // screen when the last attempt was.
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message});
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err)});
 
             logger.warn(
                 `[mail] queued send ${item._id} failed (attempt ${item.attempts}): ${err.message}`
@@ -186,8 +189,8 @@ export function createScheduler({store, pool, config, logger, tickMs = TICK_MS})
             const attempts = (item.attempts ?? 0) + 1;
             const giveUp = err?.needsReconnect || attempts >= MAX_ATTEMPTS;
             await store.finishSnooze(item._id, giveUp
-                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : err.message, attempts}
-                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: err.message, attempts});
+                ? {status: 'failed', error: err?.needsReconnect ? `${reconnectReason(err)} The message is still in ${item.folder}.` : describeError(err), attempts}
+                : {status: 'pending', at: new Date(Date.now() + RETRY_MS), error: describeError(err), attempts});
             logger.warn(
                 `[mail] could not wake snoozed message ${item._id} (attempt ${attempts}): ${err.message}`
             );

package/plugins/_lib/mail/send.js

@@ -14,6 +14,7 @@ import nodemailer from 'nodemailer';
 
 import {bareAddress, formatFrom} from '../admin/mail/identity.js';
 import {describeError} from './imapPool.js';
+import {pinMailHost} from './hostGuard.js';
 import {normalisePriority, priorityHeaders} from './priority.js';
 import {normaliseMessageSource, recordMessageAction, SOURCE_HEADER} from './message-action.js';
 
@@ -213,22 +214,31 @@ export async function sendMessage({
     // running its own mail server with a self-signed certificate has the same
     // problem in both directions, and two switches for one decision is how
     // one of them ends up wrong.
-    const transport = nodemailer.createTransport({
-        ...smtp.transport,
-        tls: {rejectUnauthorized: !allowInsecureTLS}
-    });
-    const info = await transport.sendMail({
-        envelope: {
-            // Bare, always. A display name here is not decoration the server
-            // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
-            // is a free-text field somebody may well have typed a name into.
-            from: bareAddress(smtp.from),
-            to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
-                .map(a => a.address)
-        },
-        raw
-    });
-    transport.close();
+    // The mail server's own words never leave as the error (they say what
+    // listens on a port): describeError's plain text, the detail in the log.
+    let transport;
+    let info;
+    try {
+        transport = nodemailer.createTransport({
+            ...await pinnedTransport(smtp.transport, pool?.mailHostOptions),
+            tls: {rejectUnauthorized: !allowInsecureTLS}
+        });
+        info = await transport.sendMail({
+            envelope: {
+                // Bare, always. A display name here is not decoration the server
+                // ignores - it is a MAIL FROM the server rejects, and `smtp.from`
+                // is a free-text field somebody may well have typed a name into.
+                from: bareAddress(smtp.from),
+                to: [...addresses(draft.to), ...addresses(draft.cc), ...addresses(draft.bcc)]
+                    .map(a => a.address)
+            },
+            raw
+        });
+    } catch (err) {
+        throw plainSendError(err, smtp.transport);
+    } finally {
+        transport?.close();
+    }
 
     const messageAction = await recordMessageAction({
         source: draft.sourceMessage, account, pool, poolKey, connection, store
@@ -383,15 +393,54 @@ async function findSentFolder(pool, poolKey, connection) {
     return findSpecialFolder(pool, poolKey, connection, '\\Sent');
 }
 
+/**
+ * A send failure as plain words. Our own errors (a refused host, a mailbox that
+ * needs signing in again) pass as they are; anything from the server or the
+ * library becomes describeError()'s text, keeping `code` so a caller can still
+ * tell an authentication failure from the rest.
+ *
+ * @param   {Error} err
+ * @param   {object} transportConfig
+ * @returns {Error}
+ */
+export function plainSendError(err, transportConfig = {}) {
+    if (!err || err.needsReconnect || err.mailHostRefused || err.name === 'MailKeyError') return err;
+    const plain = new Error(describeError(err, transportConfig));
+    if (err.code) plain.code = err.code;
+    if (err.responseCode) plain.responseCode = err.responseCode;
+    return plain;
+}
+
+/**
+ * A mailbox's transport settings with the host checked and pinned: connect to
+ * the address hostGuard.js checked, keep the name for TLS. Throws when the
+ * host or port is refused, or the name does not resolve.
+ *
+ * @param   {object} transportConfig - {host, port, ...}
+ * @param   {{allowPrivate?: boolean}} [guard] - the plugin's allowPrivateMailHosts, when the caller has it
+ * @returns {Promise<object>}
+ */
+export async function pinnedTransport(transportConfig, guard = {}) {
+    const port = Number(transportConfig.port) || (transportConfig.secure ? 465 : 587);
+    const {address, servername} = await pinMailHost(transportConfig.host, port, {kind: 'smtp', ...(guard || {})});
+    return {...transportConfig, port, host: address, ...(servername && {servername})};
+}
+
 /**
  * Try the outgoing server without sending anything.
  *
  * @param   {object} transportConfig
  * @returns {Promise<{ok: boolean, error?: string}>}
  */
-export async function verifySmtp(transportConfig, allowInsecureTLS = false) {
+export async function verifySmtp(transportConfig, allowInsecureTLS = false, guard = undefined) {
+    let pinned;
+    try {
+        pinned = await pinnedTransport(transportConfig, guard);
+    } catch (err) {
+        return {ok: false, error: describeError(err, transportConfig)};
+    }
     const transport = nodemailer.createTransport({
-        ...transportConfig,
+        ...pinned,
         connectionTimeout: 10_000,
         tls: {rejectUnauthorized: !allowInsecureTLS}
     });

package/plugins/free-tier.lock.json

@@ -1,6 +1,6 @@
 {
   "note": "Written by `make sync-free-tier` in dcms-marketplace. Do not edit these plugins here - edit them there and sync.",
-  "source": "dcms-marketplace@ddb1e0c",
+  "source": "dcms-marketplace@af8baa8",
   "plugins": {
     "blog": {
       "version": "1.10.1",
@@ -165,9 +165,9 @@
       }
     },
     "security": {
-      "version": "1.2.0",
+      "version": "1.2.1",
       "files": {
-        "CLAUDE.md": "c4a8cedeff2af492871d2b9af446c6b73792881f4e428e189516105508bc07e5",
+        "CLAUDE.md": "1aabef04e77d9bd10ead195851a75c358b5c6657a57ad217495cf7b5b0d63538",
         "admin/lib/blocks.js": "5ef346b7de751518f8beb9212e3b89b270ae236560ae3d8a1f40d129c50918ff",
         "admin/lib/health.js": "3b233a3d29b2d69c333321602c13233b8221cfe1114aa03903739d9ae8ad65d5",
         "admin/lib/ip.js": "cf33be4fa2e2cad37bafd12ebec17f293891a88de402caad1bf9c9a57ce87680",
@@ -183,11 +183,12 @@
         "config.js": "e6a00f7816637687d6a68ebbac65a71489246a926c28523c2a78d859e75b7ae0",
         "docs/guide.md": "a27d5303f9146057fd79c2093d7476ada1a5ee4fd14d34df7f94ad8555d88ca0",
         "plugin.js": "9d3a2e8b56dd637407c8abd93252dda9f67042231bc79d35771f766a62022c14",
-        "plugin.json": "5cf525d76b1f043a475268f8d37622bdb53120e0c34a1068930d7fcff88ea686",
+        "plugin.json": "c7ebf55a71048e914ca8e6d2f042fb099123367e1e6fd694cfbf9eb2e4146852",
         "server/common-passwords.NOTICE": "3b148a49a569bfa24feaa7879db602da8f0607fa61ab6c52b7a62391fc7c009a",
         "server/common-passwords.txt": "68782d6a4a19a4768d5f15dd66bd534e7a33055cc755411e33f16d18c50fdcce",
-        "server/facts.js": "25538a8d1cfe012688fceb8ec0d0dd7b43ac9e168430723d6fb731183701fb46",
+        "server/facts.js": "8dbf6802acd9103fe4ca8d5e7d2dfc97c169df6d47bea72b33411cd22fee597b",
         "server/state.js": "1319b322e94a4aec176948990b2d674b28dfece761eef4d5685df474037bfc4a",
+        "tests/facts.test.js": "dc59d307033c7a9887b4d522bccd9e9d4986b6ed5cb4ffe1287282a93f54cb11",
         "tests/screen-state.test.js": "5349273cf7cfe526a05f929115a6e4e66287e6fb05b252ea859e182e88e3925e",
         "tests/security.test.js": "f0cb70dcb28bc8b3de8d3b39064616296382c5b0f97bfd615ee8e24fe3b031bc"
       }

package/plugins/security/CLAUDE.md

@@ -24,7 +24,10 @@ Ships with the engine (free tier, `make sync-free-tier`); switched ON when it fi
   `kind: 'reset'` lines - their `ok` is not a sign-in. Older engines never emit the event: nothing changes there.
 - **Health check**: `server/facts.js` gathers (users, engine vs npm latest, certificate via tls, security headers of the
   public home page, private paths fetched LOCALLY, TRUST_PROXY, bind, SMTP, licences); `admin/lib/health.js` judges.
-  Unknown = 'info', never a pass. Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
+  Unknown = 'info', never a pass. The public checks (headers, HTTPS, certificate) connect ONLY to `publicTarget()`:
+  site.json `baseUrl`/`url` when it is a public name (every DNS answer public), else the admin's own Host but only
+  when it resolves to one of this server's public interface addresses - never a host a visitor names (1.2.1). The
+  connection is pinned to the checked address (no second DNS lookup). Cached 10 min; the sidebar badge (`/count`) = checks needing attention, red only
   when a failing check is critical.
 - Engines before 0.83 have no sign-in checks: the plugin logs it, the screen says so, lockout/rules are off.
 - plugin.json `minCmsVersion: "0.83.0"` (1.1.1) states that floor; core enforces it at install/update from the release after 0.92.1,
@@ -63,3 +66,8 @@ what strangers typed). Public data (emails, addresses, user-agents) only through
   `security.rule-draft.<user>`. Pure parts in `admin/lib/screen-state.js` (Pro's copy adds Audit and 2FA).
 - Every list: click/Enter/Shift+F10/right-click/⋮ open the row menu (a check row opens its details on click). Filter
   counts follow the search; skeletons; help popovers started after mount. Keep this screen alike with Security Pro's.
+
+## 1.2.1 (2026-10-16)
+
+- Health check: the headers/certificate fetch no longer goes to whatever Host / X-Forwarded-Host a request carried
+  (a forged one made the server connect anywhere). `publicTarget()` in server/facts.js; `tests/facts.test.js`.

package/plugins/security/plugin.json

@@ -1,11 +1,11 @@
 {
   "name": "security",
   "displayName": "Security",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "tier": "free",
   "description": "Keeps a Domma CMS site safe: a health check of what is weak and how to fix it, sign-in lockout after repeated wrong passwords, password rules, a log of every sign-in, and blocking of the scanners that probe every site for WordPress, .env files and the like.",
   "author": "Domma CMS",
-  "date": "2026-10-15",
+  "date": "2026-10-16",
   "minCmsVersion": "0.83.0",
   "icon": "shield",
   "permissions": [

package/plugins/security/server/facts.js

@@ -5,7 +5,12 @@
  *
  * Slow answers (the latest engine version, the certificate) are cached.
  */
+import dns from 'node:dns';
 import fs from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+import net from 'node:net';
+import os from 'node:os';
 import path from 'node:path';
 import tls from 'node:tls';
 import {getConfig} from '../../../server/config.js';
@@ -21,6 +26,7 @@ async function cached(key, ms, fn) {
     const hit = cache.get(key);
     if (hit && hit.until > Date.now()) return hit.value;
     const value = await fn();
+    if (cache.size > 200) for (const [k, v] of cache) if (v.until <= Date.now()) cache.delete(k);
     cache.set(key, {value, until: Date.now() + ms});
     return value;
 }
@@ -41,11 +47,11 @@ async function engine() {
     return {installed, latest};
 }
 
-/** Days left on the certificate the site serves (cached 6 h). */
-function certificate(host) {
-    return cached(`cert:${host}`, 6 * 3_600_000, () => new Promise((resolve) => {
+/** Days left on the certificate the site serves (cached 6 h). Connects only to the checked address. */
+export function certificate({host, address, port = 443}) {
+    return cached(`cert:${host}:${address}`, 6 * 3_600_000, () => new Promise((resolve) => {
         const done = (v) => { try { socket.destroy(); } catch { /* gone */ } resolve(v); };
-        const socket = tls.connect({host, port: 443, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
+        const socket = tls.connect({host: address, port, servername: host, rejectUnauthorized: false, timeout: TIMEOUT}, () => {
             const c = socket.getPeerCertificate();
             if (!c?.valid_to) return done({daysLeft: null, error: 'no certificate'});
             done({daysLeft: Math.floor((Date.parse(c.valid_to) - Date.now()) / 86_400_000), issuer: c.issuer?.O || c.issuer?.CN || ''});
@@ -55,23 +61,34 @@ function certificate(host) {
     }));
 }
 
-/** The security headers the public home page is served with. */
-async function headers(origin) {
-    try {
-        const res = await fetch(`${origin}/`, {redirect: 'manual', signal: AbortSignal.timeout(TIMEOUT), headers: {'user-agent': 'Domma Security health check'}});
-        const h = (n) => res.headers.get(n) || '';
-        const csp = h('content-security-policy');
-        return {
-            https: origin.startsWith('https:'),
-            csp: Boolean(csp),
-            nosniff: /nosniff/i.test(h('x-content-type-options')),
-            frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
-            referrer: Boolean(h('referrer-policy')),
-            hsts: Boolean(h('strict-transport-security'))
-        };
-    } catch (e) {
-        return {error: e.name === 'TimeoutError' ? 'timed out' : (e.cause?.code || e.message)};
-    }
+/** The security headers the public home page is served with. Connects only to the checked address. */
+export function headers({host, proto, address, port}) {
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (v) => { if (!settled) { settled = true; resolve(v); } };
+        const secure = proto === 'https';
+        const req = (secure ? https : http).request({
+            host: address, port: port || (secure ? 443 : 80), path: '/', method: 'GET', agent: false,
+            ...(secure ? {servername: host} : {}),
+            headers: {host, 'user-agent': 'Domma Security health check'}
+        }, (res) => {
+            const h = (n) => String(res.headers[n] || '');
+            const csp = h('content-security-policy');
+            res.resume();
+            finish({
+                https: secure,
+                csp: Boolean(csp),
+                nosniff: /nosniff/i.test(h('x-content-type-options')),
+                frame: Boolean(h('x-frame-options')) || /frame-ancestors/i.test(csp),
+                referrer: Boolean(h('referrer-policy')),
+                hsts: Boolean(h('strict-transport-security'))
+            });
+        });
+        const timer = setTimeout(() => { finish({error: 'timed out'}); req.destroy(); }, TIMEOUT);
+        req.on('error', (e) => finish({error: e.code || e.message}));
+        req.on('close', () => clearTimeout(timer));
+        req.end();
+    });
 }
 
 /** Private paths asked of the CMS itself (locally, so Security's own probe filter does not hide them). */
@@ -91,18 +108,76 @@ async function probeFiles(port) {
 
 const isLocalHost = (h) => !h || h === 'localhost' || /^[\d.]+$/.test(h) || h.includes(':') || h.endsWith('.local') || h.endsWith('.test');
 
+/** Not a public address: loopback, private, link-local, CGNAT, unique-local, unspecified, multicast. */
+export function isPrivateAddress(ip) {
+    const a = String(ip || '').toLowerCase().replace(/^::ffff:(?=\d+\.)/, '');
+    if (net.isIPv4(a)) {
+        const [o1, o2] = a.split('.').map(Number);
+        return o1 === 0 || o1 === 10 || o1 === 127 || o1 >= 224 || (o1 === 169 && o2 === 254) || (o1 === 172 && o2 >= 16 && o2 <= 31)
+            || (o1 === 192 && o2 === 168) || (o1 === 100 && o2 >= 64 && o2 <= 127) || (o1 === 192 && o2 === 0) || (o1 === 198 && (o2 === 18 || o2 === 19));
+    }
+    // IPv6: loopback, unspecified, IPv4-compatible/mapped (anything under ::/16), NAT64 (64:ff9b::), 6to4 (2002::),
+    // unique-local, link-local, site-local, multicast - an embedded IPv4 is never trusted to be public.
+    if (net.isIPv6(a)) return a.startsWith('::') || /^64:ff9b:/.test(a) || /^2002:/.test(a) || /^(fc|fd|fe[89a-f]|ff)/.test(a);
+    return true;
+}
+
+/** This machine's own public addresses (its network interfaces, not loopback or private ones). */
+export function ownPublicAddresses() {
+    return new Set(Object.values(os.networkInterfaces()).flat().filter(i => i && !i.internal)
+        .map(i => String(i.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '').split('%')[0]).filter(a => !isPrivateAddress(a)));
+}
+
+const urlHost = (raw) => {
+    try {
+        const u = new URL(String(raw || ''));
+        return /^https?:$/.test(u.protocol) ? {host: u.hostname.toLowerCase(), proto: u.protocol.slice(0, -1)} : null;
+    } catch { return null; }
+};
+
+/**
+ * Where the public checks (headers, HTTPS, certificate) may connect - never a host named by a
+ * visitor. The site's configured address (site.json `baseUrl`, else `url`) when it has a public
+ * name (a configured name that fails the checks gives null, never a fallback); otherwise the name the admin used, but ONLY when it resolves to one of this server's own
+ * public addresses (a hosted site has no configured address, and its name points here). Either
+ * way the connection is pinned to the checked address, so a second DNS answer cannot move it.
+ * Null = leave those checks unanswered (as on localhost).
+ *
+ * @returns {Promise<{host: string, proto: 'http'|'https', address: string, source: 'config'|'request'}|null>}
+ */
+export async function publicTarget(request, {site = getConfig('site') || {}, lookup = dns.promises.lookup, own = ownPublicAddresses()} = {}) {
+    const resolve = async (host) => {
+        try { return (await lookup(host, {all: true})).map(r => String(r.address).toLowerCase().replace(/^::ffff:(?=\d+\.)/, '')); }
+        catch { return []; }
+    };
+    const configured = urlHost(site.baseUrl) || urlHost(site.url);
+    if (configured && !isLocalHost(configured.host)) {
+        const addrs = await resolve(configured.host);
+        // Every answer must be public (or this server's own): an address the admin typed is still not a way inside.
+        if (!addrs.length || !addrs.every(a => own.has(a) || !isPrivateAddress(a))) return null;
+        return {...configured, address: addrs[0], source: 'config'};
+    }
+    // A local configured address (the shipped default is http://localhost:4096) says nothing about the public name.
+
+    const host = String(request.hostname || '').split(':')[0].toLowerCase();
+    if (isLocalHost(host) || !/^[a-z0-9.-]+$/.test(host)) return null;
+    const mine = (await resolve(host)).find(a => own.has(a));
+    if (!mine) return null;
+    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
+    return {host, proto, address: mine, source: 'request'};
+}
+
 /**
  * Everything the health check needs.
  *
- * @param {import('fastify').FastifyRequest} request - the admin asking (its host is the site's)
+ * @param {import('fastify').FastifyRequest} request - the admin asking
  * @param {{settings: object, checks: boolean, twoFactor?: boolean}} ctx
+ * @param {{target?: object}} [deps] - tests: options for publicTarget()
  */
-export async function gatherFacts(request, {settings, checks, twoFactor = false}) {
+export async function gatherFacts(request, {settings, checks, twoFactor = false}, deps = {}) {
     const server = readJson(path.join(CMS_ROOT, 'config', 'server.json')) || {};
     const port = Number(process.env.PORT) || server.port || 4096;
-    const host = String(request.hostname || '').split(':')[0];
-    const proto = request.protocol === 'https' || request.headers['x-forwarded-proto'] === 'https' ? 'https' : 'http';
-    const origin = isLocalHost(host) ? `http://127.0.0.1:${port}` : `${proto}://${host}`;
+    const target = await publicTarget(request, deps.target);
 
     const users = (await listUsers()).map(u => ({name: u.name, email: u.email, role: u.role, lastLogin: u.lastLogin || null,
         createdAt: u.createdAt || null, isActive: u.isActive !== false, level: getEffectiveLevel(u)}));
@@ -111,10 +186,11 @@ export async function gatherFacts(request, {settings, checks, twoFactor = false}
 
     const [eng, cert, head, probes] = await Promise.all([
         engine(),
-        isLocalHost(host) ? Promise.resolve(null) : certificate(host),
+        target ? certificate(target) : Promise.resolve(null),
         // Headers and HTTPS are about the PUBLIC site: without a public name to ask (a check run by the site
-        // itself, or on localhost) they are left unanswered rather than judged on the local port.
-        isLocalHost(host) ? Promise.resolve(null) : headers(origin),
+        // itself, on localhost, or a name that is not this server's) they are left unanswered rather than
+        // judged on the local port.
+        target ? headers(target) : Promise.resolve(null),
         probeFiles(port)
     ]);
     const smtp = getConfig('site')?.smtp || {};

package/plugins/security/tests/facts.test.js

@@ -0,0 +1,109 @@
+/** Security - the health check never connects to a host a visitor names (Host / X-Forwarded-Host). */
+import {test} from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import Fastify from 'fastify';
+import {certificate, gatherFacts, headers, isPrivateAddress, publicTarget} from '../server/facts.js';
+
+const OWN = '82.165.196.228';
+const DNS = {'evil.example': ['203.0.113.9'], 'inside.example': ['127.0.0.1'], 'lan.example': ['10.0.0.5'],
+    'site.example': [OWN], 'mixed.example': ['10.0.0.5', OWN], 'configured.example': ['198.51.100.7']};
+
+/** A fake resolver that records every name it was asked about. */
+function resolver() {
+    const asked = [];
+    const lookup = async (host) => {
+        asked.push(host);
+        if (!DNS[host]) throw Object.assign(new Error('ENOTFOUND'), {code: 'ENOTFOUND'});
+        return DNS[host].map(address => ({address, family: address.includes(':') ? 6 : 4}));
+    };
+    return {asked, lookup};
+}
+
+/** Run publicTarget() on a real Fastify request (trustProxy on, so X-Forwarded-Host is believed - the worst case). */
+async function targetFor(headers, deps) {
+    const app = Fastify({trustProxy: true});
+    app.get('/t', async (request) => ({target: await publicTarget(request, deps)}));
+    const res = await app.inject({method: 'GET', url: '/t', headers});
+    await app.close();
+    return res.json().target;
+}
+
+test('a forged Host or X-Forwarded-Host is never a target', async () => {
+    for (const headers of [
+        {host: 'evil.example'},
+        {host: 'site.example', 'x-forwarded-host': 'evil.example'},
+        {host: 'inside.example'},
+        {host: 'site.example', 'x-forwarded-host': 'lan.example'},
+        {host: 'site.example', 'x-forwarded-host': 'nowhere.example'},
+        {host: '169.254.169.254'},
+        {host: 'site.example', 'x-forwarded-host': '10.0.0.5:8080'}
+    ]) {
+        const {lookup} = resolver();
+        assert.equal(await targetFor(headers, {site: {}, lookup, own: new Set([OWN])}), null, JSON.stringify(headers));
+    }
+});
+
+test('the name the admin used is checked only when it resolves to this server, and pinned there', async () => {
+    const {lookup} = resolver();
+    const t = await targetFor({host: 'site.example', 'x-forwarded-proto': 'https'}, {site: {url: 'http://localhost:4096'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'site.example', proto: 'https', address: OWN, source: 'request'});
+    // Several answers: the connection goes to this server's own one, never the other.
+    const m = await targetFor({host: 'mixed.example'}, {site: {}, lookup, own: new Set([OWN])});
+    assert.equal(m.address, OWN);
+});
+
+test('a configured public address wins, and the request headers are not even looked up', async () => {
+    const {asked, lookup} = resolver();
+    const t = await targetFor({host: 'evil.example', 'x-forwarded-host': 'evil.example'},
+        {site: {baseUrl: 'https://configured.example'}, lookup, own: new Set([OWN])});
+    assert.deepEqual(t, {host: 'configured.example', proto: 'https', address: '198.51.100.7', source: 'config'});
+    assert.deepEqual(asked, ['configured.example']);
+});
+
+test('a configured address that resolves inside is refused, with no fallback to the request', async () => {
+    const {asked, lookup} = resolver();
+    assert.equal(await targetFor({host: 'site.example'}, {site: {url: 'https://lan.example'}, lookup, own: new Set([OWN])}), null);
+    assert.deepEqual(asked, ['lan.example']);
+});
+
+test('gatherFacts with forged headers leaves the public checks unanswered and connects nowhere', async () => {
+    const {asked, lookup} = resolver();
+    const request = {hostname: 'evil.example', protocol: 'https',
+        headers: {host: 'evil.example', 'x-forwarded-host': 'evil.example', 'x-forwarded-proto': 'https'}};
+    const settings = {lockout: {enabled: true}, policy: {enabled: true, minLength: 10}};
+    const started = Date.now();
+    const facts = await gatherFacts(request, {settings, checks: true}, {target: {site: {}, lookup, own: new Set([OWN])}});
+    assert.equal(facts.headers, null);
+    assert.equal(facts.cert, null);
+    assert.deepEqual(asked, ['evil.example']);
+    assert.ok(Date.now() - started < 20_000);
+});
+
+test('isPrivateAddress', () => {
+    for (const a of ['127.0.0.1', '10.1.2.3', '172.16.0.1', '192.168.1.1', '169.254.169.254', '100.64.0.1', '0.0.0.0', '192.0.0.8', '198.18.0.1',
+        '::', '::1', '::7f00:1', '::ffff:127.0.0.1', '64:ff9b::a00:1', '2002:7f00:1::1', 'fd00::1', 'fe80::1', 'fec0::1', 'ff02::1', 'nonsense'])
+        assert.equal(isPrivateAddress(a), true, a);
+    for (const a of [OWN, '8.8.8.8', '2a00:1450:4009::1'])
+        assert.equal(isPrivateAddress(a), false, a);
+});
+
+test('the checks connect to the pinned address, sending the name only as Host / SNI', async () => {
+    const seen = [];
+    const web = http.createServer((req, res) => { seen.push(req.headers.host); res.setHeader('x-content-type-options', 'nosniff'); res.end('ok'); });
+    await new Promise(r => web.listen(0, '127.0.0.1', r));
+    const h = await headers({host: 'site.example', proto: 'http', address: '127.0.0.1', port: web.address().port});
+    web.close();
+    assert.deepEqual(seen, ['site.example']);
+    assert.equal(h.nosniff, true);
+    assert.equal(h.https, false);
+
+    let connected = 0;
+    const raw = net.createServer((sock) => { connected++; sock.destroy(); });
+    await new Promise(r => raw.listen(0, '127.0.0.1', r));
+    const c = await certificate({host: 'pinned.example', address: '127.0.0.1', port: raw.address().port});
+    raw.close();
+    assert.equal(connected, 1);
+    assert.equal(c.daysLeft, null);
+});

package/server/routes/api/forms.js

@@ -27,7 +27,7 @@ import {deleteForm, ensureCollectionForForm, ensureFormsDir, listForms, readForm
 import {executeAction} from '../../services/actions.js';
 // The same rules the browser draws the buttons by (a Cancel link must be safe).
 import {buttonSettingsProblems, formClassProblems, publicButtonSettings} from '../../../public/js/form-submit.mjs';
-import {createTransport, sendFormEmail} from '../../services/email.js';
+import {createTransport, mailFailure, sendFormEmail, TEST_EMAIL_FAILED} from '../../services/email.js';
 import {formActionFailed, formTriggerNotice} from '../../services/notification-sources.js';
 import {
     clearEntries,
@@ -1063,7 +1063,9 @@ export async function formsRoutes(fastify) {
             });
             return { ok: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send test email: ${err.message}` });
+            // Plain words only - the server's own are in the log (email.js mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 }

package/server/routes/api/settings.js

@@ -11,7 +11,9 @@ import {faviconSource, generateFavicon} from '../../services/favicon.js';
 import {saveMedia} from '../../services/content.js';
 import {randomUUID} from 'node:crypto';
 import {authenticate, requirePermission} from '../../middleware/auth.js';
-import {createTransport} from '../../services/email.js';
+import {createTransport, mailFailure, TEST_EMAIL_FAILED} from '../../services/email.js';
+import {signedOnly} from '../../services/codePolicy.js';
+import {resolveMailHost} from '../../services/mailHost.js';
 import fs from 'fs/promises';
 import path from 'path';
 import {fileURLToPath} from 'url';
@@ -171,6 +173,17 @@ export async function settingsRoutes(fastify) {
         if (merged.smtp && merged.smtp.pass === '' && existing.smtp?.pass) {
             merged.smtp = {...merged.smtp, pass: existing.smtp.pass};
         }
+        // Hosted sites: refuse a mail server this site would not connect to, at
+        // save, so it is not found out at the first password reset.
+        if (signedOnly() && merged.smtp?.host
+            && (merged.smtp.host !== existing.smtp?.host || merged.smtp.port !== existing.smtp?.port)) {
+            try {
+                await resolveMailHost(merged.smtp.host, Number(merged.smtp.port) || 587, {kind: 'smtp', signed: true});
+            } catch (err) {
+                if (err.mailHostRefused) return reply.code(400).send({error: err.message});
+                // A name that does not resolve yet is the send's problem, not the save's.
+            }
+        }
         saveConfig('site', merged);
         await cache.invalidateTags(['site']);
         return { success: true };
@@ -182,16 +195,16 @@ export async function settingsRoutes(fastify) {
             return reply.status(400).send({ error: 'SMTP is not configured. Save your SMTP settings first.' });
         }
 
-        // Shared transport factory - carries the self-signed-cert TLS relaxation.
-        // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
-        const transporter = await createTransport(smtp);
-
         const to = request.body?.to || smtp.fromAddress;
         if (!to) {
             return reply.status(400).send({ error: 'No recipient address. Provide "to" in the request body or set a From Address.' });
         }
 
         try {
+            // Shared transport factory - carries the self-signed-cert TLS relaxation
+            // and, on hosted sites, the mail-host rules (services/mailHost.js).
+            // Do NOT build a raw nodemailer transport here; that regresses on engine sync.
+            const transporter = await createTransport(smtp);
             await transporter.sendMail({
                 from:    smtp.fromName ? `"${smtp.fromName}" <${smtp.fromAddress}>` : smtp.fromAddress,
                 to,
@@ -201,7 +214,10 @@ export async function settingsRoutes(fastify) {
             });
             return { success: true, message: `Test email sent to ${to}` };
         } catch (err) {
-            return reply.status(500).send({ error: `Failed to send email: ${err.message}` });
+            // Never the mail server's words: they say what listens on a host and
+            // port. The detail is in the server log (mailFailure).
+            const plain = mailFailure(err);
+            return reply.status(500).send({ error: plain.refused ? `${TEST_EMAIL_FAILED} ${plain.message}` : TEST_EMAIL_FAILED });
         }
     });
 

package/server/services/email.js

@@ -3,6 +3,82 @@
  * Nodemailer transport factory and generic form email sending utility.
  */
 import nodemailer from 'nodemailer';
+import {signedOnly} from './codePolicy.js';
+import {resolveMailHost} from './mailHost.js';
+
+/**
+ * What a person is told when mail could not be sent. The mail server's own
+ * words (and the library's) go to the server log only: they say what is
+ * listening on a host and port, which is how a mail setting becomes a scanner
+ * of the server's network.
+ */
+export const MAIL_SEND_FAILED = 'Could not send the email. Check the mail server settings.';
+export const TEST_EMAIL_FAILED = 'Could not send the test email. Check the mail server settings.';
+
+/** The error every send fails with: plain words, nothing from the server. */
+export class MailSendError extends Error {
+    constructor(message = MAIL_SEND_FAILED, {refused = false} = {}) {
+        super(message);
+        this.code = 'EMAILSEND';
+        this.mailSendFailed = true;
+        // The host or port was refused by services/mailHost.js - the message is ours, not the server's.
+        this.refused = refused;
+    }
+}
+
+/**
+ * Log a send failure in full, and hand back the plain error to throw.
+ *
+ * @param {unknown} err
+ * @returns {MailSendError}
+ */
+export function mailFailure(err) {
+    if (err instanceof MailSendError) return err;
+    const detail = err?.message || String(err);
+    console.warn(`[email] send failed${err?.code ? ` (${err.code})` : ''}: ${detail}`);
+    return err?.mailHostRefused ? new MailSendError(err.message, {refused: true}) : new MailSendError();
+}
+
+/** Wrap sendMail/verify (promise or callback style) so only plain errors leave. */
+function guardTransportErrors(transport) {
+    for (const method of ['sendMail', 'verify']) {
+        const real = transport[method]?.bind(transport);
+        if (!real) continue;
+        transport[method] = (...args) => {
+            const cb = typeof args.at(-1) === 'function' ? args.pop() : null;
+            const p = Promise.resolve().then(() => real(...args)).catch(err => { throw mailFailure(err); });
+            if (!cb) return p;
+            p.then(info => cb(null, info), err => cb(err));
+            return undefined;
+        };
+    }
+    return transport;
+}
+
+/**
+ * A transport for a signed-only site: each send checks the host again and
+ * connects to the address it checked (the name kept for TLS), so neither a
+ * changed setting nor a second DNS answer can point it inward. nodemailer's SMTP
+ * transport opens a connection per message anyway, so a transport per send
+ * costs nothing extra.
+ */
+function pinnedTransport(base, {lookup} = {}) {
+    const open = async () => {
+        const {address, servername} = await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+        return nodemailer.createTransport({...base, host: address, ...(servername && {servername})});
+    };
+    const run = async (method, args) => {
+        const t = await open();
+        try { return await t[method](...args); } finally { t.close(); }
+    };
+    return guardTransportErrors({
+        options: {...base},
+        sendMail: (message) => run('sendMail', [message]),
+        verify: () => run('verify', []),
+        close: () => {},
+        isIdle: () => true
+    });
+}
 
 let lastSendResult = null;
 
@@ -70,15 +146,27 @@ export function isSmtpConfigured(smtp) {
  * @returns {Promise<import('nodemailer').Transporter>}
  * @throws {Error} If Ethereal test account creation fails.
  */
-export async function createTransport(smtp) {
+export async function createTransport(smtp, {signed, lookup} = {}) {
     if (isSmtpConfigured(smtp)) {
-        return nodemailer.createTransport({
+        const base = {
             host: smtp.host,
-            port: smtp.port || 587,
+            port: Number(smtp.port) || 587,
             secure: smtp.secure || false,
             auth: smtp.user ? { user: smtp.user, pass: smtp.pass } : undefined,
             tls: { rejectUnauthorized: false }
-        });
+        };
+        // Hosted (signed-only) sites: loopback or a public mail server on a mail
+        // port, connected by the checked address - services/mailHost.js.
+        // Self-hosted sites may use any relay, internal ones included, as before.
+        if (signed ?? signedOnly()) {
+            try {
+                await resolveMailHost(base.host, base.port, {kind: 'smtp', signed: true, lookup});
+            } catch (err) {
+                throw mailFailure(err);
+            }
+            return pinnedTransport(base, {lookup});
+        }
+        return guardTransportErrors(nodemailer.createTransport(base));
     }
 
     // No SMTP configured - use Ethereal for dev/demo.
@@ -152,8 +240,9 @@ export async function sendEmail(transport, {from, fromName, to, subject, html, t
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }
 
@@ -213,7 +302,8 @@ export async function sendFormEmail(transport, { from, fromName, to, subject, fo
         }
         return info;
     } catch (err) {
-        recordSendResult(false, err.message);
-        throw err;
+        const plain = mailFailure(err);
+        recordSendResult(false, plain.message);
+        throw plain;
     }
 }

package/server/services/mailHost.js

@@ -0,0 +1,100 @@
+/**
+ * Where this server may open a mail connection (SMTP or IMAP) to a host a site
+ * user typed - and the address it then connects to.
+ *
+ * A mail host is a TCP target the admin chooses, and a failed connection says
+ * what is listening there, so an unchecked host is a scanner of the server's
+ * own network. The address rules are services/outbound.js's (`resolvePublic`,
+ * `isBlockedAddress`): every address the name resolves to must be public,
+ * IPv4-mapped / NAT64 / decimal and octal spellings included. This module adds
+ * what is particular to mail:
+ *
+ *  - Signed-only sites (codePolicy.signedOnly() - every site a Manager hosts)
+ *    may name `localhost`, `127.0.0.1` or `::1` (hosted sites send through the
+ *    box's own port 25) or a public mail server, on the mail ports only
+ *    (SMTP 25/465/587/2525, IMAP 143/993). Nothing the site's admin sets lifts
+ *    that - not `outboundAllowPrivate`, not a mail plugin's
+ *    `allowPrivateMailHosts`, not the site's own SMTP host.
+ *  - This server's own PUBLIC address is not refused here (outbound.js refuses
+ *    it for web requests): a hosted mailbox at mail.<domain> on the same box is
+ *    normal, and on a signed-only site the port list keeps it to mail.
+ *  - The connection goes to the address that was checked (`address`), with the
+ *    name kept for TLS (`servername`), so a second DNS answer cannot swap in an
+ *    internal one (DNS rebinding).
+ *
+ * Self-hosted sites keep their freedom: core's site SMTP is not checked at all
+ * there (an internal relay is normal), and the mail plugins' own rules apply
+ * (plugins/_lib/mail/hostGuard.js).
+ *
+ * @module services/mailHost
+ */
+import dns from 'node:dns';
+import net from 'node:net';
+import {FetchRefused, resolvePublic} from './outbound.js';
+import {signedOnly} from './codePolicy.js';
+
+export const SMTP_PORTS = Object.freeze([25, 465, 587, 2525]);
+export const IMAP_PORTS = Object.freeze([143, 993]);
+
+/** The loopback names a signed-only site may use, and the address each one is. */
+const LOOPBACK = Object.freeze({localhost: '127.0.0.1', '127.0.0.1': '127.0.0.1', '::1': '::1'});
+
+export const REFUSED_PRIVATE = 'That mail server is on a private network, so this site will not connect to it. '
+    + 'Use the mail server\'s public name.';
+
+export class MailHostRefused extends Error {
+    constructor(message) { super(message); this.code = 'EMAILHOST_REFUSED'; this.mailHostRefused = true; }
+}
+
+/**
+ * Normalise a typed host for comparison: case, spaces, trailing dot, IPv6 brackets.
+ *
+ * @param {string} host
+ * @returns {string}
+ */
+export function normaliseMailHost(host) {
+    return String(host ?? '').trim().toLowerCase().replace(/\.$/, '').replace(/^\[(.*)\]$/, '$1');
+}
+
+/**
+ * Check a mail host and port, and say which address to connect to.
+ *
+ * @param {string} host
+ * @param {number} port
+ * @param {object} [opts]
+ * @param {'smtp'|'imap'} [opts.kind='smtp']
+ * @param {boolean} [opts.signed] - codePolicy.signedOnly() when omitted
+ * @param {boolean} [opts.checkAddresses] - refuse private addresses (default: on when signed)
+ * @param {boolean} [opts.anyPort] - skip the port rule (a save route that has no port to hand; the connection checks it)
+ * @param {Function} [opts.lookup] - dns.promises.lookup, swappable in tests
+ * @returns {Promise<{address: string, family: number, servername: string|undefined}>}
+ * @throws {MailHostRefused} the host or port is not allowed
+ * @throws {Error} code ENOTFOUND - the name did not resolve (never connect by name instead)
+ */
+export async function resolveMailHost(host, port, {kind = 'smtp', signed, checkAddresses, anyPort = false, lookup = dns.promises.lookup} = {}) {
+    const isSigned = signed ?? signedOnly();
+    const check = checkAddresses ?? isSigned;
+    const name = normaliseMailHost(host);
+    if (!name) throw new MailHostRefused('A mail server is required.');
+    if (isSigned && !anyPort) {
+        const ports = kind === 'imap' ? IMAP_PORTS : SMTP_PORTS;
+        const n = Number(port);
+        if (!ports.includes(n)) throw new MailHostRefused(`Port ${Number.isFinite(n) ? n : port} is not used for mail here - use ${ports.join(', ')}.`);
+    }
+    const servername = net.isIP(name) ? undefined : name;
+    if (isSigned && Object.hasOwn(LOOPBACK, name)) {
+        const address = LOOPBACK[name];
+        return {address, family: net.isIP(address), servername};
+    }
+    try {
+        // own: an empty set - see the module note on this server's public address.
+        const r = await resolvePublic(name, {allowPrivate: !check, lookup, own: new Set()});
+        return {address: r.address, family: r.family, servername};
+    } catch (err) {
+        if (!(err instanceof FetchRefused)) throw err;
+        if (/could not be found/.test(err.message)) {
+            throw Object.assign(new Error(`getaddrinfo ENOTFOUND ${name}`), {code: 'ENOTFOUND'});
+        }
+        throw new MailHostRefused(REFUSED_PRIVATE);
+    }
+}

package/server/services/notification-sources.js

@@ -317,7 +317,8 @@ export async function registerCoreSources() {
 export function emailFailed(message) {
     return notify({source: 'core:email', severity: 'warning', dedupeKey: `email-failed:${day()}`, link: '#/settings',
         title: 'An email could not be sent',
-        body: `The mail server refused or could not be reached: ${String(message || '').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email.`});
+        // `message` is email.js's plain text, never the mail server's own words (those are in the server log).
+        body: `${String(message || 'The mail server refused the message or could not be reached.').slice(0, 300)}\n\nPassword resets and form emails may not be arriving. Check Settings > Email; the server log has the mail server's reply.`});
 }
 
 /** email.js: no SMTP host, so mail goes to a test inbox. */