mailauth 3.0.2 → 4.0.1

package/README.md

@@ -48,7 +48,8 @@ Where
         -   **selector** (_string_) ARC key selector
         -   **privateKey** (_string_ or _buffer_) Private key for signing. Either an RSA or an Ed25519 key
     -   **resolver** (_async function_) is an optional async function for DNS requests. Defaults to [dns.promises.resolve](https://nodejs.org/api/dns.html#dns_dnspromises_resolve_hostname_rrtype)
-    -   **maxResolveCount** (_number_ defaults to _50_) is the DNS lookup limit for SPF. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 10. Mailauth is less strict and defaults to 50.
+    -   **maxResolveCount** (_number_ defaults to _10_) is the DNS lookup limit for SPF. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 10.
+    -   **maxVoidCount** (_number_ defaults to _2_) is the DNS lookup limit for SPF that produce an empty result. [RFC7208](https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4) requires this limit to be 2.
 
 **Example**
 
@@ -403,7 +404,6 @@ The function returns a boolean. If it is `true`, then MX hostname is allowed to
 
 [OpenSPF test suite](http://www.openspf.org/Test_Suite) ([archive.org mirror](https://web.archive.org/web/20190130131432/http://www.openspf.org/Test_Suite)) with the following differences:
 
--   No PTR support in `mailauth`. All PTR related tests are ignored
 -   Less strict whitespace checks (`mailauth` accepts multiple spaces between tags etc.)
 -   Some macro tests are skipped (macro expansion is supported _in most parts_)
 -   Some tests where the invalid component is listed after a matching part (mailauth processes from left to right and returns on the first match found)

package/bin/mailauth.js

@@ -52,7 +52,13 @@ const argv = yargs(hideBin(process.argv))
                     alias: 'x',
                     type: 'number',
                     description: 'Maximum allowed DNS lookups',
-                    default: 50
+                    default: 10
+                })
+                .option('max-void-lookups', {
+                    alias: 'z',
+                    type: 'number',
+                    description: 'Maximum allowed empty DNS lookups',
+                    default: 2
                 });
             yargs.positional('email', {
                 describe: 'Path to the email message file in EML format. If not specified then content is read from stdin'
@@ -275,7 +281,13 @@ const argv = yargs(hideBin(process.argv))
                     alias: 'x',
                     type: 'number',
                     description: 'Maximum allowed DNS lookups',
-                    default: 50
+                    default: 10
+                })
+                .option('max-void-lookups', {
+                    alias: 'z',
+                    type: 'number',
+                    description: 'Maximum allowed empty DNS lookups',
+                    default: 2
                 });
         },
         argv => {
@@ -312,6 +324,12 @@ const argv = yargs(hideBin(process.argv))
                     type: 'string',
                     description: 'Sending domain to validate',
                     demandOption: false
+                })
+                .option('date', {
+                    alias: 't',
+                    type: 'string',
+                    description: 'ISO formatted timestamp for the certificate expiration checks',
+                    demandOption: false
                 });
         },
         argv => {

package/cli.md

@@ -59,7 +59,8 @@ Where
 -   `--mta hostname` or `-m hostname` is the server hostname doing the validation checks. Defaults to `os.hostname()`
 -   `--dns-cache /path/to/dns.json` or `-n path` is the path to a file with cached DNS query responses. If this file is provided then no actual DNS requests are performed, only cached values from this file are used.
 -   `--verbose` or `-v` if this flag is set then mailauth writes some debugging info to standard error
--   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 50.
+-   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 10.
+-   `--max-void-lookups nr` or `-z nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 2.
 
 **Example**
 
@@ -187,14 +188,15 @@ Where
 -   `--dns-cache /path/to/dns.json` or `-n path` is the path to a file with cached DNS query responses. If this file is provided then no actual DNS requests are performed, only cached values from this file are used.
 -   `--verbose` or `-v` if this flag is set then mailauth writes some debugging info to standard error
 -   `--headers-only` or `-o` If set return SPF authentication header only. Default is to return a JSON structure.
--   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 50.
+-   `--max-lookups nr` or `-x nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 10.
+-   `--max-void-lookups nr` or `-z nr` defines the allowed DNS lookup limit for SPF checks. Defaults to 2.
 
 **Example**
 
 ```
 $ mailauth spf --verbose -f andris@wildduck.email -i 217.146.76.20
 Checking SPF for andris@wildduck.email
-Maximum DNS lookups: 50
+Maximum DNS lookups: 10
 --------
 DNS query for TXT wildduck.email: [["v=spf1 mx a -all"]]
 DNS query for MX wildduck.email: [{"exchange":"mail.wildduck.email","priority":1}]

package/lib/arc/index.js

@@ -351,7 +351,6 @@ const arc = async (data, opts) => {
                 if (result.authenticationResults.dkim && result.authenticationResults.dkim.length) {
                     result.authenticationResults.dkim = result.authenticationResults.dkim.map(entry => {
                         let result = entry.value;
-
                         delete entry.value;
                         return Object.assign({ result }, entry);
                     });

package/lib/bimi/index.js

@@ -240,7 +240,8 @@ const downloadPromise = (url, cachedFile) => {
     });
 };
 
-const validateVMC = async bimiData => {
+const validateVMC = async (bimiData, opts) => {
+    opts = opts || {};
     if (!bimiData) {
         return false;
     }
@@ -302,7 +303,7 @@ const validateVMC = async bimiData => {
 
         if (authorityValue) {
             try {
-                let vmcData = await vmc(authorityValue);
+                let vmcData = await vmc(authorityValue, opts);
 
                 if (!vmcData.logoFile) {
                     let error = new Error('VMC does not contain a log file');

package/lib/commands/report.js

@@ -2,6 +2,7 @@
 
 const { authenticate } = require('../mailauth');
 const fs = require('fs');
+const { resolve } = require('dns').promises;
 
 const cmd = async argv => {
     let source = argv.email;
@@ -35,6 +36,10 @@ const cmd = async argv => {
         opts.maxResolveCount = argv.maxLookups;
     }
 
+    if (argv.maxVoidLookups) {
+        opts.maxVoidCount = argv.maxVoidLookups;
+    }
+
     for (let key of ['mta', 'helo', 'sender']) {
         if (argv[key]) {
             opts[key] = argv[key];
@@ -48,7 +53,7 @@ const cmd = async argv => {
             let match = dnsCache?.[name]?.[rr];
 
             if (argv.verbose) {
-                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
+                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'} (using cache)`);
             }
 
             if (!match) {
@@ -59,6 +64,18 @@ const cmd = async argv => {
 
             return match;
         };
+    } else if (argv.verbose) {
+        opts.resolver = async (name, rr) => {
+            let match;
+            try {
+                match = await resolve(name, rr);
+                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
+                return match;
+            } catch (err) {
+                console.error(`DNS query for ${rr} ${name}: ${err.message}${err.code ? ` [${err.code}]` : ''}`);
+                throw err;
+            }
+        };
     }
 
     let result = await authenticate(stream, opts);

package/lib/commands/seal.js

@@ -3,6 +3,7 @@
 const { authenticate } = require('../mailauth');
 const fs = require('fs');
 const { GathererStream } = require('../gatherer-stream');
+const { resolve } = require('dns').promises;
 
 const cmd = async argv => {
     let source = argv.email;
@@ -82,7 +83,7 @@ const cmd = async argv => {
             let match = dnsCache?.[name]?.[rr];
 
             if (argv.verbose) {
-                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
+                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'} (using cache)`);
             }
 
             if (!match) {
@@ -93,6 +94,18 @@ const cmd = async argv => {
 
             return match;
         };
+    } else if (argv.verbose) {
+        opts.resolver = async (name, rr) => {
+            let match;
+            try {
+                match = await resolve(name, rr);
+                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
+                return match;
+            } catch (err) {
+                console.error(`DNS query for ${rr} ${name}: ${err.message}${err.code ? ` [${err.code}]` : ''}`);
+                throw err;
+            }
+        };
     }
 
     let result = await authenticate(gatherer, opts);

package/lib/commands/spf.js

@@ -2,7 +2,7 @@
 
 const { spf } = require('../spf');
 const fs = require('fs');
-const dns = require('dns').promises;
+const { resolve } = require('dns').promises;
 
 const cmd = async argv => {
     let address = argv.sender;
@@ -28,6 +28,10 @@ const cmd = async argv => {
         opts.maxResolveCount = argv.maxLookups;
     }
 
+    if (argv.maxVoidLookups) {
+        opts.maxVoidCount = argv.maxVoidLookups;
+    }
+
     for (let key of ['sender', 'helo', 'mta']) {
         if (argv[key]) {
             opts[key] = argv[key];
@@ -41,7 +45,7 @@ const cmd = async argv => {
             let match = dnsCache?.[name]?.[rr];
 
             if (argv.verbose) {
-                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
+                console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'} (using cache)`);
             }
 
             if (!match) {
@@ -52,29 +56,17 @@ const cmd = async argv => {
 
             return match;
         };
-    } else {
+    } else if (argv.verbose) {
         opts.resolver = async (name, rr) => {
             let match;
             try {
-                match = await dns.resolve(name, rr);
-            } catch (err) {
-                if (argv.verbose) {
-                    console.error(`DNS query for ${rr} ${name}: ${err.code || err.message}`);
-                }
-                throw err;
-            }
-
-            if (argv.verbose) {
+                match = await resolve(name, rr);
                 console.error(`DNS query for ${rr} ${name}: ${match ? JSON.stringify(match) : 'not found'}`);
-            }
-
-            if (!match) {
-                let err = new Error('Error');
-                err.code = 'ENOTFOUND';
+                return match;
+            } catch (err) {
+                console.error(`DNS query for ${rr} ${name}: ${err.message}${err.code ? ` [${err.code}]` : ''}`);
                 throw err;
             }
-
-            return match;
         };
     }
 

package/lib/commands/vmc.js

@@ -18,7 +18,20 @@ const cmd = async argv => {
         bimiData.status = { header: { d: argv.domain } };
     }
 
-    const result = await validateVMC(bimiData);
+    let opts = {};
+    if (argv.date) {
+        let date = new Date(argv.date);
+        if (date.toString() !== 'Invalid Date') {
+            opts.now = date;
+            if (argv.verbose) {
+                console.error(`Setting date to: ${argv.date}`);
+            }
+        } else if (argv.verbose) {
+            console.error(`Invalid date argument: ${argv.date}`);
+        }
+    }
+
+    const result = await validateVMC(bimiData, opts);
     process.stdout.write(JSON.stringify(result.authority, false, 2) + '\n');
 };
 

package/lib/dkim/body/relaxed.js

@@ -266,27 +266,3 @@ class RelaxedHash {
 }
 
 module.exports = { RelaxedHash };
-
-/*
-let fs = require('fs');
-
-const getBody = message => {
-    message = message.toString('binary');
-    let match = message.match(/\r?\n\r?\n/);
-    if (match) {
-        message = message.substr(match.index + match[0].length);
-    }
-    return Buffer.from(message, 'binary');
-};
-
-let s = fs.readFileSync(process.argv[2]);
-
-let k = new RelaxedHash('rsa-sha256', -1);
-
-for (let byte of getBody(s)) {
-    k.update(Buffer.from([byte]));
-}
-
-console.error(k.digest('base64'));
-console.error(k.byteLength, k.bodyHashedBytes);
-*/

package/lib/dkim/dkim-verifier.js

@@ -225,7 +225,7 @@ class DkimVerifier extends MessageParser {
                                 ? 'pass'
                                 : 'fail';
 
-                            if (status === 'fail') {
+                            if (status.result === 'fail') {
                                 status.comment = 'bad signature';
                             }
                         } catch (err) {

package/lib/spf/index.js

@@ -8,7 +8,8 @@ const Joi = require('joi');
 const domainSchema = Joi.string().domain({ allowUnicode: false, tlds: false });
 const { formatAuthHeaderRow, escapeCommentValue } = require('../tools');
 
-const MAX_RESOLVE_COUNT = 50;
+const MAX_RESOLVE_COUNT = 10;
+const MAX_VOID_COUNT = 2;
 
 const formatHeaders = result => {
     let header = `Received-SPF: ${result.status.result}${result.status.comment ? ` (${escapeCommentValue(result.status.comment)})` : ''} client-ip=${
@@ -19,23 +20,24 @@ const formatHeaders = result => {
 };
 
 // DNS resolver method
-let limitedResolver = (resolver, maxResolveCount) => {
+let limitedResolver = (resolver, maxResolveCount, maxVoidCount, ignoreFirst) => {
     let resolveCount = 0;
-    maxResolveCount = maxResolveCount || MAX_RESOLVE_COUNT;
+    let voidCount = 0;
 
-    return async (domain, type) => {
-        if (!domain && type === 'resolveCount') {
-            // special condition to get the counter
-            return resolveCount;
-        }
+    let subResolveCounts = {};
+    let firstCounted = !ignoreFirst;
 
-        if (!domain && type === 'resolveLimit') {
-            // special condition to get the limit
-            return maxResolveCount;
-        }
+    maxResolveCount = maxResolveCount || MAX_RESOLVE_COUNT;
+    maxVoidCount = maxVoidCount || MAX_VOID_COUNT;
 
+    let resolverFunc = async (domain, type) => {
         // do not allow to make more that MAX_RESOLVE_COUNT DNS requests per SPF check
-        resolveCount++;
+
+        if (firstCounted) {
+            resolveCount++;
+        } else {
+            firstCounted = true;
+        }
 
         if (resolveCount > maxResolveCount) {
             let error = new Error('Too many DNS requests');
@@ -65,8 +67,17 @@ let limitedResolver = (resolver, maxResolveCount) => {
         } catch (err) {
             switch (err.code) {
                 case 'ENOTFOUND':
-                case 'ENODATA':
+                case 'ENODATA': {
+                    voidCount++;
+                    if (voidCount > maxVoidCount) {
+                        err.spfResult = {
+                            error: 'permerror',
+                            text: 'Too many void DNS results'
+                        };
+                        throw err;
+                    }
                     return [];
+                }
 
                 case 'ETIMEOUT':
                     err.spfResult = {
@@ -80,6 +91,21 @@ let limitedResolver = (resolver, maxResolveCount) => {
             }
         }
     };
+
+    resolverFunc.updateSubQueries = (type, count) => {
+        if (!subResolveCounts[type]) {
+            subResolveCounts[type] = count;
+        } else {
+            subResolveCounts[type] += count;
+        }
+    };
+
+    resolverFunc.getResolveCount = () => resolveCount;
+    resolverFunc.getResolveLimit = () => maxResolveCount;
+    resolverFunc.getSubResolveCounts = () => subResolveCounts;
+    resolverFunc.getVoidCount = () => voidCount;
+
+    return resolverFunc;
 };
 
 /**
@@ -89,10 +115,11 @@ let limitedResolver = (resolver, maxResolveCount) => {
  * @param {String} opts.ip Client IP address
  * @param {String} opts.helo Client EHLO/HELO hostname
  * @param {String} [opts.mta] Hostname of the MTA or MX server that processes the message
- * @param {String} [opts.maxResolveCount=50] Maximum DNS lookups allowed
+ * @param {String} [opts.maxResolveCount=10] Maximum DNS lookups allowed
+ * @param {String} [opts.maxVoidCount=2] Maximum empty DNS lookups allowed
  */
 const verify = async opts => {
-    let { sender, ip, helo, mta, maxResolveCount, resolver } = opts || {};
+    let { sender, ip, helo, mta, maxResolveCount, maxVoidCount, resolver } = opts || {};
 
     mta = mta || os.hostname();
 
@@ -125,7 +152,7 @@ const verify = async opts => {
         }
     };
 
-    let verifyResolver = limitedResolver(resolver, maxResolveCount);
+    let verifyResolver = limitedResolver(resolver, maxResolveCount, maxVoidCount, true);
 
     let result;
     try {
@@ -146,7 +173,10 @@ const verify = async opts => {
             helo,
 
             // generate DNS handler
-            resolver: verifyResolver
+            resolver: verifyResolver,
+
+            // allow to create sub resolvers
+            createSubResolver: () => limitedResolver(resolver, maxResolveCount, maxVoidCount)
         });
     } catch (err) {
         if (err.spfResult) {
@@ -161,8 +191,10 @@ const verify = async opts => {
 
     if (result && typeof result === 'object') {
         result.lookups = {
-            limit: await verifyResolver(false, 'resolveLimit'),
-            count: await verifyResolver(false, 'resolveCount')
+            limit: verifyResolver.getResolveLimit(),
+            count: verifyResolver.getResolveCount(),
+            void: verifyResolver.getVoidCount(),
+            subqueries: verifyResolver.getSubResolveCounts()
         };
     }
 

package/lib/spf/spf-verify.js

@@ -5,6 +5,9 @@ const net = require('net');
 const macro = require('./macro');
 const dns = require('dns').promises;
 const ipaddr = require('ipaddr.js');
+const { getPtrHostname, formatDomain } = require('../tools');
+
+const LIMIT_PTR_RESOLVE_RECORDS = 10;
 
 const matchIp = (addr, range) => {
     if (/\/\d+$/.test(range)) {
@@ -357,18 +360,27 @@ const spfVerify = async (domain, opts) => {
 
                         let mxList = await resolver(mxDomain, 'MX');
                         if (mxList) {
-                            mxList = mxList.sort((a, b) => a.priority - b.priority);
-                            for (let mx of mxList) {
-                                if (mx.exchange) {
-                                    let responses = await resolver(mx.exchange, net.isIPv6(opts.ip) ? 'AAAA' : 'A');
-                                    if (responses) {
-                                        for (let a of responses) {
-                                            if (matchIp(addr, a + cidr)) {
-                                                return { type, val: mx.exchange, qualifier };
+                            // MX resolver has separate counter
+                            let subResolver = typeof opts.createSubResolver === 'function' ? opts.createSubResolver() : resolver;
+                            try {
+                                mxList = mxList.sort((a, b) => a.priority - b.priority);
+                                for (let mx of mxList) {
+                                    if (mx.exchange) {
+                                        let responses = await subResolver(mx.exchange, net.isIPv6(opts.ip) ? 'AAAA' : 'A');
+                                        if (responses) {
+                                            for (let a of responses) {
+                                                if (matchIp(addr, a + cidr)) {
+                                                    return { type, val: mx.exchange, qualifier };
+                                                }
                                             }
                                         }
                                     }
                                 }
+                            } finally {
+                                if (typeof resolver.updateSubQueries === 'function') {
+                                    resolver.updateSubQueries('mx', subResolver.getResolveCount());
+                                    resolver.updateSubQueries('mx:void', subResolver.getVoidCount());
+                                }
                             }
                         }
                     }
@@ -391,7 +403,73 @@ const spfVerify = async (domain, opts) => {
                     break;
 
                 case 'ptr':
-                    // ignore, not supported
+                    {
+                        let { cidr4, cidr6 } = parseCidrValue(val, false, type);
+                        if (cidr4 || cidr6) {
+                            let err = new Error('SPF failure');
+                            err.spfResult = { error: 'permerror', text: `invalid domain-spec definition: ${val}` };
+                            throw err;
+                        }
+
+                        let ptrDomain;
+                        if (val) {
+                            ptrDomain = macro(val, opts);
+                        } else {
+                            ptrDomain = macro('%{d}', opts);
+                        }
+                        ptrDomain = formatDomain(ptrDomain);
+
+                        // Step 1. Resolve PTR hostnames
+                        let ptrValues;
+                        if (opts._resolvedPtr) {
+                            ptrValues = opts._resolvedPtr;
+                        } else {
+                            let responses = await resolver(getPtrHostname(addr), 'PTR');
+                            opts._resolvedPtr = ptrValues = responses && responses.length ? responses : [];
+                        }
+
+                        // PTR resolver has separate counter
+                        let subResolver = typeof opts.createSubResolver === 'function' ? opts.createSubResolver() : resolver;
+
+                        let resolvers = [];
+                        for (let ptrValue of ptrValues) {
+                            if (resolvers.length < LIMIT_PTR_RESOLVE_RECORDS) {
+                                // resolve up to 10 PTR A/AAAA records
+                                // https://datatracker.ietf.org/doc/html/rfc7208#section-4.6.4
+                                resolvers.push(subResolver(ptrValue, net.isIPv6(opts.ip) ? 'AAAA' : 'A'));
+                            }
+                        }
+
+                        // Step 2. Validate PTR hostnames by reverse resolving these
+                        let validatedPtrRecords = [];
+                        let results = await Promise.allSettled(resolvers);
+
+                        if (typeof resolver.updateSubQueries === 'function') {
+                            resolver.updateSubQueries('ptr', subResolver.getResolveCount());
+                            resolver.updateSubQueries('ptr:void', subResolver.getVoidCount());
+                        }
+
+                        for (let i = 0; i < results.length; i++) {
+                            let result = results[i];
+                            let ptrHostname = ptrValues[i];
+                            if (
+                                result.status === 'fulfilled' &&
+                                Array.isArray(result.value) &&
+                                result.value.map(val => ipaddr.parse(val).toNormalizedString()).includes(addr.toNormalizedString())
+                            ) {
+                                validatedPtrRecords.push(ptrHostname);
+                            }
+                        }
+
+                        // Step 3. Check subdomain alignment
+                        for (let ptrRecord of validatedPtrRecords) {
+                            let formattedPtrRecord = formatDomain(ptrRecord);
+
+                            if (formattedPtrRecord === ptrDomain || formattedPtrRecord.substr(-(ptrDomain.length + 1)) === `.${ptrDomain}`) {
+                                return { type, val: ptrRecord, qualifier };
+                            }
+                        }
+                    }
                     break;
             }
         }

package/lib/tools.js

@@ -470,6 +470,21 @@ const validateAlgorithm = (algorithm, strict) => {
     }
 };
 
+const getPtrHostname = parsedAddr => {
+    let bytes = parsedAddr.toByteArray();
+    if (bytes.length === 4) {
+        return `${bytes
+            .map(a => a.toString(10))
+            .reverse()
+            .join('.')}.in-addr.arpa`;
+    } else {
+        return `${bytes
+            .flatMap(a => a.toString(16).padStart(2, '0').split(''))
+            .reverse()
+            .join('.')}.ip6.arpa`;
+    }
+};
+
 module.exports = {
     writeToStream,
     parseHeaders,
@@ -491,5 +506,7 @@ module.exports = {
     getAlignment,
 
     formatRelaxedLine,
-    formatDomain
+    formatDomain,
+
+    getPtrHostname
 };

package/licenses.txt

@@ -1,12 +1,12 @@
 name             license type               link                                                            installed version  author
 ----             ------------               ----                                                            -----------------  ------
-@postalsys/vmc   MIT                        https://registry.npmjs.org/@postalsys/vmc/-/vmc-1.0.4.tgz       1.0.4              Postal Systems OÜ
-fast-xml-parser  MIT                        git+https://github.com/NaturalIntelligence/fast-xml-parser.git  4.0.9              Amit Gupta https://amitkumargupta.work/
-ipaddr.js        MIT                        git://github.com/whitequark/ipaddr.js.git                       2.0.1              whitequark whitequark@whitequark.org
-joi              BSD-3-Clause               git://github.com/sideway/joi.git                                17.6.0
-libmime          MIT                        git://github.com/andris9/libmime.git                            5.1.0              Andris Reinman andris@kreata.ee
+@postalsys/vmc   MIT                        https://registry.npmjs.org/@postalsys/vmc/-/vmc-1.0.5.tgz       1.0.5              Postal Systems OÜ
+fast-xml-parser  MIT                        git+https://github.com/NaturalIntelligence/fast-xml-parser.git  4.0.9              Amit Gupta (https://amitkumargupta.work/)
+ipaddr.js        MIT                        git://github.com/whitequark/ipaddr.js.git                       2.0.1              whitequark <whitequark@whitequark.org>
+joi              BSD-3-Clause               git://github.com/sideway/joi.git                                17.6.0             n/a
+libmime          MIT                        git://github.com/andris9/libmime.git                            5.1.0              Andris Reinman <andris@kreata.ee>
 node-forge       (BSD-3-Clause OR GPL-2.0)  git+https://github.com/digitalbazaar/forge.git                  1.3.1              Digital Bazaar, Inc. support@digitalbazaar.com http://digitalbazaar.com/
 nodemailer       MIT                        git+https://github.com/nodemailer/nodemailer.git                6.7.7              Andris Reinman
-psl              MIT                        git+ssh://git@github.com/lupomontero/psl.git                    1.9.0              Lupo Montero lupomontero@gmail.com https://lupomontero.com/
+psl              MIT                        git+ssh://git@github.com/lupomontero/psl.git                    1.9.0              Lupo Montero <lupomontero@gmail.com> (https://lupomontero.com/)
 punycode         MIT                        git+https://github.com/bestiejs/punycode.js.git                 2.1.1              Mathias Bynens https://mathiasbynens.be/
-yargs            MIT                        git+https://github.com/yargs/yargs.git                          17.5.1
+yargs            MIT                        git+https://github.com/yargs/yargs.git                          17.5.1             n/a

package/man/mailauth.1

@@ -1,4 +1,4 @@
-.TH "MAILAUTH" "1" "July 2022" "v3.0.2" "Mailauth Help"
+.TH "MAILAUTH" "1" "August 2022" "v4.0.1" "Mailauth Help"
 .SH "NAME"
 \fBmailauth\fR
 .QP
@@ -107,7 +107,10 @@ Colon separated list of header field names to sign\. (\fBsign\fP, \fBseal\fP)
 Return signing headers only\. By default, the entire message is printed to the console\. (\fBsign\fP, \fBseal\fP, \fBspf\fP)
 .IP \(bu 2
 \fB\-\-max\-lookups\fP, \fB\-x\fP
-How many DNS lookups allowed for SPF validation\. Defaults to 50\. (\fBreport\fP, \fBspf\fP)
+How many DNS lookups allowed for SPF validation\. Defaults to 10\. (\fBreport\fP, \fBspf\fP)
+.IP \(bu 2
+\fB\-\-max\-void\-lookups\fP, \fB\-z\fP
+How many empty DNS lookups allowed for SPF validation\. Defaults to 2\. (\fBreport\fP, \fBspf\fP)
 
 .RE
 .SH DNS CACHE

package/man/man.md

@@ -103,7 +103,10 @@ content is read from standard input.
     Return signing headers only. By default, the entire message is printed to the console. (`sign`, `seal`, `spf`)
 
 -   `--max-lookups`, `-x`
-    How many DNS lookups allowed for SPF validation. Defaults to 50. (`report`, `spf`)
+    How many DNS lookups allowed for SPF validation. Defaults to 10. (`report`, `spf`)
+
+-   `--max-void-lookups`, `-z`
+    How many empty DNS lookups allowed for SPF validation. Defaults to 2. (`report`, `spf`)
 
 ## DNS CACHE
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "3.0.2",
+    "version": "4.0.1",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "scripts": {
@@ -33,11 +33,11 @@
     "homepage": "https://github.com/postalsys/mailauth",
     "devDependencies": {
         "chai": "4.3.6",
-        "eslint": "8.19.0",
+        "eslint": "8.22.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "8.5.0",
         "js-yaml": "4.1.0",
-        "license-report": "5.0.2",
+        "license-report": "6.0.0",
         "marked": "0.7.0",
         "marked-man": "0.7.0",
         "mbox-reader": "1.1.5",
@@ -45,13 +45,13 @@
         "pkg": "5.8.0"
     },
     "dependencies": {
-        "@postalsys/vmc": "1.0.4",
+        "@postalsys/vmc": "1.0.6",
         "fast-xml-parser": "4.0.9",
         "ipaddr.js": "2.0.1",
         "joi": "17.6.0",
         "libmime": "5.1.0",
         "node-forge": "1.3.1",
-        "nodemailer": "6.7.7",
+        "nodemailer": "6.7.8",
         "psl": "1.9.0",
         "punycode": "2.1.1",
         "yargs": "17.5.1"