mhost 0.11.3

Fast, async DNS lookup library and CLI -- modern dig/host replacement with parallel multi-server queries, DoH, DoT, subdomain discovery, and zone verification
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

use super::CheckResult;
use crate::resources::rdata::parsed_txt;

/// Returns true if the given TXT string is a DMARC record.
pub fn is_dmarc(txt: &str) -> bool {
    txt.starts_with("v=DMARC1")
}

/// Run DMARC lint checks against the given DMARC TXT record strings.
pub fn check_dmarc_records(dmarcs: &[String]) -> Vec<CheckResult> {
    let mut results = Vec::new();
    check_num_of_dmarc_records(dmarcs, &mut results);
    check_parsed_dmarc_records(dmarcs, &mut results);
    results
}

fn check_num_of_dmarc_records(dmarcs: &[String], results: &mut Vec<CheckResult>) {
    let check = match dmarcs.len() {
        0 => CheckResult::Warning(
            "No DMARC record found: without DMARC, email spoofing for this domain cannot be detected by receivers"
                .to_string(),
        ),
        1 => CheckResult::Ok("Found exactly one DMARC record".to_string()),
        n => CheckResult::Failed(format!(
            "Found {} DMARC records: a domain must not have multiple DMARC records; cf. RFC 7489, section 6.6.3",
            n
        )),
    };
    results.push(check);
}

fn check_parsed_dmarc_records(dmarcs: &[String], results: &mut Vec<CheckResult>) {
    for txt in dmarcs {
        match parsed_txt::Dmarc::from_str(txt) {
            Ok(dmarc) => {
                results.push(CheckResult::Ok("Successfully parsed DMARC record".to_string()));
                check_dmarc_policy(&dmarc, results);
            }
            Err(_) => {
                results.push(CheckResult::Failed("Failed to parse DMARC record".to_string()));
            }
        }
    }
}

fn check_dmarc_policy(dmarc: &parsed_txt::Dmarc<'_>, results: &mut Vec<CheckResult>) {
    match dmarc.policy() {
        "none" => results.push(CheckResult::Warning(
            "DMARC policy is 'none': emails failing authentication will not be blocked. Consider 'quarantine' or 'reject'"
                .to_string(),
        )),
        "quarantine" => results.push(CheckResult::Ok(
            "DMARC policy is 'quarantine': suspicious emails will be quarantined".to_string(),
        )),
        "reject" => results.push(CheckResult::Ok(
            "DMARC policy is 'reject': emails failing authentication will be rejected".to_string(),
        )),
        other => results.push(CheckResult::Warning(format!(
            "Unknown DMARC policy '{}': expected 'none', 'quarantine', or 'reject'",
            other
        ))),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn is_dmarc_true() {
        assert!(is_dmarc("v=DMARC1; p=reject"));
    }

    #[test]
    fn is_dmarc_false() {
        assert!(!is_dmarc("v=spf1 include:example.com ~all"));
    }

    #[test]
    fn check_num_zero() {
        let mut results = Vec::new();
        check_num_of_dmarc_records(&[], &mut results);
        assert_eq!(results.len(), 1);
        assert!(matches!(&results[0], CheckResult::Warning(_)));
    }

    #[test]
    fn check_num_one() {
        let mut results = Vec::new();
        check_num_of_dmarc_records(&["v=DMARC1; p=reject".to_string()], &mut results);
        assert_eq!(results.len(), 1);
        assert!(matches!(&results[0], CheckResult::Ok(_)));
    }

    #[test]
    fn check_num_multiple() {
        let mut results = Vec::new();
        check_num_of_dmarc_records(
            &["v=DMARC1; p=reject".to_string(), "v=DMARC1; p=none".to_string()],
            &mut results,
        );
        assert_eq!(results.len(), 1);
        assert!(matches!(&results[0], CheckResult::Failed(_)));
    }

    #[test]
    fn check_parsed_valid_reject() {
        let mut results = Vec::new();
        check_parsed_dmarc_records(&["v=DMARC1; p=reject".to_string()], &mut results);
        assert_eq!(results.len(), 2);
        assert!(matches!(&results[0], CheckResult::Ok(_)));
        assert!(matches!(&results[1], CheckResult::Ok(_)));
    }

    #[test]
    fn check_parsed_valid_none_policy() {
        let mut results = Vec::new();
        check_parsed_dmarc_records(&["v=DMARC1; p=none".to_string()], &mut results);
        assert_eq!(results.len(), 2);
        assert!(matches!(&results[0], CheckResult::Ok(_)));
        assert!(matches!(&results[1], CheckResult::Warning(_)));
    }

    #[test]
    fn check_parsed_invalid() {
        let mut results = Vec::new();
        check_parsed_dmarc_records(&["garbage data".to_string()], &mut results);
        assert_eq!(results.len(), 1);
        assert!(matches!(&results[0], CheckResult::Failed(_)));
    }

    #[test]
    fn check_policy_quarantine() {
        let dmarc = parsed_txt::Dmarc::from_str("v=DMARC1; p=quarantine").unwrap();
        let mut results = Vec::new();
        check_dmarc_policy(&dmarc, &mut results);
        assert_eq!(results.len(), 1);
        assert!(matches!(&results[0], CheckResult::Ok(_)));
    }
}