Verdict text for domains without MX and " v=spf1 -all" not right

[baknu]

The verdict texts for domains like app4.nijmegen.nl do not seem right under:

• "Mail server(s) --> IPv6 addresses for mail server(s)";
• "Mail server domain(s) --> DNSSEC existence";
• "STARTTLS available".

See: https://internet.nl/mail/app4.nijmegen.nl/1506063/

The domain has no MX and has " v=spf1 -all".

It seems the following text labels should be shown:

• /detail/mail/ipv6/mx-AAAA/verdict/no-null-mx
• /detail/mail/dnssec/mx-exists/verdict/no-null-mx (content van dit label moet nog worden geüpdatet!)
• /detail/mail/tls/starttls-exists/verdict/no-null-mx

[bwbroersma]

Ok, so the content is right, but the verdict is wrong:

Test	Group	SubTest	Verdict shown	Expected verdict
IPv6	Mail server(s)	IPv6 addresses for mail server(s)	other	no-null-mx
DNSSEC	Mail server domain(s)	DNSSEC existence	no-mailserver	no-null-mx
STARTTLS and DANE	TLS	STARTTLS available	other-2	no-null-mx

I described the behavior in the duplicate:

• Skipped DNSSEC verdict states the SPF may be used for sending mail while v=spf1 -all #1741

However I wrongly tagged it as a content issue, it's a verdict issue.

The code search for result_no_null_mx in the path:/checks/tasks/ is an interesting search, because the logic:

Internet.nl/checks/tasks/dnssec.py

Lines 181 to 191 in cef300d

	# Handle the case where there are no mailservers or NULL MX variants.
	if mailtdnssec.mx_status == MxStatus.no_mx:
	category.subtests["dnssec_mx_exists"].result_no_mailservers()
	elif mailtdnssec.mx_status == MxStatus.no_null_mx:
	category.subtests["dnssec_mx_exists"].result_no_null_mx()
	elif mailtdnssec.mx_status == MxStatus.null_mx_with_other_mx:
	category.subtests["dnssec_mx_exists"].result_null_mx_with_other_mx()
	elif mailtdnssec.mx_status == MxStatus.null_mx_without_a_aaaa:
	category.subtests["dnssec_mx_exists"].result_null_mx_without_a_aaaa()
	elif mailtdnssec.mx_status == MxStatus.null_mx:
	category.subtests["dnssec_mx_exists"].result_null_mx()

MxStatus has to be no_mx instead of no_null_mx:

Internet.nl/checks/models.py

Lines 54 to 60 in cef300d

	class MxStatus(LabelEnum):
	has_mx = 0
	no_mx = 1
	no_null_mx = 2
	null_mx_with_other_mx = 3
	null_mx = 4
	null_mx_without_a_aaaa = 5

This is done by (new stub resolver main-branch code):

Internet.nl/checks/tasks/shared.py

Lines 163 to 173 in cef300d

	if not mailservers:
	if do_resolve_single_a_aaaa(url):
	try:
	spf_data = dns_resolve_spf(url)
	if spf_data:
	spf_parsed = spf_parse(spf_data)
	if spf_parsed.get("terms", []) == ["-all"]:
	return [(None, None, MxStatus.no_null_mx)]
	except DNSException:
	pass
	return [(None, None, MxStatus.no_mx)]

And the current release (v1.9.x-branch) code:

Internet.nl/checks/tasks/shared.py

Lines 154 to 161 in cfd3e8c

	if not mailservers:
	if do_resolve_a_aaaa(self, url):
	spf_data = resolve_spf_record(url, self)
	if spf_data.get("available"):
	spf_parsed = spf_parse(spf_data["record"][0])
	if spf_parsed.get("terms", []) == ["-all"]:
	return [(None, None, MxStatus.no_null_mx)]
	return [(None, None, MxStatus.no_mx)]

Note:

$ dig +noall +answer app4.nijmegen.nl TXT

app4.nijmegen.nl.       3600    IN      TXT     "v=spf1 -all"

I'm not seeing an issue (or some strange space) here.
Although I have to note: is the TXT DNS query done multiple time or is the result cached? If it's done multiple times, it could produce multiple outcomes.

Also note the skipping of the DKIM test is done in a slightly different way:

Internet.nl/checks/tasks/mail.py

Lines 113 to 132 in cef300d

	def skip_dkim_for_non_sending_domain(mtauth):
	"""
	If there is no DKIM, check if DMARC and SPF are hinting for a non email
	sending domain and skip the DKIM results.
	"""
	is_org = mtauth.dmarc_record_org_domain
	if (
	not mtauth.dkim_available
	and mtauth.dmarc_available
	and mtauth.dmarc_policy_status == DmarcPolicyStatus.valid
	and (
	(is_org and DMARC_NON_SENDING_POLICY_ORG.match(mtauth.dmarc_record[0]))
	or (not is_org and DMARC_NON_SENDING_POLICY.match(mtauth.dmarc_record[0]))
	)
	and mtauth.spf_available
	and mtauth.spf_policy_status == SpfPolicyStatus.valid
	and SPF_NON_SENDING_POLICY.match(mtauth.spf_record[0])
	):
	return True
	return False

Also see:

• SPF / DMARC case sensitivity #1400