source-package.json — Email Domain Setup Checker

{
  "schema_version": 1,
  "runtimes": [
    {
      "name": "python",
      "versions": [
        "3.10"
      ]
    }
  ],
  "dependencies": [],
  "operations": [
    {
      "kind": "read",
      "description": "Read DNS-over-HTTPS for the checked domain and email record names. Recursive SPF checks send include/redirect target names from DNS records, including unrelated third-party domains, to the selected resolver.",
      "target_restrictions": [
        "The validated caller-supplied domain, derived email record names, and recursive SPF include and redirect targets named in DNS records, including unrelated third-party domains; target names are sent to the selected resolver",
        "Only dns.google or cloudflare-dns.com, selected by --resolver; HTTPS and every redirect are host checked"
      ]
    },
    {
      "kind": "read",
      "description": "Optionally fetch the MTA-STS policy for the checked domain when --mta-sts is supplied.",
      "target_restrictions": [
        "Only https://mta-sts.<validated-domain>/.well-known/mta-sts.txt",
        "HTTPS and every redirect are checked against the exact selected MTA-STS host"
      ]
    },
    {
      "kind": "read",
      "description": "In test mode, read a caller-named synthetic fixture before any request; the paired acknowledgment variable is required.",
      "target_restrictions": [
        "Only the exact synthetic fixture file named by EMAIL_DNS_FAKE_RESPONSES",
        "Only when EMAIL_DNS_FAKE_TRANSPORT_TEST_ACK=1 is also set; test mode prints a stderr warning and makes no network request"
      ]
    }
  ],
  "authorization": {
    "mode": "none",
    "scopes": [],
    "credential_requirements": []
  },
  "network": {
    "domains": [
      "dns.google",
      "cloudflare-dns.com"
    ],
    "destinations": [
      "DNS-over-HTTPS at dns.google or cloudflare-dns.com (--resolver). Recursive SPF sends include/redirect target names from DNS records, including unrelated third-party domains, to the selected resolver.",
      "With --mta-sts only, https://mta-sts.<validated-domain>/.well-known/mta-sts.txt for the exact checked domain",
      "Python urllib honors HTTPS_PROXY, https_proxy, NO_PROXY, no_proxy and macOS or Windows system proxy settings; TLS still terminates at the checked destination hosts"
    ]
  },
  "safety": {
    "read_only_by_default": true,
    "dry_run_supported": false,
    "consequential_writes_require_authorization": true,
    "validation_controls": [
      "Domain and selector syntax are validated and IDNA-normalized before requests",
      "Every request and redirect requires HTTPS and a declared resolver or the exact selected MTA-STS host",
      "Human-readable findings escape untrusted DNS and policy text onto one line; JSON output remains structured JSON",
      "A failed lookup marks results incomplete, lists skipped checks and exits 2 unless --allow-partial",
      "SPF static counts follow RFC 7208 processing order: include, a, mx, ptr, exists and redirect count recursively; nothing after all counts, and redirect is ignored with all.",
      "No sender-IP matching or macro evaluation. Macro targets warn and are skipped, marking the count partial and report incomplete. Void lookups are not measured. No definitive SPF pass/fail evaluation.",
      "Duplicate redirect modifiers warn (RFC 7208 section 6); neither is followed or counted, marking the result incomplete.",
      "The eleventh term warns: static lookup count is 11, above the 10-lookup limit; evaluation can stop earlier for a matching sender. Further SPF lookups stop. All DNS queries stop at 60 with an incomplete report.",
      "The fake transport requires two environment variables, warns on stderr and never contacts a real host"
    ],
    "target_restrictions": [
      "The caller-selected domain, derived email record names, and recursive SPF include and redirect targets from DNS records, including unrelated third-party domains; those names are sent to the selected resolver",
      "The selected DNS-over-HTTPS resolver, plus the exact MTA-STS host only with --mta-sts",
      "No DNS changes, sends, uploads, deletions or local output writes"
    ]
  },
  "tests": {
    "files": [
      "tests/test_email_domain_setup_checker.py",
      "tests/test_hygiene.py"
    ],
    "fixtures": "synthetic_only",
    "provenance": "creator",
    "evidence": [
      "Standard-library unittest tests use synthetic fixtures and a subprocess CLI",
      "Covers SPF processing order around all and redirect, nested includes, loops, the 10/11-lookup boundary, DNS query ceilings, DMARC, partial results, resolver headers, host guards and fake-transport gating",
      "Hygiene checks only shipped package files for attribution, invisible characters and forbidden constructs"
    ]
  }
}

License: MIT (read it).

Back to the listing