DMARC branch coverage round 3 + fix apex-fallback exception masking

[seanthegeek]

Summary

Pushes DMARC branch coverage from 80% to 98% with focused tests for the apex-fallback path, the DNS tree walk, the report-authorization helpers, and the rua/ruf URI processing. Also fixes one bug surfaced by the new tests.

File	Before	After
dmarc.py	80%	98%
Project total	91%	93%

Tests added

• TestQueryDmarcRecordEdges — _query_dmarc_record apex fallback (NoAnswer / NXDOMAIN / generic Exception on the apex query, and a generic Exception at the selector wrapping as DMARCError).
• TestQueryDmarcRecordTreeWalk — walk succeeds at a parent, continues past per-step DMARCRecordNotFound, re-raises other DMARCError, NXDOMAIN on the apex TXT lookup, and the short vs long not-found messages.
• TestCheckWildcardDmarcReportAuthorization — found, missing, unrelated records (raise vs ignore), DNSException returning False.
• TestVerifyDmarcReportDestination — same-base-domain short circuit, wildcard short circuit, specific authorization present, missing record, unrelated records reaching the catch-all.
• TestParseDmarcRecordReportBranches — size-limit warnings, cross-domain destinations calling verify_dmarc_report_destination, missing MX records, DNSException on MX lookup, and the >2-URIs best-practice warning for both rua and ruf.
• TestGetDmarcRecord — both include_tag_descriptions branches.
• TestCheckDmarcErrorWithTarget — check_dmarc flattens error.data["target"] onto the result.

Bug fix in checkdmarc/dmarc.py

_query_dmarc_record's apex-fallback path had the same masking pattern as the pre-#246 BIMI code:

try:
    records = query_dns(domain, "TXT", ...)
    for record in records:
        if record.startswith(txt_prefix):
            raise DMARCRecordInWrongLocation(...)
except dns.resolver.NoAnswer:
    pass
except dns.resolver.NXDOMAIN:
    raise DMARCRecordNotFound(...)
except Exception as error:
    raise DMARCRecordNotFound(error)   # catches and converts DMARCRecordInWrongLocation

So a DMARC record placed at the apex (instead of _dmarc.<domain>) surfaced to callers as DMARCRecordNotFound — they couldn't distinguish "wrong location" from "no record found at all". Added an except DMARCError: raise clause before the catch-all so the specific DMARCRecordInWrongLocation propagates. testApexFallbackWrongLocation demonstrates the previously-broken path.

Test plan

• GITHUB_ACTIONS=true python -m pytest tests/ passes (396 passed, 12 skipped)
• ruff check, ruff format --check, pyright (latest, 1.1.409) all clean
• CI green on this PR

🤖 Generated with Claude Code