Add null SPF, DMARC, and MX records for automatically generated autoconfig, autodiscover, and mta-sts subdomains; add null MX records for custom A-record subdomains

All A/AAAA-resolvable domains that don't send or receive mail should have these null records.

This simplifies the handling of domains a bit by handling automatically generated subdomains more like other domains.

Author: JoshData

CHANGELOG.md

@@ -4,9 +4,15 @@ CHANGELOG
 In Development
 --------------
 
-* Migrate to the ECDSAP256SHA256 DNSSEC algorithm. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record.
+Mail:
+
 * Roundcube's login cookie is updated to use a new encryption algorithm (AES-256-CBC instead of DES-EDE-CBC).
 
+DNS:
+
+* The ECDSAP256SHA256 DNSSEC algorithm is now available. If a DS record is set for any of your domain names that have DNS hosted on your box, you will be prompted by status checks to update the DS record at your convenience.
+* Null MX records are added for domains that do not serve mail.
+
 v0.53a (May 8, 2021)
 --------------------
 

management/dns_update.py

@@ -135,6 +135,14 @@ def build_zones(env):
 	web_domains = set(get_web_domains(env))
 	auto_domains = web_domains - set(get_web_domains(env, include_auto=False))
 	domains |= auto_domains # www redirects not included in the initial list, see above
+
+	# Add ns1/ns2+PRIMARY_HOSTNAME which must also have A/AAAA records
+	# when the box is acting as authoritative DNS server for its domains.
+	for ns in ("ns1", "ns2"):
+		d = ns + "." + env["PRIMARY_HOSTNAME"]
+		domains.add(d)
+		auto_domains.add(d)
+
 	domains = {
 		domain: {
 			"user": domain in mail_user_domains,
@@ -161,9 +169,6 @@ def build_zones(env):
 def build_zone(domain, domain_properties, additional_records, env, is_zone=True):
 	records = []
 
-	# Skip www redirect and autoconfiguration domains here because they are set at the zone level directly.
-	if domain_properties[domain]["auto"]: return records
-
 	# For top-level zones, define the authoritative name servers.
 	#
 	# Normally we are our own nameservers. Some TLDs require two distinct IP addresses,
@@ -173,10 +178,10 @@ def build_zone(domain, domain_properties, additional_records, env, is_zone=True)
 	# 'False' in the tuple indicates these records would not be used if the zone
 	# is managed outside of the box.
 	if is_zone:
-		# Obligatory definition of ns1.PRIMARY_HOSTNAME.
+		# Obligatory NS record to ns1.PRIMARY_HOSTNAME.
 		records.append((None,  "NS",  "ns1.%s." % env["PRIMARY_HOSTNAME"], False))
 
-		# Define ns2.PRIMARY_HOSTNAME or whatever the user overrides.
+		# NS record to ns2.PRIMARY_HOSTNAME or whatever the user overrides.
 		# User may provide one or more additional nameservers
 		secondary_ns_list = get_secondary_dns(additional_records, mode="NS") \
 			or ["ns2." + env["PRIMARY_HOSTNAME"]]
@@ -186,15 +191,6 @@ def build_zone(domain, domain_properties, additional_records, env, is_zone=True)
 
 	# In PRIMARY_HOSTNAME...
 	if domain == env["PRIMARY_HOSTNAME"]:
-		# Define ns1 and ns2.
-		# 'False' in the tuple indicates these records would not be used if the zone
-		# is managed outside of the box.
-		records.append(("ns1", "A", env["PUBLIC_IP"], False))
-		records.append(("ns2", "A", env["PUBLIC_IP"], False))
-		if env.get('PUBLIC_IPV6'):
-			records.append(("ns1", "AAAA", env["PUBLIC_IPV6"], False))
-			records.append(("ns2", "AAAA", env["PUBLIC_IPV6"], False))
-
 		# Set the A/AAAA records. Do this early for the PRIMARY_HOSTNAME so that the user cannot override them
 		# and we can provide different explanatory text.
 		records.append((None, "A", env["PUBLIC_IP"], "Required. Sets the IP address of the box."))
@@ -249,21 +245,23 @@ def has_rec(qname, rtype, prefix=None):
 				continue
 		records.append((qname, rtype, value, "(Set by user.)"))
 
-	# Add defaults if not overridden by the user's custom settings (and not otherwise configured).
+	# Add A/AAAA defaults if not overridden by the user's custom settings (and not otherwise configured).
 	# Any CNAME or A record on the qname overrides A and AAAA. But when we set the default A record,
 	# we should not cause the default AAAA record to be skipped because it thinks a custom A record
 	# was set. So set has_rec_base to a clone of the current set of DNS settings, and don't update
 	# during this process.
 	has_rec_base = list(records)
+	a_expl = "Required. May have a different value. Sets the IP address that %s resolves to for web hosting and other services besides mail. The A record must be present but its value does not affect mail delivery." % domain
+	if domain_properties[domain]["auto"]:
+		if domain.startswith("ns1.") or domain.startswith("ns2."): a_expl = False # omit from 'External DNS' page since this only applies if box is its own DNS server
+		if domain.startswith("www."): a_expl = "Optional. Sets the IP address that %s resolves to so that the box can provide a redirect to the parent domain." % domain
+		if domain.startswith("mta-sts."): a_expl = "Optional. MTA-STS Policy Host serving /.well-known/mta-sts.txt."
+		if domain.startswith("autoconfig."): a_expl = "Provides email configuration autodiscovery support for Thunderbird Autoconfig."
+		if domain.startswith("autodiscover."): a_expl = "Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."
 	defaults = [
-		(None,  "A",    env["PUBLIC_IP"],       "Required. May have a different value. Sets the IP address that %s resolves to for web hosting and other services besides mail. The A record must be present but its value does not affect mail delivery." % domain),
+		(None,  "A",    env["PUBLIC_IP"], a_expl),
 		(None,  "AAAA", env.get('PUBLIC_IPV6'), "Optional. Sets the IPv6 address that %s resolves to, e.g. for web hosting. (It is not necessary for receiving mail on this domain.)" % domain),
 	]
-	if domain_properties.get("www." + domain, {}).get("auto"):
-		defaults += [
-			("www", "A",    env["PUBLIC_IP"],       "Optional. Sets the IP address that www.%s resolves to so that the box can provide a redirect to the parent domain." % domain),
-			("www", "AAAA", env.get('PUBLIC_IPV6'), "Optional. Sets the IPv6 address that www.%s resolves to so that the box can provide a redirect to the parent domain." % domain),
-		]
 	for qname, rtype, value, explanation in defaults:
 		if value is None or value.strip() == "": continue # skip IPV6 if not set
 		if not is_zone and qname == "www": continue # don't create any default 'www' subdomains on what are themselves subdomains
@@ -277,63 +275,40 @@ def has_rec(qname, rtype, prefix=None):
 	# Don't pin the list of records that has_rec checks against anymore.
 	has_rec_base = records
 
-	# The MX record says where email for the domain should be delivered: Here!
-	if not has_rec(None, "MX", prefix="10 "):
-		records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
-
-	# SPF record: Permit the box ('mx', see above) to send mail on behalf of
-	# the domain, and no one else.
-	# Skip if the user has set a custom SPF record.
-	if not has_rec(None, "TXT", prefix="v=spf1 "):
-		records.append((None,  "TXT", 'v=spf1 mx -all', "Recommended. Specifies that only the box is permitted to send @%s mail." % domain))
-
-	# Append the DKIM TXT record to the zone as generated by OpenDKIM.
-	# Skip if the user has set a DKIM record already.
-	opendkim_record_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/mail.txt')
-	with open(opendkim_record_file) as orf:
-		m = re.match(r'(\S+)\s+IN\s+TXT\s+\( ((?:"[^"]+"\s+)+)\)', orf.read(), re.S)
-		val = "".join(re.findall(r'"([^"]+)"', m.group(2)))
-		if not has_rec(m.group(1), "TXT", prefix="v=DKIM1; "):
-			records.append((m.group(1), "TXT", val, "Recommended. Provides a way for recipients to verify that this machine sent @%s mail." % domain))
-
-	# Append a DMARC record.
-	# Skip if the user has set a DMARC record already.
-	if not has_rec("_dmarc", "TXT", prefix="v=DMARC1; "):
-		records.append(("_dmarc", "TXT", 'v=DMARC1; p=quarantine', "Recommended. Specifies that mail that does not originate from the box but claims to be from @%s or which does not have a valid DKIM signature is suspect and should be quarantined by the recipient's mail system." % domain))
-
-	# For any subdomain with an A record but no SPF or DMARC record, add strict policy records.
-	all_resolvable_qnames = set(r[0] for r in records if r[1] in ("A", "AAAA"))
-	for qname in all_resolvable_qnames:
-		if not has_rec(qname, "TXT", prefix="v=spf1 "):
-			records.append((qname,  "TXT", 'v=spf1 -all', "Recommended. Prevents use of this domain name for outbound mail by specifying that no servers are valid sources for mail from @%s. If you do send email from this domain name you should either override this record such that the SPF rule does allow the originating server, or, take the recommended approach and have the box handle mail for this domain (simply add any receiving alias at this domain name to make this machine treat the domain name as one of its mail domains)." % (qname + "." + domain)))
-		dmarc_qname = "_dmarc" + ("" if qname is None else "." + qname)
-		if not has_rec(dmarc_qname, "TXT", prefix="v=DMARC1; "):
-			records.append((dmarc_qname, "TXT", 'v=DMARC1; p=reject', "Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s." % (qname + "." + domain)))
-
-	# Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname
-	# for autoconfiguration of mail clients (so only domains hosting user accounts need it).
-	# The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot).
-	if domain != env["PRIMARY_HOSTNAME"] and domain_properties[domain]["user"]:
-		for dav in ("card", "cal"):
-			qname = "_" + dav + "davs._tcp"
-			if not has_rec(qname, "SRV"):
-				records.append((qname, "SRV", "0 0 443 " + env["PRIMARY_HOSTNAME"] + ".", "Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
-
-	# Adds autoconfiguration A records for all domains that there are user accounts at.
-	# This allows the following clients to automatically configure email addresses in the respective applications.
-	# autodiscover.* - Z-Push ActiveSync Autodiscover
-	# autoconfig.* - Thunderbird Autoconfig
+	if domain_properties[domain]["mail"]:
+		# The MX record says where email for the domain should be delivered: Here!
+		if not has_rec(None, "MX", prefix="10 "):
+			records.append((None,  "MX",  "10 %s." % env["PRIMARY_HOSTNAME"], "Required. Specifies the hostname (and priority) of the machine that handles @%s mail." % domain))
+
+		# SPF record: Permit the box ('mx', see above) to send mail on behalf of
+		# the domain, and no one else.
+		# Skip if the user has set a custom SPF record.
+		if not has_rec(None, "TXT", prefix="v=spf1 "):
+			records.append((None,  "TXT", 'v=spf1 mx -all', "Recommended. Specifies that only the box is permitted to send @%s mail." % domain))
+
+		# Append the DKIM TXT record to the zone as generated by OpenDKIM.
+		# Skip if the user has set a DKIM record already.
+		opendkim_record_file = os.path.join(env['STORAGE_ROOT'], 'mail/dkim/mail.txt')
+		with open(opendkim_record_file) as orf:
+			m = re.match(r'(\S+)\s+IN\s+TXT\s+\( ((?:"[^"]+"\s+)+)\)', orf.read(), re.S)
+			val = "".join(re.findall(r'"([^"]+)"', m.group(2)))
+			if not has_rec(m.group(1), "TXT", prefix="v=DKIM1; "):
+				records.append((m.group(1), "TXT", val, "Recommended. Provides a way for recipients to verify that this machine sent @%s mail." % domain))
+
+		# Append a DMARC record.
+		# Skip if the user has set a DMARC record already.
+		if not has_rec("_dmarc", "TXT", prefix="v=DMARC1; "):
+			records.append(("_dmarc", "TXT", 'v=DMARC1; p=quarantine', "Recommended. Specifies that mail that does not originate from the box but claims to be from @%s or which does not have a valid DKIM signature is suspect and should be quarantined by the recipient's mail system." % domain))
+
 	if domain_properties[domain]["user"]:
-		autodiscover_records = [
-			("autodiscover", "A", env["PUBLIC_IP"], "Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."),
-			("autodiscover", "AAAA", env["PUBLIC_IPV6"], "Provides email configuration autodiscovery support for Z-Push ActiveSync Autodiscover."),
-			("autoconfig", "A", env["PUBLIC_IP"], "Provides email configuration autodiscovery support for Thunderbird Autoconfig."),
-			("autoconfig", "AAAA", env["PUBLIC_IPV6"], "Provides email configuration autodiscovery support for Thunderbird Autoconfig.")
-		]
-		for qname, rtype, value, explanation in autodiscover_records:
-			if value is None or value.strip() == "": continue # skip IPV6 if not set
-			if not has_rec(qname, rtype):
-				records.append((qname, rtype, value, explanation))
+		# Add CardDAV/CalDAV SRV records on the non-primary hostname that points to the primary hostname
+		# for autoconfiguration of mail clients (so only domains hosting user accounts need it).
+		# The SRV record format is priority (0, whatever), weight (0, whatever), port, service provider hostname (w/ trailing dot).
+		if domain != env["PRIMARY_HOSTNAME"]:
+			for dav in ("card", "cal"):
+				qname = "_" + dav + "davs._tcp"
+				if not has_rec(qname, "SRV"):
+					records.append((qname, "SRV", "0 0 443 " + env["PRIMARY_HOSTNAME"] + ".", "Recommended. Specifies the hostname of the server that handles CardDAV/CalDAV services for email addresses on this domain."))
 
 	# If this is a domain name that there are email addresses configured for, i.e. "something@"
 	# this domain name, then the domain name is a MTA-STS (https://tools.ietf.org/html/rfc8461)
@@ -350,11 +325,9 @@ def has_rec(qname, rtype, prefix=None):
 	# subdomain must be valid certificate for that domain. Do not set an MTA-STS policy if either
 	# certificate in use is not valid (e.g. because it is self-signed and a valid certificate has not
 	# yet been provisioned). Since we cannot provision a certificate without A/AAAA records, we
-	# always set them --- only the TXT records depend on there being valid certificates.
-	mta_sts_records = [
-		("mta-sts", "A", env["PUBLIC_IP"], "Optional. MTA-STS Policy Host serving /.well-known/mta-sts.txt."),
-		("mta-sts", "AAAA", env.get('PUBLIC_IPV6'), "Optional. MTA-STS Policy Host serving /.well-known/mta-sts.txt."),
-	]
+	# always set them (by including them in the www domains) --- only the TXT records depend on there
+	# being valid certificates.
+	mta_sts_records = [ ]
 	if domain_properties[domain]["mail"] \
 	  and domain_properties[env["PRIMARY_HOSTNAME"]]["certificate-is-valid"] \
 	  and is_domain_cert_signed_and_valid("mta-sts." + domain, env):
@@ -374,10 +347,28 @@ def has_rec(qname, rtype, prefix=None):
 		if env.get("MTA_STS_TLSRPT_RUA") and not has_rec("_smtp._tls", "TXT", prefix="v=TLSRPTv1;"):
 			mta_sts_records.append(("_smtp._tls", "TXT", "v=TLSRPTv1; rua=" + env["MTA_STS_TLSRPT_RUA"], "Optional. Enables MTA-STS reporting."))
 	for qname, rtype, value, explanation in mta_sts_records:
-		if value is None or value.strip() == "": continue # skip IPV6 if not set
 		if not has_rec(qname, rtype):
 			records.append((qname, rtype, value, explanation))
 
+	# Add no-mail-here records for any qname that has an A or AAAA record
+	# but no MX record. This would include domain itself if domain is a
+	# non-mail domain and also may include qnames from custom DNS records.
+	# Do this once at the end of generating a zone.
+	if is_zone:
+		qnames_with_a = set(qname for (qname, rtype, value, explanation) in records if rtype in ("A", "AAAA"))
+		qnames_with_mx = set(qname for (qname, rtype, value, explanation) in records if rtype == "MX")
+		for qname in qnames_with_a - qnames_with_mx:
+			# Mark this domain as not sending mail with hard-fail SPF and DMARC records.
+			d = (qname+"." if qname else "") + domain
+			if not has_rec(qname, "TXT", prefix="v=spf1 "):
+				records.append((qname,  "TXT", 'v=spf1 -all', "Recommended. Prevents use of this domain name for outbound mail by specifying that no servers are valid sources for mail from @%s. If you do send email from this domain name you should either override this record such that the SPF rule does allow the originating server, or, take the recommended approach and have the box handle mail for this domain (simply add any receiving alias at this domain name to make this machine treat the domain name as one of its mail domains)." % d))
+			if not has_rec("_dmarc" + ("."+qname if qname else ""), "TXT", prefix="v=DMARC1; "):
+				records.append(("_dmarc" + ("."+qname if qname else ""), "TXT", 'v=DMARC1; p=reject', "Recommended. Prevents use of this domain name for outbound mail by specifying that the SPF rule should be honoured for mail from @%s." % d))
+
+			# And with a null MX record (https://explained-from-first-principles.com/email/#null-mx-record)
+			if not has_rec(qname, "MX"):
+				records.append((qname, "MX", '0 .', "Recommended. Prevents use of this domain name for incoming mail."))
+
 	# Sort the records. The None records *must* go first in the nsd zone file. Otherwise it doesn't matter.
 	records.sort(key = lambda rec : list(reversed(rec[0].split(".")) if rec[0] is not None else ""))
 

management/web_update.py

@@ -27,7 +27,7 @@ def get_web_domains(env, include_www_redirects=True, include_auto=True, exclude_
 	if include_auto:
 		# Add Autoconfiguration domains for domains that there are user accounts at:
 		# 'autoconfig.' for Mozilla Thunderbird auto setup.
-		# 'autodiscover.' for Activesync autodiscovery.
+		# 'autodiscover.' for ActiveSync autodiscovery (Z-Push).
 		domains |= set('autoconfig.' + maildomain for maildomain in get_mail_domains(env, users_only=True))
 		domains |= set('autodiscover.' + maildomain for maildomain in get_mail_domains(env, users_only=True))