<?php
/**
* SeekQuarry/Yioop --
* Open Source Pure PHP Search Engine, Crawler, and Indexer
*
* Copyright (C) 2009 - 2026 Chris Pollett chris@pollett.org
*
* LICENSE:
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* END LICENSE
*
* @author Chris Pollett chris@pollett.org
* @license https://www.gnu.org/licenses/ GPL3
* @link https://www.seekquarry.com/
* @copyright 2009 - 2026
* @filesource
*/
namespace seekquarry\yioop\tests;
use seekquarry\yioop\library\mail\MailSiteFactory;
use seekquarry\yioop\library\UnitTest;
/**
* Tests for the MTA-STS policy helpers on MailSiteFactory:
* mtaStsMode (posture to policy mode), mtaStsPolicy (policy file
* body for one domain), and mtaStsDomainForHost (request host to
* policy domain). All three are static pure functions of their
* arguments, so the cases are self-contained; no setUp data or
* teardown is required.
*
* @author Chris Pollett
*/
class MailStsPolicyTest extends UnitTest
{
/**
* No set-up state needed; the helpers are static pure
* functions of their arguments.
*/
public function setUp()
{
}
/**
* No teardown needed either.
*/
public function tearDown()
{
}
/**
* Each delivery posture maps to the expected policy mode: the
* insecure posture publishes nothing, spam publishes a testing
* policy, and require publishes an enforce policy.
*/
public function modeMappingTestCase()
{
$this->assertEqual('', MailSiteFactory::mtaStsMode(
'insecure'), "insecure posture publishes no policy");
$this->assertEqual('testing', MailSiteFactory::mtaStsMode(
'spam'), "spam posture publishes a testing policy");
$this->assertEqual('enforce', MailSiteFactory::mtaStsMode(
'require'), "require posture publishes enforce");
}
/**
* The policy body carries the RFC 8461 fields: the STSv1
* version, the mode, both a wildcard and an apex mx line for
* the domain, and a max_age, with CRLF line endings.
*/
public function policyBodyTestCase()
{
$policy = MailSiteFactory::mtaStsPolicy('testing',
'yioop.com');
$this->assertTrue(strpos($policy, "version: STSv1") === 0,
"policy starts with the STSv1 version line");
$this->assertTrue(strpos($policy, "mode: testing") !== false,
"policy carries the mode");
$this->assertTrue(strpos($policy, "mx: *.yioop.com") !== false,
"policy authorizes subdomain MX hosts");
$this->assertTrue(strpos($policy, "mx: yioop.com") !== false,
"policy authorizes an apex MX host");
$this->assertTrue(strpos($policy, "max_age: ") !== false,
"policy carries a max_age");
$this->assertTrue(strpos($policy, "\r\n") !== false,
"policy uses CRLF line endings");
}
/**
* An empty mode yields an empty policy body, so the route can
* treat it as nothing to serve.
*/
public function emptyModeYieldsNoPolicyTestCase()
{
$this->assertEqual('', MailSiteFactory::mtaStsPolicy('',
'yioop.com'), "no mode means no policy body");
}
/**
* The dedicated mta-sts.<domain> host resolves to that
* configured domain, matched case-insensitively, while a host
* for an unconfigured domain resolves to nothing.
*/
public function hostResolvesConfiguredDomainTestCase()
{
$domains = ['yioop.com', 'example.org'];
$this->assertEqual('yioop.com',
MailSiteFactory::mtaStsDomainForHost(
'mta-sts.yioop.com', $domains),
"mta-sts host resolves to its domain");
$this->assertEqual('example.org',
MailSiteFactory::mtaStsDomainForHost(
'MTA-STS.Example.Org', $domains),
"host match is case-insensitive");
$this->assertEqual('',
MailSiteFactory::mtaStsDomainForHost(
'mta-sts.notmine.com', $domains),
"unconfigured domain resolves to nothing");
}
/**
* A bare configured domain (without the mta-sts prefix) does
* not resolve, so the apex site is not mistaken for the policy
* host.
*/
public function bareDomainDoesNotResolveTestCase()
{
$domains = ['yioop.com'];
$this->assertEqual('',
MailSiteFactory::mtaStsDomainForHost('yioop.com',
$domains), "bare domain is not the policy host");
}
/**
* Loopback hosts resolve to the first configured domain as a
* testing convenience, and a port suffix on the host is
* ignored.
*/
public function loopbackTestPathTestCase()
{
$domains = ['yioop.com', 'example.org'];
$this->assertEqual('yioop.com',
MailSiteFactory::mtaStsDomainForHost('localhost',
$domains), "localhost resolves to the first domain");
$this->assertEqual('yioop.com',
MailSiteFactory::mtaStsDomainForHost('127.0.0.1:8080',
$domains), "a port suffix is ignored");
}
/**
* The suggested SPF and DMARC record strings carry their
* version tags, SPF authorizes the domain's MX hosts with a
* soft-fail default, and DMARC starts in report-only mode with
* the report address woven into the rua tag when given.
*/
public function spfAndDmarcRecordsTestCase()
{
$spf = MailSiteFactory::spfTxtRecord();
$this->assertTrue(strpos($spf, 'v=spf1') === 0,
"SPF record starts with the version tag");
$this->assertTrue(strpos($spf, 'mx') !== false,
"SPF authorizes the MX hosts");
$this->assertTrue(strpos($spf, '~all') !== false,
"SPF soft-fails other senders by default");
$dmarc = MailSiteFactory::dmarcTxtRecord(
'postmaster@yioop.com');
$this->assertTrue(strpos($dmarc, 'v=DMARC1') === 0,
"DMARC record starts with the version tag");
$this->assertTrue(strpos($dmarc, 'p=none') !== false,
"DMARC starts in report-only policy");
$this->assertTrue(
strpos($dmarc, 'rua=mailto:postmaster@yioop.com')
!== false, "DMARC carries the aggregate-report address");
$bare = MailSiteFactory::dmarcTxtRecord('');
$this->assertTrue(strpos($bare, 'rua=') === false,
"DMARC omits rua when no report address is given");
}
/**
* The _mta-sts discovery record carries the STSv1 version and
* the given id when a policy is published, and is empty when
* the posture publishes no policy.
*/
public function mtaStsTxtRecordTestCase()
{
$record = MailSiteFactory::mtaStsTxtRecord('testing', 42);
$this->assertTrue(strpos($record, 'v=STSv1') === 0,
"discovery record starts with the version tag");
$this->assertTrue(strpos($record, 'id=42') !== false,
"discovery record carries the policy id");
$this->assertEqual('',
MailSiteFactory::mtaStsTxtRecord('', 42),
"no discovery record when no policy is published");
}
/**
* The assembled suggestions include SPF and DMARC for every
* domain, add the MTA-STS records only under a policy-
* publishing posture, and skip them under the insecure
* posture.
*/
public function suggestedRecordsAssemblyTestCase()
{
$secure = MailSiteFactory::suggestedDnsRecords(
['yioop.com'], 'spam', 100, 'postmaster@yioop.com');
$hosts = array_column($secure['yioop.com'], 'host');
$this->assertTrue(in_array('yioop.com', $hosts),
"SPF record present at the apex host");
$this->assertTrue(in_array('_dmarc.yioop.com', $hosts),
"DMARC record present at _dmarc host");
$this->assertTrue(in_array('_mta-sts.yioop.com', $hosts),
"MTA-STS discovery record present under spam posture");
$this->assertTrue(in_array('mta-sts.yioop.com', $hosts),
"MTA-STS policy host record present under spam");
$insecure = MailSiteFactory::suggestedDnsRecords(
['yioop.com'], 'insecure', 100, '');
$hosts = array_column($insecure['yioop.com'], 'host');
$this->assertTrue(!in_array('_mta-sts.yioop.com', $hosts),
"no MTA-STS record under the insecure posture");
$this->assertTrue(in_array('yioop.com', $hosts),
"SPF still suggested under the insecure posture");
}
/**
* When a DKIM selector and public-key record are supplied, the
* suggestions include the <selector>._domainkey.<domain> TXT
* record carrying that value; when no record is supplied (no
* key generated) the DKIM row is omitted.
*/
public function dkimRecordInSuggestionsTestCase()
{
$with = MailSiteFactory::suggestedDnsRecords(['yioop.com'],
'spam', 100, '', 'yioop20260602',
'v=DKIM1; k=rsa; p=ABCDEF');
$dkim = null;
foreach ($with['yioop.com'] as $row) {
if ($row['host'] === 'yioop20260602._domainkey.yioop.com') {
$dkim = $row;
}
}
$this->assertTrue($dkim !== null,
"DKIM record present at the selector host");
$this->assertEqual('v=DKIM1; k=rsa; p=ABCDEF',
$dkim['value'], "DKIM record carries the key value");
$without = MailSiteFactory::suggestedDnsRecords(
['yioop.com'], 'spam', 100, '', 'yioop20260602', '');
$hosts = array_column($without['yioop.com'], 'host');
$this->assertTrue(
!in_array('yioop20260602._domainkey.yioop.com', $hosts),
"no DKIM row when no key record is supplied");
}
/**
* A www. or mta-sts. host of a domain already in the list is
* not given its own record set, since it is not an independent
* mail domain; a bare www./mta-sts. host whose apex is not
* listed still gets one.
*/
public function subdomainOfListedApexSkippedTestCase()
{
$records = MailSiteFactory::suggestedDnsRecords(
['pollett.org', 'mta-sts.pollett.org',
'www.pollett.org'], 'spam', 100, '');
$this->assertTrue(isset($records['pollett.org']),
"apex mail domain keeps its record set");
$this->assertTrue(!isset($records['mta-sts.pollett.org']),
"mta-sts host of a listed apex is skipped");
$this->assertTrue(!isset($records['www.pollett.org']),
"www host of a listed apex is skipped");
$alone = MailSiteFactory::suggestedDnsRecords(
['www.example.com'], 'spam', 100, '');
$this->assertTrue(isset($alone['www.example.com']),
"www host with no listed apex still gets a set");
}
}
(c) 2026 Seekquarry - Open Source Search Engine Software