audit

Documentation

Overview

Package audit checks published DNS through a real resolver rather than through the provider API, because the API reports what you asked for and not what the internet sees.

Index

• type Check
• type Fetcher
  • func HTTPFetcher() Fetcher
• type Report
  • func Run(ctx context.Context, d config.Domain, desired []dns.Record, resolver Resolver, ...) Report
  • func (r Report) OK() bool
  • func (r Report) Render(w io.Writer)
• type Resolver
  • func NetResolver() Resolver

Types

type Check

type Check struct {
	Name string
	Want string
	Got  string
	OK   bool
}

type Fetcher

type Fetcher interface {
	Get(ctx context.Context, url string) (string, error)
}

func HTTPFetcher

func HTTPFetcher() Fetcher

HTTPFetcher returns a Fetcher backed by net/http.

type Report

type Report struct {
	Domain string
	Checks []Check
	Notes  []string
}

func Run

func Run(ctx context.Context, d config.Domain, desired []dns.Record, resolver Resolver, fetcher Fetcher) Report

Run resolves every desired record and, when MTA-STS is configured, fetches the policy endpoint. mode: none is included: it is a published withdrawal policy (a rotated _mta-sts TXT id plus a Worker serving mode: none), not an absence of publication, so it is audited like any other mode.

func (Report) OK

func (r Report) OK() bool

func (Report) Render

func (r Report) Render(w io.Writer)

Render writes failures first; a long list of passes should not hide the one line that matters.

type Resolver

type Resolver interface {
	LookupMX(ctx context.Context, name string) ([]string, error)
	LookupTXT(ctx context.Context, name string) ([]string, error)
	LookupCNAME(ctx context.Context, name string) (string, error)
}

func NetResolver

func NetResolver() Resolver

NetResolver returns a Resolver backed by the system resolver.