Syntax06 (syntax06)

Status: Final

Purpose

  • Validate SOA RNAME as an email-like mailbox and verify that its mail domain/exchange resolution path is usable.

Preconditions And Inputs

  • Preconditions:
    • A zone.Zone object is available with a recursor.
  • Required inputs:
    • Nameserver objects from methods.Method4 and methods.Method5.
    • SOA responses from those nameservers.
    • Recursive lookups for MX, A, and AAAA records.
  • Profile/config knobs that affect behavior:
    • net.ipv4 and net.ipv6 can skip SOA probes (with debug tags).
    • resolver.defaults.parallel controls parallel processing of mail-server address checks.

Algorithm And Decision Flow

  1. Emit TEST_CASE_START.
  2. Build deduplicated nameserver list from Method4 and Method5.
  3. For each nameserver:
    • If transport is disabled, emit IPV4_DISABLED or IPV6_DISABLED and skip.
    • Query SOA (RD=0, TCP off).
    • If no response, emit NO_RESPONSE and continue.
    • If no SOA answer, emit NO_RESPONSE_SOA_QUERY and continue.
    • Convert SOA RNAME to email-like form (rnameToEmail).
    • If invalid RFC822 mailbox, emit RNAME_RFC822_INVALID and continue.
    • Resolve MX for mailbox domain (with CNAME-follow behavior from packet/question chain).
    • If MX lookup is not NOERROR, emit RNAME_MAIL_DOMAIN_INVALID and continue.
    • For each deduplicated mail server target (or mailbox domain if no MX):
      • Resolve A and AAAA.
      • Emit RNAME_MAIL_ILLEGAL_CNAME if CNAME appears in A/AAAA answers.
      • Emit RNAME_MAIL_DOMAIN_LOCALHOST when loopback addresses are present.
      • Emit RNAME_MAIL_DOMAIN_INVALID when no usable non-loopback A/AAAA is found.
      • Mark candidate as valid when at least one usable A/AAAA is found.
  4. After processing all nameservers, emit RNAME_RFC822_VALID for remaining valid candidates only when no invalid exchange verdicts were recorded.
  5. Emit TEST_CASE_END.

Emitted Tags (Possible Set)

TagEmitted when
IPV4_DISABLEDIPv4 SOA probing for a nameserver is skipped by profile.
IPV6_DISABLEDIPv6 SOA probing for a nameserver is skipped by profile.
NO_RESPONSENameserver SOA query yields no response packet.
NO_RESPONSE_SOA_QUERYResponse exists but has no SOA answer.
RNAME_MAIL_DOMAIN_INVALIDMail domain/exchange resolution is unusable for delivery checks.
RNAME_MAIL_DOMAIN_LOCALHOSTMail domain/exchange resolves to loopback (127.0.0.1 or ::1).
RNAME_MAIL_ILLEGAL_CNAMEA/AAAA lookup for mail domain/exchange contains CNAME in answer.
RNAME_RFC822_INVALIDConverted SOA RNAME does not validate as mailbox address.
RNAME_RFC822_VALIDConverted SOA RNAME remains valid after all exchange checks.
TEST_CASE_ENDTestcase completion marker is emitted.
TEST_CASE_STARTTestcase start marker is emitted.

Tag Arguments

TagArgument keyTypeMeaning
IPV4_DISABLEDnsstringNameserver identity (ns name only; use address for IP).
IPV4_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV4_DISABLEDrrtypestringrrtype skipped (SOA).
IPV6_DISABLEDnsstringNameserver identity (ns name only; use address for IP).
IPV6_DISABLEDaddressstringNameserver IP address for the same endpoint.
IPV6_DISABLEDrrtypestringrrtype skipped (SOA).
NO_RESPONSEnsstringNameserver identity (ns name only; use address for IP) with no response.
NO_RESPONSEaddressstringNameserver IP address for the same endpoint.
NO_RESPONSEdomainstringTested child zone name.
NO_RESPONSE_SOA_QUERY--No arguments.
RNAME_MAIL_DOMAIN_INVALIDdomainstringInvalid mail domain/exchange target.
RNAME_MAIL_DOMAIN_LOCALHOSTdomainstringMail domain/exchange target resolving to loopback.
RNAME_MAIL_DOMAIN_LOCALHOSTlocalhoststringLoopback address (127.0.0.1 or ::1).
RNAME_MAIL_ILLEGAL_CNAMEdomainstringMail domain/exchange target with illegal CNAME in A/AAAA response.
RNAME_RFC822_INVALIDrnamestringConverted mailbox candidate from SOA RNAME.
RNAME_RFC822_VALIDrnamestringConverted mailbox candidate validated as usable.
TEST_CASE_ENDtestcasestringTestcase display name (Syntax06).
TEST_CASE_STARTtestcasestringTestcase display name (Syntax06).

Severity Levels Per Tag

TagLevelNotes
IPV4_DISABLEDDEBUGDefault from share/profile.json (test_levels.SYNTAX).
IPV6_DISABLEDDEBUGDefault from share/profile.json (test_levels.SYNTAX).
NO_RESPONSEDEBUGDefault from share/profile.json (test_levels.SYNTAX).
NO_RESPONSE_SOA_QUERYDEBUGDefault from share/profile.json (test_levels.SYNTAX).
RNAME_MAIL_DOMAIN_INVALIDNOTICEDefault from share/profile.json (test_levels.SYNTAX).
RNAME_MAIL_DOMAIN_LOCALHOSTWARNINGDefault from share/profile.json (test_levels.SYNTAX).
RNAME_MAIL_ILLEGAL_CNAMEWARNINGDefault from share/profile.json (test_levels.SYNTAX).
RNAME_RFC822_INVALIDWARNINGDefault from share/profile.json (test_levels.SYNTAX).
RNAME_RFC822_VALIDINFODefault from share/profile.json (test_levels.SYNTAX).
TEST_CASE_ENDDEBUGDefault from share/profile.json (test_levels.SYNTAX).
TEST_CASE_STARTDEBUGDefault from share/profile.json (test_levels.SYNTAX).

Differences From Upstream

  • Upstream reference: syntax06.md
  • Differences (Upstream vs Gonemaster):
    • Upstream outcome table lists RNAME_MAIL_DOMAIN_INVALID, RNAME_MAIL_DOMAIN_LOCALHOST, and RNAME_MAIL_ILLEGAL_CNAME as WARNING; Gonemaster profile still maps RNAME_MAIL_DOMAIN_INVALID to NOTICE.
    • Upstream: does not explicitly define this detail. Gonemaster: Transport skip tags (IPV4_DISABLED, IPV6_DISABLED) are emitted but not listed in upstream metadata summary.
  • Potential upstream report:
    • yes
  • If yes, include:
    • Upstream expected behavior: Warning-level outcomes for invalid/localhost/illegal-cname mail domain checks.
    • Gonemaster observed behavior: NOTICE for invalid domain and WARNING for localhost/illegal-cname.
    • evidence: docs/specifications/upstream/tests/Syntax-TP/syntax06.md, share/profile.json, engine/test/syntax/syntax.go.
    • report status: not filed

Edge Cases And Limitations

  • RNAME_RFC822_VALID is emitted only when at least one candidate survives and zero invalid exchange outcomes were recorded.
  • Mail-server checks are deduplicated globally across all nameservers (seenMailServers), so repeated targets are checked once.
  • A/AAAA CNAME detection emits warning-style tags even when another address family later yields a valid exchange.
  • When running through syntax.All, this testcase is skipped if syntax01 did not emit ONLY_ALLOWED_CHARS.
  • When running through syntax.All, this testcase is skipped if syntax05 emitted NO_RESPONSE_SOA_QUERY.