From e8fc41e3941892465349fcda3083ce1e82cebea9 Mon Sep 17 00:00:00 2001 From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com> Date: Sat, 3 Oct 2026 19:49:02 +0530 Subject: [PATCH] test(email): give the exact authserv-id pin rows a passing verdict Every topmost row carried dmarc=fail, so it failed on its verdict no matter what the pin check did: restoring subdomain alignment on the topmost field kept the test green (gate 2ab Low finding). The subdomain and comment-smuggled rows now say dmarc=pass, so only the exact pin rejects them and that mutation goes red. --- tests/gateway/test_email.py | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tests/gateway/test_email.py b/tests/gateway/test_email.py index 01217af686..8bfbda3c41 100644 --- a/tests/gateway/test_email.py +++ b/tests/gateway/test_email.py @@ -1367,13 +1367,14 @@ class TestSenderAuthentication(unittest.TestCase): def test_only_topmost_exact_authserv_id_is_trusted(self): - """Never search below the authoritative field or relax an authserv-id pin.""" + """Never search below the authoritative field or relax an authserv-id pin. + The subdomain and comment-smuggled rows carry dmarc=pass, so only the exact pin rejects them.""" forged_lower = "mx.ourserver.com; dmarc=pass header.from=example.com" for topmost in ( "mx.ourserver.com; dmarc=fail header.from=example.com", "edge.receiver.test; dmarc=fail header.from=example.com", - "child.mx.ourserver.com; dmarc=fail header.from=example.com", - "(mx.ourserver.com) edge.receiver.test; dmarc=fail header.from=example.com", + "child.mx.ourserver.com; dmarc=pass header.from=example.com", + "(mx.ourserver.com) edge.receiver.test; dmarc=pass header.from=example.com", ): with self.subTest(topmost=topmost): ok, reason = self._verify(