Sentinel checks email hygiene: SPF, DMARC, CAA. When I pointed it at sentinel.nyxoralabs.com, it reported no DMARC record and told me to fix it:
Add TXT at _dmarc.sentinel.nyxoralabs.com: "v=DMARC1; p=quarantine; ..."That advice is wrong. If I had followed it, I’d have created a record that does nothing.
DMARC resolves at the organizational domain. nyxoralabs.com publishes p=quarantine, and that policy already covers every subdomain under it. There was nothing to fix. My tool had looked for a record at the exact host, not found one, and confidently told me to create something unnecessary.
The cause was a line I’d written earlier without thinking hard about it:
const domain = host.replace(/^www\./, "")A www special case standing in for actual domain resolution. It handled the one subdomain I’d thought about and silently mishandled every other. Anyone scanning app.theirsite.com or blog.whatever.com would have gotten the same wrong answer and the same useless advice.
Fixing it properly meant admitting I couldn’t do it with string manipulation. You cannot find the boundary between a domain and its public suffix by counting labels. co.ke has two. github.io looks like a domain and isn’t. Getting that boundary wrong means querying the wrong domain, which means giving wrong advice again, just more elaborately.
So I took a dependency on the Public Suffix List, in a package I’d deliberately kept dependency-light. The argument that convinced me: I can’t hand-roll this honestly. A correct implementation is shipping and maintaining the suffix list. A hand-rolled subset goes stale silently, which is worse than a dependency, because at least a dependency announces its version.
While implementing subdomain policy inheritance, I found a second bug hiding behind the first. My tag parser used p=(\w+), which happily matches the p inside sp=. On any domain publishing a subdomain policy, I’d have read the wrong tag. Nobody was looking for that one either.
Wrong remediation is worse than silence. A tool that says nothing leaves you where you were. A tool that tells you to do the wrong thing moves you backwards and charges you for the privilege.