implement dnssec-awareness throughout code, and dane for incoming/outgoing mail delivery

the vendored dns resolver code is a copy of the go stdlib dns resolver, with
awareness of the "authentic data" (i.e. dnssec secure) added, as well as support
for enhanced dns errors, and looking up tlsa records (for dane). ideally it
would be upstreamed, but the chances seem slim.

dnssec-awareness is added to all packages, e.g. spf, dkim, dmarc, iprev. their
dnssec status is added to the Received message headers for incoming email.

but the main reason to add dnssec was for implementing dane. with dane, the
verification of tls certificates can be done through certificates/public keys
published in dns (in the tlsa records). this only makes sense (is trustworthy)
if those dns records can be verified to be authentic.

mox now applies dane to delivering messages over smtp. mox already implemented
mta-sts for webpki/pkix-verification of certificates against the (large) pool
of CA's, and still enforces those policies when present. but it now also checks
for dane records, and will verify those if present. if dane and mta-sts are
both absent, the regular opportunistic tls with starttls is still done. and the
fallback to plaintext is also still done.

mox also makes it easy to setup dane for incoming deliveries, so other servers
can deliver with dane tls certificate verification. the quickstart now
generates private keys that are used when requesting certificates with acme.
the private keys are pre-generated because they must be static and known during
setup, because their public keys must be published in tlsa records in dns.
autocert would generate private keys on its own, so had to be forked to add the
option to provide the private key when requesting a new certificate. hopefully
upstream will accept the change and we can drop the fork.

with this change, using the quickstart to setup a new mox instance, the checks
at internet.nl result in a 100% score, provided the domain is dnssec-signed and
the network doesn't have any issues.

smtpclient/client.go

@@ -17,6 +17,9 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 
+	"github.com/mjl-/adns"
+
+	"github.com/mjl-/mox/dane"
 	"github.com/mjl-/mox/dns"
 	"github.com/mjl-/mox/metrics"
 	"github.com/mjl-/mox/mlog"
@@ -49,7 +52,7 @@ var (
 	ErrSMTPUTF8Unsupported = errors.New("remote smtp server does not implement smtputf8 extension, required by message")
 	ErrStatus              = errors.New("remote smtp server sent unexpected response status code") // Relatively common, e.g. when a 250 OK was expected and server sent 451 temporary error.
 	ErrProtocol            = errors.New("smtp protocol error")                                     // After a malformed SMTP response or inconsistent multi-line response.
-	ErrTLS                 = errors.New("tls error")                                               // E.g. handshake failure, or hostname validation was required and failed.
+	ErrTLS                 = errors.New("tls error")                                               // E.g. handshake failure, or hostname verification was required and failed.
 	ErrBotched             = errors.New("smtp connection is botched")                              // Set on a client, and returned for new operations, after an i/o error or malformed SMTP response.
 	ErrClosed              = errors.New("client is closed")
 )
@@ -58,13 +61,20 @@ var (
 type TLSMode string
 
 const (
-	// TLS with STARTTLS for MX SMTP servers, with validated certificate is required: matching name, not expired, trusted by CA.
+	// Required TLS with STARTTLS for SMTP servers, with either verified DANE TLSA
+	// record, or a WebPKI-verified certificate (with matching name, not expired, etc).
 	TLSStrictStartTLS TLSMode = "strictstarttls"
 
-	// TLS immediately ("implicit TLS"), with validated certificate is required: matching name, not expired, trusted by CA.
+	// Required TLS with STARTTLS for SMTP servers, without verifiying the certificate.
+	// This mode is needed to fallback after only unusable DANE records were found
+	// (e.g. with unknown parameters in the TLSA records).
+	TLSUnverifiedStartTLS TLSMode = "unverifiedstarttls"
+
+	// TLS immediately ("implicit TLS"), with either verified DANE TLSA records or a
+	// verified certificate: matching name, not expired, trusted by CA.
 	TLSStrictImmediate TLSMode = "strictimmediate"
 
-	// Use TLS if remote claims to support it, but do not validate the certificate
+	// Use TLS if remote claims to support it, but do not verify the certificate
 	// (not trusted by CA, different host name or expired certificate is accepted).
 	TLSOpportunistic TLSMode = "opportunistic"
 
@@ -80,8 +90,12 @@ type Client struct {
 	// can be wrapped in a tls.Client. We close origConn instead of conn because
 	// closing the TLS connection would send a TLS close notification, which may block
 	// for 5s if the server isn't reading it (because it is also sending it).
-	origConn net.Conn
-	conn     net.Conn
+	origConn            net.Conn
+	conn                net.Conn
+	remoteHostname      dns.Domain   // TLS with SNI and name verification.
+	daneRecords         []adns.TLSA  // For authenticating (START)TLS connection.
+	moreRemoteHostnames []dns.Domain // Additional allowed names in TLS certificate.
+	verifiedRecord      *adns.TLSA   // If non-nil, then will be set to verified DANE record if any.
 
 	r        *bufio.Reader
 	w        *bufio.Writer
@@ -164,21 +178,27 @@ func (e Error) Error() string {
 // records with preferences, other DNS records, MTA-STS, retries and special
 // cases into account.
 //
-// tlsMode indicates if TLS is required, optional or should not be used. A
-// certificate is only validated (trusted, match remoteHostname and not expired)
-// for the strict tls modes. By default, SMTP does not verify TLS for
-// interopability reasons, but MTA-STS or DANE can require it. If opportunistic TLS
-// is used, and a TLS error is encountered, the caller may want to try again (on a
-// new connection) without TLS.
+// tlsMode indicates if TLS is required, optional or should not be used. Only for
+// strict TLS modes is the certificate verified: Either with DANE, or through
+// the trusted CA pool with matching remoteHostname and not expired. For DANE,
+// additional host names in moreRemoteHostnames are allowed during TLS certificate
+// verification. By default, SMTP does not verify TLS for interopability reasons,
+// but MTA-STS or DANE can require it. If opportunistic TLS is used, and a TLS
+// error is encountered, the caller may want to try again (on a new connection)
+// without TLS.
 //
 // If auth is non-empty, authentication will be done with the first algorithm
 // supported by the server. If none of the algorithms are supported, an error is
 // returned.
-func New(ctx context.Context, log *mlog.Log, conn net.Conn, tlsMode TLSMode, ourHostname, remoteHostname dns.Domain, auth []sasl.Client) (*Client, error) {
+func New(ctx context.Context, log *mlog.Log, conn net.Conn, tlsMode TLSMode, ehloHostname, remoteHostname dns.Domain, auth []sasl.Client, daneRecords []adns.TLSA, moreRemoteHostnames []dns.Domain, verifiedRecord *adns.TLSA) (*Client, error) {
 	c := &Client{
-		origConn: conn,
-		lastlog:  time.Now(),
-		cmds:     []string{"(none)"},
+		origConn:            conn,
+		remoteHostname:      remoteHostname,
+		daneRecords:         daneRecords,
+		moreRemoteHostnames: moreRemoteHostnames,
+		verifiedRecord:      verifiedRecord,
+		lastlog:             time.Now(),
+		cmds:                []string{"(none)"},
 	}
 	c.log = log.Fields(mlog.Field("smtpclient", "")).MoreFields(func() []mlog.Pair {
 		now := time.Now()
@@ -190,12 +210,9 @@ func New(ctx context.Context, log *mlog.Log, conn net.Conn, tlsMode TLSMode, our
 	})
 
 	if tlsMode == TLSStrictImmediate {
-		tlsconfig := tls.Config{
-			ServerName: remoteHostname.ASCII,
-			RootCAs:    mox.Conf.Static.TLS.CertPool,
-			MinVersion: tls.VersionTLS12, // ../rfc/8996:31 ../rfc/8997:66
-		}
-		tlsconn := tls.Client(conn, &tlsconfig)
+		// todo: we could also verify DANE here. not applicable to SMTP delivery.
+		config := c.tlsConfig(tlsMode)
+		tlsconn := tls.Client(conn, &config)
 		if err := tlsconn.HandshakeContext(ctx); err != nil {
 			return nil, err
 		}
@@ -216,12 +233,25 @@ func New(ctx context.Context, log *mlog.Log, conn net.Conn, tlsMode TLSMode, our
 	c.tw = moxio.NewTraceWriter(c.log, "LC: ", timeoutWriter{c.conn, 30 * time.Second, c.log})
 	c.w = bufio.NewWriter(c.tw)
 
-	if err := c.hello(ctx, tlsMode, ourHostname, remoteHostname, auth); err != nil {
+	if err := c.hello(ctx, tlsMode, ehloHostname, auth); err != nil {
 		return nil, err
 	}
 	return c, nil
 }
 
+func (c *Client) tlsConfig(tlsMode TLSMode) tls.Config {
+	if c.daneRecords != nil {
+		return dane.TLSClientConfig(c.log, c.daneRecords, c.remoteHostname, c.moreRemoteHostnames, c.verifiedRecord)
+	}
+	// todo: possibly accept older TLS versions for TLSOpportunistic?
+	return tls.Config{
+		ServerName:         c.remoteHostname.ASCII,
+		RootCAs:            mox.Conf.Static.TLS.CertPool,
+		InsecureSkipVerify: tlsMode == TLSOpportunistic || tlsMode == TLSUnverifiedStartTLS,
+		MinVersion:         tls.VersionTLS12, // ../rfc/8996:31 ../rfc/8997:66
+	}
+}
+
 // xbotchf generates a temporary error and marks the client as botched. e.g. for
 // i/o errors or invalid protocol messages.
 func (c *Client) xbotchf(code int, secode string, lastLine, format string, args ...any) {
@@ -463,7 +493,7 @@ func (c *Client) recover(rerr *error) {
 	*rerr = cerr
 }
 
-func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remoteHostname dns.Domain, auth []sasl.Client) (rerr error) {
+func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ehloHostname dns.Domain, auth []sasl.Client) (rerr error) {
 	defer c.recover(&rerr)
 
 	// perform EHLO handshake, falling back to HELO if server does not appear to
@@ -474,7 +504,7 @@ func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remote
 		c.cmds[0] = "ehlo"
 		c.cmdStart = time.Now()
 		// Syntax: ../rfc/5321:1827
-		c.xwritelinef("EHLO %s", ourHostname.ASCII)
+		c.xwritelinef("EHLO %s", ehloHostname.ASCII)
 		code, _, lastLine, remains := c.xreadecode(false)
 		switch code {
 		// ../rfc/5321:997
@@ -486,7 +516,7 @@ func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remote
 			// ../rfc/5321:996
 			c.cmds[0] = "helo"
 			c.cmdStart = time.Now()
-			c.xwritelinef("HELO %s", ourHostname.ASCII)
+			c.xwritelinef("HELO %s", ehloHostname.ASCII)
 			code, _, lastLine, _ = c.xreadecode(false)
 			if code != smtp.C250Completed {
 				c.xerrorf(code/100 == 5, code, "", lastLine, "%w: expected 250 to HELO, got %d", ErrStatus, code)
@@ -536,8 +566,8 @@ func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remote
 	hello(true)
 
 	// Attempt TLS if remote understands STARTTLS and we aren't doing immediate TLS or if caller requires it.
-	if c.extStartTLS && (tlsMode != TLSSkip && tlsMode != TLSStrictImmediate) || tlsMode == TLSStrictStartTLS {
-		c.log.Debug("starting tls client", mlog.Field("tlsmode", tlsMode), mlog.Field("servername", remoteHostname))
+	if c.extStartTLS && (tlsMode != TLSSkip && tlsMode != TLSStrictImmediate) || tlsMode == TLSStrictStartTLS || tlsMode == TLSUnverifiedStartTLS {
+		c.log.Debug("starting tls client", mlog.Field("tlsmode", tlsMode), mlog.Field("servername", c.remoteHostname))
 		c.cmds[0] = "starttls"
 		c.cmdStart = time.Now()
 		c.xwritelinef("STARTTLS")
@@ -561,14 +591,8 @@ func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remote
 
 		// For TLSStrictStartTLS, the Go TLS library performs the checks needed for MTA-STS.
 		// ../rfc/8461:646
-		// todo: possibly accept older TLS versions for TLSOpportunistic?
-		tlsConfig := &tls.Config{
-			ServerName:         remoteHostname.ASCII,
-			RootCAs:            mox.Conf.Static.TLS.CertPool,
-			InsecureSkipVerify: tlsMode != TLSStrictStartTLS,
-			MinVersion:         tls.VersionTLS12, // ../rfc/8996:31 ../rfc/8997:66
-		}
-		nconn := tls.Client(conn, tlsConfig)
+		tlsConfig := c.tlsConfig(tlsMode)
+		nconn := tls.Client(conn, &tlsConfig)
 		c.conn = nconn
 
 		nctx, cancel := context.WithTimeout(ctx, time.Minute)
@@ -584,7 +608,7 @@ func (c *Client) hello(ctx context.Context, tlsMode TLSMode, ourHostname, remote
 		c.w = bufio.NewWriter(c.tw)
 
 		tlsversion, ciphersuite := mox.TLSInfo(nconn)
-		c.log.Debug("starttls client handshake done", mlog.Field("tls", tlsversion), mlog.Field("ciphersuite", ciphersuite), mlog.Field("servername", remoteHostname), mlog.Field("insecureskipverify", tlsConfig.InsecureSkipVerify))
+		c.log.Debug("starttls client handshake done", mlog.Field("tlsmode", tlsMode), mlog.Field("tls", tlsversion), mlog.Field("ciphersuite", ciphersuite), mlog.Field("servername", c.remoteHostname), mlog.Field("danerecord", c.verifiedRecord))
 
 		hello(false)
 	}
@@ -916,3 +940,13 @@ func (c *Client) Close() (rerr error) {
 	}
 	return
 }
+
+// Conn returns the connection with initialized SMTP session. Once the caller uses
+// this connection it is in control, and responsible for closing the connection,
+// and other functions on the client must not be called anymore.
+func (c *Client) Conn() (net.Conn, error) {
+	if err := c.conn.SetDeadline(time.Time{}); err != nil {
+		return nil, fmt.Errorf("clearing io deadlines: %w", err)
+	}
+	return c.conn, nil
+}

smtpclient/client_test.go

@@ -271,7 +271,7 @@ func TestClient(t *testing.T) {
 				result <- fmt.Errorf("client: %w", fmt.Errorf(format, args...))
 				panic("stop")
 			}
-			c, err := New(ctx, log, clientConn, opts.tlsMode, localhost, opts.tlsHostname, auths)
+			c, err := New(ctx, log, clientConn, opts.tlsMode, localhost, opts.tlsHostname, auths, nil, nil, nil)
 			if (err == nil) != (expClientErr == nil) || err != nil && !errors.As(err, reflect.New(reflect.ValueOf(expClientErr).Type()).Interface()) && !errors.Is(err, expClientErr) {
 				fail("new client: got err %v, expected %#v", err, expClientErr)
 			}
@@ -373,7 +373,7 @@ func TestErrors(t *testing.T) {
 	run(t, func(s xserver) {
 		s.writeline("bogus") // Invalid, should be "220 <hostname>".
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, ErrProtocol) || !errors.As(err, &xerr) || xerr.Permanent {
 			panic(fmt.Errorf("got %#v, expected ErrProtocol without Permanent", err))
@@ -384,7 +384,7 @@ func TestErrors(t *testing.T) {
 	run(t, func(s xserver) {
 		s.conn.Close()
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, io.ErrUnexpectedEOF) || !errors.As(err, &xerr) || xerr.Permanent {
 			panic(fmt.Errorf("got %#v (%v), expected ErrUnexpectedEOF without Permanent", err, err))
@@ -395,7 +395,7 @@ func TestErrors(t *testing.T) {
 	run(t, func(s xserver) {
 		s.writeline("521 not accepting connections")
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, ErrStatus) || !errors.As(err, &xerr) || !xerr.Permanent {
 			panic(fmt.Errorf("got %#v, expected ErrStatus with Permanent", err))
@@ -406,7 +406,7 @@ func TestErrors(t *testing.T) {
 	run(t, func(s xserver) {
 		s.writeline("2200 mox.example") // Invalid, too many digits.
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, ErrProtocol) || !errors.As(err, &xerr) || xerr.Permanent {
 			panic(fmt.Errorf("got %#v, expected ErrProtocol without Permanent", err))
@@ -420,7 +420,7 @@ func TestErrors(t *testing.T) {
 		s.writeline("250-mox.example")
 		s.writeline("500 different code") // Invalid.
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		_, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, ErrProtocol) || !errors.As(err, &xerr) || xerr.Permanent {
 			panic(fmt.Errorf("got %#v, expected ErrProtocol without Permanent", err))
@@ -436,7 +436,7 @@ func TestErrors(t *testing.T) {
 		s.readline("MAIL FROM:")
 		s.writeline("550 5.7.0 not allowed")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -456,7 +456,7 @@ func TestErrors(t *testing.T) {
 		s.readline("MAIL FROM:")
 		s.writeline("451 bad sender")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -478,7 +478,7 @@ func TestErrors(t *testing.T) {
 		s.readline("RCPT TO:")
 		s.writeline("451")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -502,7 +502,7 @@ func TestErrors(t *testing.T) {
 		s.readline("DATA")
 		s.writeline("550 no!")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -522,7 +522,7 @@ func TestErrors(t *testing.T) {
 		s.readline("STARTTLS")
 		s.writeline("502 command not implemented")
 	}, func(conn net.Conn) {
-		_, err := New(ctx, log, conn, TLSStrictStartTLS, localhost, dns.Domain{ASCII: "mox.example"}, nil)
+		_, err := New(ctx, log, conn, TLSStrictStartTLS, localhost, dns.Domain{ASCII: "mox.example"}, nil, nil, nil, nil)
 		var xerr Error
 		if err == nil || !errors.Is(err, ErrTLS) || !errors.As(err, &xerr) || !xerr.Permanent {
 			panic(fmt.Errorf("got %#v, expected ErrTLS with Permanent", err))
@@ -538,7 +538,7 @@ func TestErrors(t *testing.T) {
 		s.readline("MAIL FROM:")
 		s.writeline("451 enough")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSSkip, localhost, dns.Domain{ASCII: "mox.example"}, nil)
+		c, err := New(ctx, log, conn, TLSSkip, localhost, dns.Domain{ASCII: "mox.example"}, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -568,7 +568,7 @@ func TestErrors(t *testing.T) {
 		s.readline("DATA")
 		s.writeline("550 not now")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}
@@ -598,7 +598,7 @@ func TestErrors(t *testing.T) {
 		s.readline("MAIL FROM:")
 		s.writeline("550 ok")
 	}, func(conn net.Conn) {
-		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil)
+		c, err := New(ctx, log, conn, TLSOpportunistic, localhost, zerohost, nil, nil, nil, nil)
 		if err != nil {
 			panic(err)
 		}

smtpclient/dial.go

@@ -0,0 +1,87 @@
+package smtpclient
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"time"
+
+	"github.com/mjl-/mox/dns"
+	"github.com/mjl-/mox/mlog"
+	"github.com/mjl-/mox/mox-"
+)
+
+// DialHook can be used during tests to override the regular dialer from being used.
+var DialHook func(ctx context.Context, dialer Dialer, timeout time.Duration, addr string, laddr net.Addr) (net.Conn, error)
+
+func dial(ctx context.Context, dialer Dialer, timeout time.Duration, addr string, laddr net.Addr) (net.Conn, error) {
+	// todo: see if we can remove this function and DialHook in favor of the Dialer interface.
+
+	if DialHook != nil {
+		return DialHook(ctx, dialer, timeout, addr, laddr)
+	}
+
+	// If this is a net.Dialer, use its settings and add the timeout and localaddr.
+	// This is the typical case, but SOCKS5 support can use a different dialer.
+	if d, ok := dialer.(*net.Dialer); ok {
+		nd := *d
+		nd.Timeout = timeout
+		nd.LocalAddr = laddr
+		return nd.DialContext(ctx, "tcp", addr)
+	}
+	return dialer.DialContext(ctx, "tcp", addr)
+}
+
+// Dialer is used to dial mail servers, an interface to facilitate testing.
+type Dialer interface {
+	DialContext(ctx context.Context, network, addr string) (c net.Conn, err error)
+}
+
+// Dial connects to host by dialing ips, taking previous attempts in dialedIPs into
+// accounts (for greylisting, blocklisting and ipv4/ipv6).
+//
+// If the previous attempt used IPv4, this attempt will use IPv6 (in case one of
+// the IPs is in a DNSBL).
+// The second attempt for an address family we prefer the same IP as earlier, to
+// increase our chances if remote is doing greylisting.
+//
+// Dial updates dialedIPs, callers may want to save it so it can be taken into
+// account for future delivery attempts.
+//
+// If we have fully specified local SMTP listener IPs, we set those for the
+// outgoing connection. The admin probably configured these same IPs in SPF, but
+// others possibly not.
+func Dial(ctx context.Context, log *mlog.Log, dialer Dialer, host dns.IPDomain, ips []net.IP, port int, dialedIPs map[string][]net.IP) (conn net.Conn, ip net.IP, rerr error) {
+	timeout := 30 * time.Second
+	if deadline, ok := ctx.Deadline(); ok && len(ips) > 0 {
+		timeout = time.Until(deadline) / time.Duration(len(ips))
+	}
+
+	var lastErr error
+	var lastIP net.IP
+	for _, ip := range ips {
+		addr := net.JoinHostPort(ip.String(), fmt.Sprintf("%d", port))
+		log.Debug("dialing host", mlog.Field("addr", addr))
+		var laddr net.Addr
+		for _, lip := range mox.Conf.Static.SpecifiedSMTPListenIPs {
+			ipIs4 := ip.To4() != nil
+			lipIs4 := lip.To4() != nil
+			if ipIs4 == lipIs4 {
+				laddr = &net.TCPAddr{IP: lip}
+				break
+			}
+		}
+		conn, err := dial(ctx, dialer, timeout, addr, laddr)
+		if err == nil {
+			log.Debug("connected to host", mlog.Field("host", host), mlog.Field("addr", addr), mlog.Field("laddr", laddr))
+			name := host.String()
+			dialedIPs[name] = append(dialedIPs[name], ip)
+			return conn, ip, nil
+		}
+		log.Debugx("connection attempt", err, mlog.Field("host", host), mlog.Field("addr", addr), mlog.Field("laddr", laddr))
+		lastErr = err
+		lastIP = ip
+	}
+	// todo: possibly return all errors joined?
+	return nil, lastIP, lastErr
+}

smtpclient/dial_test.go

@@ -0,0 +1,57 @@
+package smtpclient
+
+import (
+	"context"
+	"net"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/mjl-/mox/dns"
+	"github.com/mjl-/mox/mlog"
+)
+
+func TestDialHost(t *testing.T) {
+	// We mostly want to test that dialing a second time switches to the other address family.
+	ctxbg := context.Background()
+	log := mlog.New("smtpclient")
+
+	resolver := dns.MockResolver{
+		A: map[string][]string{
+			"dualstack.example.": {"10.0.0.1"},
+		},
+		AAAA: map[string][]string{
+			"dualstack.example.": {"2001:db8::1"},
+		},
+	}
+
+	DialHook = func(ctx context.Context, dialer Dialer, timeout time.Duration, addr string, laddr net.Addr) (net.Conn, error) {
+		return nil, nil // No error, nil connection isn't used.
+	}
+	defer func() {
+		DialHook = nil
+	}()
+
+	ipdomain := func(s string) dns.IPDomain {
+		return dns.IPDomain{Domain: dns.Domain{ASCII: s}}
+	}
+
+	dialedIPs := map[string][]net.IP{}
+	_, _, _, ips, dualstack, err := GatherIPs(ctxbg, log, resolver, ipdomain("dualstack.example"), dialedIPs)
+	if err != nil || !reflect.DeepEqual(ips, []net.IP{net.ParseIP("10.0.0.1"), net.ParseIP("2001:db8::1")}) || !dualstack {
+		t.Fatalf("expected err nil, address 10.0.0.1,2001:db8::1, dualstack true, got %v %v %v", err, ips, dualstack)
+	}
+	_, ip, err := Dial(ctxbg, log, nil, ipdomain("dualstack.example"), ips, 25, dialedIPs)
+	if err != nil || ip.String() != "10.0.0.1" {
+		t.Fatalf("expected err nil, address 10.0.0.1, dualstack true, got %v %v %v", err, ip, dualstack)
+	}
+
+	_, _, _, ips, dualstack, err = GatherIPs(ctxbg, log, resolver, ipdomain("dualstack.example"), dialedIPs)
+	if err != nil || !reflect.DeepEqual(ips, []net.IP{net.ParseIP("2001:db8::1"), net.ParseIP("10.0.0.1")}) || !dualstack {
+		t.Fatalf("expected err nil, address 2001:db8::1,10.0.0.1, dualstack true, got %v %v %v", err, ips, dualstack)
+	}
+	_, ip, err = Dial(ctxbg, log, nil, ipdomain("dualstack.example"), ips, 25, dialedIPs)
+	if err != nil || ip.String() != "2001:db8::1" {
+		t.Fatalf("expected err nil, address 2001:db8::1, dualstack true, got %v %v %v", err, ip, dualstack)
+	}
+}

smtpclient/gather.go

@@ -0,0 +1,419 @@
+package smtpclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/sha512"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	"net"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/mjl-/adns"
+
+	"github.com/mjl-/mox/dns"
+	"github.com/mjl-/mox/mlog"
+)
+
+var (
+	errCNAMELoop  = errors.New("cname loop")
+	errCNAMELimit = errors.New("too many cname records")
+	errDNS        = errors.New("dns lookup error")
+	errNoMail     = errors.New("domain does not accept email as indicated with single dot for mx record")
+)
+
+// GatherDestinations looks up the hosts to deliver email to a domain ("next-hop").
+// If it is an IP address, it is the only destination to try. Otherwise CNAMEs of
+// the domain are followed. Then MX records for the expanded CNAME are looked up.
+// If no MX record is present, the original domain is returned. If an MX record is
+// present but indicates the domain does not accept email, ErrNoMail is returned.
+// If valid MX records were found, the MX target hosts are returned.
+//
+// haveMX indicates if an MX record was found.
+//
+// origNextHopAuthentic indicates if the DNS record for the initial domain name was
+// DNSSEC secure (CNAME, MX).
+//
+// expandedNextHopAuthentic indicates if the DNS records after following CNAMEs were
+// DNSSEC secure.
+//
+// These authentic flags are used by DANE, to determine where to look up TLSA
+// records, and which names to allow in the remote TLS certificate. If MX records
+// were found, both the original and expanded next-hops must be authentic for DANE
+// to apply. For a non-IP with no MX records found, the authentic result can be
+// used to decide which of the names to use as TLSA base domain.
+func GatherDestinations(ctx context.Context, log *mlog.Log, resolver dns.Resolver, origNextHop dns.IPDomain) (haveMX, origNextHopAuthentic, expandedNextHopAuthentic bool, expandedNextHop dns.Domain, hosts []dns.IPDomain, permanent bool, err error) {
+	// ../rfc/5321:3824
+
+	// IP addresses are dialed directly, and don't have TLSA records.
+	if len(origNextHop.IP) > 0 {
+		return false, false, false, expandedNextHop, []dns.IPDomain{origNextHop}, false, nil
+	}
+
+	// We start out assuming the result is authentic. Updated with each lookup.
+	origNextHopAuthentic = true
+	expandedNextHopAuthentic = true
+
+	// We start out delivering to the recipient domain. We follow CNAMEs.
+	rcptDomain := origNextHop.Domain
+	// Domain we are actually delivering to, after following CNAME record(s).
+	expandedNextHop = rcptDomain
+	// Keep track of CNAMEs we have followed, to detect loops.
+	domainsSeen := map[string]bool{}
+	for i := 0; ; i++ {
+		if domainsSeen[expandedNextHop.ASCII] {
+			// todo: only mark as permanent failure if TTLs for all records are beyond latest possibly delivery retry we would do.
+			err := fmt.Errorf("%w: recipient domain %s: already saw %s", errCNAMELoop, rcptDomain, expandedNextHop)
+			return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, false, err
+		}
+		domainsSeen[expandedNextHop.ASCII] = true
+
+		// note: The Go resolver returns the requested name if the domain has no CNAME
+		// record but has a host record.
+		if i == 16 {
+			// We have a maximum number of CNAME records we follow. There is no hard limit for
+			// DNS, and you might think folks wouldn't configure CNAME chains at all, but for
+			// (non-mail) domains, CNAME chains of 10 records have been encountered according
+			// to the internet.
+			// todo: only mark as permanent failure if TTLs for all records are beyond latest possibly delivery retry we would do.
+			err := fmt.Errorf("%w: recipient domain %s, last resolved domain %s", errCNAMELimit, rcptDomain, expandedNextHop)
+			return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, false, err
+		}
+
+		// Do explicit CNAME lookup. Go's LookupMX also resolves CNAMEs, but we want to
+		// know the final name, and we're interested in learning if the first vs later
+		// results were DNSSEC-(in)secure.
+		// ../rfc/5321:3838 ../rfc/3974:197
+		cctx, ccancel := context.WithTimeout(ctx, 30*time.Second)
+		defer ccancel()
+		cname, cnameResult, err := resolver.LookupCNAME(cctx, expandedNextHop.ASCII+".")
+		ccancel()
+		if i == 0 {
+			origNextHopAuthentic = origNextHopAuthentic && cnameResult.Authentic
+		}
+		expandedNextHopAuthentic = expandedNextHopAuthentic && cnameResult.Authentic
+		if err != nil && !dns.IsNotFound(err) {
+			err = fmt.Errorf("%w: cname lookup for %s: %v", errDNS, expandedNextHop, err)
+			return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, false, err
+		}
+		if err == nil && cname != expandedNextHop.ASCII+"." {
+			d, err := dns.ParseDomain(strings.TrimSuffix(cname, "."))
+			if err != nil {
+				// todo: only mark as permanent failure if TTLs for all records are beyond latest possibly delivery retry we would do.
+				err = fmt.Errorf("%w: parsing cname domain %s: %v", errDNS, expandedNextHop, err)
+				return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, false, err
+			}
+			expandedNextHop = d
+			// Start again with new domain.
+			continue
+		}
+
+		// Not a CNAME, so lookup MX record.
+		mctx, mcancel := context.WithTimeout(ctx, 30*time.Second)
+		defer mcancel()
+		// Note: LookupMX can return an error and still return records: Invalid records are
+		// filtered out and an error returned. We must process any records that are valid.
+		// Only if all are unusable will we return an error. ../rfc/5321:3851
+		mxl, mxResult, err := resolver.LookupMX(mctx, expandedNextHop.ASCII+".")
+		mcancel()
+		if i == 0 {
+			origNextHopAuthentic = origNextHopAuthentic && mxResult.Authentic
+		}
+		expandedNextHopAuthentic = expandedNextHopAuthentic && mxResult.Authentic
+		if err != nil && len(mxl) == 0 {
+			if !dns.IsNotFound(err) {
+				err = fmt.Errorf("%w: mx lookup for %s: %v", errDNS, expandedNextHop, err)
+				return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, false, err
+			}
+
+			// No MX record, attempt delivery directly to host. ../rfc/5321:3842
+			hosts = []dns.IPDomain{{Domain: expandedNextHop}}
+			return false, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, hosts, false, nil
+		} else if err != nil {
+			log.Infox("mx record has some invalid records, keeping only the valid mx records", err)
+		}
+
+		// ../rfc/7505:122
+		if err == nil && len(mxl) == 1 && mxl[0].Host == "." {
+			// Note: Depending on MX record TTL, this record may be replaced with a more
+			// receptive MX record before our final delivery attempt. But it's clearly the
+			// explicit desire not to be bothered with email delivery attempts, so mark failure
+			// as permanent.
+			return true, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, true, errNoMail
+		}
+
+		// The Go resolver already sorts by preference, randomizing records of same
+		// preference. ../rfc/5321:3885
+		for _, mx := range mxl {
+			host, err := dns.ParseDomain(strings.TrimSuffix(mx.Host, "."))
+			if err != nil {
+				// note: should not happen because Go resolver already filters these out.
+				err = fmt.Errorf("%w: invalid host name in mx record %q: %v", errDNS, mx.Host, err)
+				return true, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, nil, true, err
+			}
+			hosts = append(hosts, dns.IPDomain{Domain: host})
+		}
+		if len(hosts) > 0 {
+			err = nil
+		}
+		return true, origNextHopAuthentic, expandedNextHopAuthentic, expandedNextHop, hosts, false, err
+	}
+}
+
+// GatherIPs looks up the IPs to try for connecting to host, with the IPs ordered
+// to take previous attempts into account. For use with DANE, the CNAME-expanded
+// name is returned, and whether the DNS responses were authentic.
+func GatherIPs(ctx context.Context, log *mlog.Log, resolver dns.Resolver, host dns.IPDomain, dialedIPs map[string][]net.IP) (authentic bool, expandedAuthentic bool, expandedHost dns.Domain, ips []net.IP, dualstack bool, rerr error) {
+	if len(host.IP) > 0 {
+		return false, false, dns.Domain{}, []net.IP{host.IP}, false, nil
+	}
+
+	authentic = true
+	expandedAuthentic = true
+
+	// The Go resolver automatically follows CNAMEs, which is not allowed for host
+	// names in MX records, but seems to be accepted and is documented for DANE SMTP
+	// behaviour. We resolve CNAMEs explicitly, so we can return the final name, which
+	// DANE needs. ../rfc/7671:246
+	// ../rfc/5321:3861 ../rfc/2181:661 ../rfc/7672:1382 ../rfc/7671:1030
+	name := host.Domain.ASCII + "."
+
+	for i := 0; ; i++ {
+		cname, result, err := resolver.LookupCNAME(ctx, name)
+		if i == 0 {
+			authentic = result.Authentic
+		}
+		expandedAuthentic = expandedAuthentic && result.Authentic
+		if dns.IsNotFound(err) {
+			break
+		} else if err != nil {
+			return authentic, expandedAuthentic, dns.Domain{}, nil, dualstack, err
+		} else if strings.TrimSuffix(cname, ".") == strings.TrimSuffix(name, ".") {
+			break
+		}
+		if i > 10 {
+			return authentic, expandedAuthentic, dns.Domain{}, nil, dualstack, fmt.Errorf("mx lookup: %w", errCNAMELimit)
+		}
+		name = strings.TrimSuffix(cname, ".") + "."
+	}
+
+	if name == host.Domain.ASCII+"." {
+		expandedHost = host.Domain
+	} else {
+		var err error
+		expandedHost, err = dns.ParseDomain(strings.TrimSuffix(name, "."))
+		if err != nil {
+			return authentic, expandedAuthentic, dns.Domain{}, nil, dualstack, fmt.Errorf("parsing cname-resolved domain: %w", err)
+		}
+	}
+
+	ipaddrs, result, err := resolver.LookupIPAddr(ctx, name)
+	authentic = authentic && result.Authentic
+	expandedAuthentic = expandedAuthentic && result.Authentic
+	if err != nil || len(ipaddrs) == 0 {
+		return authentic, expandedAuthentic, expandedHost, nil, false, fmt.Errorf("looking up %q: %w", name, err)
+	}
+	var have4, have6 bool
+	for _, ipaddr := range ipaddrs {
+		ips = append(ips, ipaddr.IP)
+		if ipaddr.IP.To4() == nil {
+			have6 = true
+		} else {
+			have4 = true
+		}
+	}
+	dualstack = have4 && have6
+	prevIPs := dialedIPs[host.String()]
+	if len(prevIPs) > 0 {
+		prevIP := prevIPs[len(prevIPs)-1]
+		prevIs4 := prevIP.To4() != nil
+		sameFamily := 0
+		for _, ip := range prevIPs {
+			is4 := ip.To4() != nil
+			if prevIs4 == is4 {
+				sameFamily++
+			}
+		}
+		preferPrev := sameFamily == 1
+		// We use stable sort so any preferred/randomized listing from DNS is kept intact.
+		sort.SliceStable(ips, func(i, j int) bool {
+			aIs4 := ips[i].To4() != nil
+			bIs4 := ips[j].To4() != nil
+			if aIs4 != bIs4 {
+				// Prefer "i" if it is not same address family.
+				return aIs4 != prevIs4
+			}
+			// Prefer "i" if it is the same as last and we should be preferring it.
+			return preferPrev && ips[i].Equal(prevIP)
+		})
+		log.Debug("ordered ips for dialing", mlog.Field("ips", ips))
+	}
+	return
+}
+
+// GatherTLSA looks up TLSA record for either expandedHost or host, and returns
+// records usable for DANE with SMTP, and host names to allow in DANE-TA
+// certificate name verification.
+//
+// If no records are found, this isn't necessarily an error. It can just indicate
+// the domain/host does not opt-in to DANE, and nil records and a nil error are
+// returned.
+//
+// Only usable records are returned. If any record was found, DANE is required and
+// this is indicated with daneRequired. If no usable records remain, the caller
+// must do TLS, but not verify the remote TLS certificate.
+func GatherTLSA(ctx context.Context, log *mlog.Log, resolver dns.Resolver, host dns.Domain, expandedAuthentic bool, expandedHost dns.Domain) (daneRequired bool, daneRecords []adns.TLSA, tlsaBaseDomain dns.Domain, err error) {
+	// ../rfc/7672:912
+	// This function is only called when the lookup of host was authentic.
+
+	var l []adns.TLSA
+
+	if host == expandedHost || !expandedAuthentic {
+		tlsaBaseDomain = host
+		l, err = lookupTLSACNAME(ctx, log, resolver, 25, "tcp", host)
+	} else if expandedAuthentic {
+		// ../rfc/7672:934
+		tlsaBaseDomain = expandedHost
+		l, err = lookupTLSACNAME(ctx, log, resolver, 25, "tcp", expandedHost)
+		if err == nil && len(l) == 0 {
+			tlsaBaseDomain = host
+			l, err = lookupTLSACNAME(ctx, log, resolver, 25, "tcp", host)
+		}
+	}
+	if len(l) == 0 || err != nil {
+		daneRequired = err != nil
+		log.Debugx("gathering tlsa records failed", err, mlog.Field("danerequired", daneRequired))
+		return daneRequired, nil, dns.Domain{}, err
+	}
+	daneRequired = len(l) > 0
+	l = filterUsableTLSARecords(log, l)
+	log.Debug("tlsa records exist", mlog.Field("danerequired", daneRequired), mlog.Field("records", l), mlog.Field("basedomain", tlsaBaseDomain))
+	return daneRequired, l, tlsaBaseDomain, err
+}
+
+// lookupTLSACNAME composes a TLSA domain name to lookup, follows CNAMEs and looks
+// up TLSA records. no TLSA records exist, a nil error is returned as it means
+// the host does not opt-in to DANE.
+func lookupTLSACNAME(ctx context.Context, log *mlog.Log, resolver dns.Resolver, port int, protocol string, host dns.Domain) (l []adns.TLSA, rerr error) {
+	name := fmt.Sprintf("_%d._%s.%s", port, protocol, host.ASCII+".")
+	for i := 0; ; i++ {
+		cname, result, err := resolver.LookupCNAME(ctx, name)
+		if dns.IsNotFound(err) {
+			if !result.Authentic {
+				log.Debugx("cname nxdomain result during tlsa lookup not authentic, not doing dane for host", err, mlog.Field("host", host), mlog.Field("name", name))
+				return nil, nil
+			}
+			break
+		} else if err != nil {
+			return nil, fmt.Errorf("looking up cname for tlsa candidate base domain: %w", err)
+		} else if !result.Authentic {
+			log.Debugx("cname result during tlsa lookup not authentic, not doing dane for host", err, mlog.Field("host", host), mlog.Field("name", name))
+			return nil, nil
+		}
+		if i == 10 {
+			return nil, fmt.Errorf("looking up cname for tlsa candidate base domain: %w", errCNAMELimit)
+		}
+		name = strings.TrimSuffix(cname, ".") + "."
+	}
+	var result adns.Result
+	var err error
+	l, result, err = resolver.LookupTLSA(ctx, 0, "", name)
+	if dns.IsNotFound(err) || err == nil && len(l) == 0 {
+		log.Debugx("no tlsa records for host, not doing dane", err, mlog.Field("host", host), mlog.Field("name", name), mlog.Field("authentic", result.Authentic))
+		return nil, nil
+	} else if err != nil {
+		return nil, fmt.Errorf("looking up tlsa records for tlsa candidate base domain: %w", err)
+	} else if !result.Authentic {
+		log.Debugx("tlsa lookup not authentic, not doing dane for host", err, mlog.Field("host", host), mlog.Field("name", name))
+		return nil, err
+	}
+	return l, nil
+}
+
+func filterUsableTLSARecords(log *mlog.Log, l []adns.TLSA) []adns.TLSA {
+	// Gather "usable" records. ../rfc/7672:708
+	o := 0
+	for _, r := range l {
+		// A record is not usable when we don't recognize parameters. ../rfc/6698:649
+
+		switch r.Usage {
+		case adns.TLSAUsageDANETA, adns.TLSAUsageDANEEE:
+		default:
+			// We can regard PKIX-TA and PKIX-EE as "unusable" with SMTP DANE. ../rfc/7672:1304
+			continue
+		}
+		switch r.Selector {
+		case adns.TLSASelectorCert, adns.TLSASelectorSPKI:
+		default:
+			continue
+		}
+		switch r.MatchType {
+		case adns.TLSAMatchTypeFull:
+			if r.Selector == adns.TLSASelectorCert {
+				if _, err := x509.ParseCertificate(r.CertAssoc); err != nil {
+					log.Debugx("parsing certificate in dane tlsa record, ignoring", err)
+					continue
+				}
+			} else if r.Selector == adns.TLSASelectorSPKI {
+				if _, err := x509.ParsePKIXPublicKey(r.CertAssoc); err != nil {
+					log.Debugx("parsing certificate in dane tlsa record, ignoring", err)
+					continue
+				}
+			}
+		case adns.TLSAMatchTypeSHA256:
+			if len(r.CertAssoc) != sha256.Size {
+				log.Debug("dane tlsa record with wrong data size for sha2-256", mlog.Field("got", len(r.CertAssoc)), mlog.Field("expect", sha256.Size))
+				continue
+			}
+		case adns.TLSAMatchTypeSHA512:
+			if len(r.CertAssoc) != sha512.Size {
+				log.Debug("dane tlsa record with wrong data size for sha2-512", mlog.Field("got", len(r.CertAssoc)), mlog.Field("expect", sha512.Size))
+				continue
+			}
+		default:
+			continue
+		}
+
+		l[o] = r
+		o++
+	}
+	return l[:o]
+}
+
+// GatherTLSANames returns the allowed names in TLS certificates for verification
+// with PKIX-* or DANE-TA. The first name should be used for SNI.
+//
+// If there was no MX record, the next-hop domain parameters (i.e. the original
+// email destination host, and its CNAME-expanded host, that has MX records) are
+// ignored and only the base domain parameters are taken into account.
+func GatherTLSANames(haveMX, expandedNextHopAuthentic, expandedTLSABaseDomainAuthentic bool, origNextHop, expandedNextHop, origTLSABaseDomain, expandedTLSABaseDomain dns.Domain) []dns.Domain {
+	// Gather the names to check against TLS certificate. ../rfc/7672:1318
+	if !haveMX {
+		// ../rfc/7672:1336
+		if !expandedTLSABaseDomainAuthentic || origTLSABaseDomain == expandedTLSABaseDomain {
+			return []dns.Domain{origTLSABaseDomain}
+		}
+		return []dns.Domain{expandedTLSABaseDomain, origTLSABaseDomain}
+	} else if expandedNextHopAuthentic {
+		// ../rfc/7672:1326
+		var l []dns.Domain
+		if expandedTLSABaseDomainAuthentic {
+			l = []dns.Domain{expandedTLSABaseDomain}
+		}
+		if expandedTLSABaseDomain != origTLSABaseDomain {
+			l = append(l, origTLSABaseDomain)
+		}
+		l = append(l, origNextHop)
+		if origNextHop != expandedNextHop {
+			l = append(l, expandedNextHop)
+		}
+		return l
+	} else {
+		// We don't attempt DANE after insecure MX, but behaviour for it is specified.
+		// ../rfc/7672:1332
+		return []dns.Domain{origNextHop}
+	}
+}

smtpclient/gather_test.go

@@ -0,0 +1,309 @@
+package smtpclient
+
+import (
+	"context"
+	"crypto/sha256"
+	"errors"
+	"fmt"
+	"net"
+	"reflect"
+	"testing"
+
+	"github.com/mjl-/adns"
+
+	"github.com/mjl-/mox/dns"
+	"github.com/mjl-/mox/mlog"
+)
+
+func domain(s string) dns.Domain {
+	d, err := dns.ParseDomain(s)
+	if err != nil {
+		panic("parse domain: " + err.Error())
+	}
+	return d
+}
+
+func ipdomain(s string) dns.IPDomain {
+	ip := net.ParseIP(s)
+	if ip != nil {
+		return dns.IPDomain{IP: ip}
+	}
+	d, err := dns.ParseDomain(s)
+	if err != nil {
+		panic(fmt.Sprintf("parse domain %q: %v", s, err))
+	}
+	return dns.IPDomain{Domain: d}
+}
+
+func ipdomains(s ...string) (l []dns.IPDomain) {
+	for _, e := range s {
+		l = append(l, ipdomain(e))
+	}
+	return
+}
+
+// Test basic MX lookup case, but also following CNAME, detecting CNAME loops and
+// having a CNAME limit, connecting directly to a host, and domain that does not
+// exist or has temporary error.
+func TestGatherDestinations(t *testing.T) {
+	ctxbg := context.Background()
+	log := mlog.New("smtpclient")
+
+	resolver := dns.MockResolver{
+		MX: map[string][]*net.MX{
+			"basic.example.":        {{Host: "mail.basic.example.", Pref: 10}},
+			"multimx.example.":      {{Host: "mail1.multimx.example.", Pref: 10}, {Host: "mail2.multimx.example.", Pref: 10}},
+			"nullmx.example.":       {{Host: ".", Pref: 10}},
+			"temperror-mx.example.": {{Host: "absent.example.", Pref: 10}},
+		},
+		A: map[string][]string{
+			"mail.basic.example":   {"10.0.0.1"},
+			"justhost.example.":    {"10.0.0.1"}, // No MX record for domain, only an A record.
+			"temperror-a.example.": {"10.0.0.1"},
+		},
+		AAAA: map[string][]string{
+			"justhost6.example.": {"2001:db8::1"}, // No MX record for domain, only an AAAA record.
+		},
+		CNAME: map[string]string{
+			"cname.example.":                "basic.example.",
+			"cname-to-inauthentic.example.": "cnameinauthentic.example.",
+			"cnameinauthentic.example.":     "basic.example.",
+			"cnameloop.example.":            "cnameloop2.example.",
+			"cnameloop2.example.":           "cnameloop.example.",
+			"danglingcname.example.":        "absent.example.", // Points to missing name.
+			"temperror-cname.example.":      "absent.example.",
+		},
+		Fail: map[dns.Mockreq]struct{}{
+			{Type: "mx", Name: "temperror-mx.example."}:       {},
+			{Type: "host", Name: "temperror-a.example."}:      {},
+			{Type: "cname", Name: "temperror-cname.example."}: {},
+		},
+		Inauthentic: []string{"cname cnameinauthentic.example."},
+	}
+	for i := 0; i <= 16; i++ {
+		s := fmt.Sprintf("cnamelimit%d.example.", i)
+		next := fmt.Sprintf("cnamelimit%d.example.", i+1)
+		resolver.CNAME[s] = next
+	}
+
+	test := func(ipd dns.IPDomain, expHosts []dns.IPDomain, expDomain dns.Domain, expPerm, expAuthic, expExpAuthic bool, expErr error) {
+		t.Helper()
+
+		_, authic, authicExp, ed, hosts, perm, err := GatherDestinations(ctxbg, log, resolver, ipd)
+		if (err == nil) != (expErr == nil) || err != nil && !errors.Is(err, expErr) {
+			// todo: could also check the individual errors? code currently does not have structured errors.
+			t.Fatalf("gather hosts: %v, expected %v", err, expErr)
+		}
+		if err != nil {
+			return
+		}
+		if !reflect.DeepEqual(hosts, expHosts) || ed != expDomain || perm != expPerm || authic != expAuthic || authicExp != expExpAuthic {
+			t.Fatalf("got hosts %#v, effectiveDomain %#v, permanent %#v, authic %v %v, expected %#v %#v %#v %v %v", hosts, ed, perm, authic, authicExp, expHosts, expDomain, expPerm, expAuthic, expExpAuthic)
+		}
+	}
+
+	var zerodom dns.Domain
+
+	for i := 0; i < 2; i++ {
+		authic := i == 1
+		resolver.AllAuthentic = authic
+		// Basic with simple MX.
+		test(ipdomain("basic.example"), ipdomains("mail.basic.example"), domain("basic.example"), false, authic, authic, nil)
+		test(ipdomain("multimx.example"), ipdomains("mail1.multimx.example", "mail2.multimx.example"), domain("multimx.example"), false, authic, authic, nil)
+		// Only an A record.
+		test(ipdomain("justhost.example"), ipdomains("justhost.example"), domain("justhost.example"), false, authic, authic, nil)
+		// Only an AAAA record.
+		test(ipdomain("justhost6.example"), ipdomains("justhost6.example"), domain("justhost6.example"), false, authic, authic, nil)
+		// Follow CNAME.
+		test(ipdomain("cname.example"), ipdomains("mail.basic.example"), domain("basic.example"), false, authic, authic, nil)
+		// No MX/CNAME, non-existence of host will be found out later.
+		test(ipdomain("absent.example"), ipdomains("absent.example"), domain("absent.example"), false, authic, authic, nil)
+		// Followed CNAME, has no MX, non-existence of host will be found out later.
+		test(ipdomain("danglingcname.example"), ipdomains("absent.example"), domain("absent.example"), false, authic, authic, nil)
+		test(ipdomain("cnamelimit1.example"), nil, zerodom, true, authic, authic, errCNAMELimit)
+		test(ipdomain("cnameloop.example"), nil, zerodom, true, authic, authic, errCNAMELoop)
+		test(ipdomain("nullmx.example"), nil, zerodom, true, authic, authic, errNoMail)
+		test(ipdomain("temperror-mx.example"), nil, zerodom, false, authic, authic, errDNS)
+		test(ipdomain("temperror-cname.example"), nil, zerodom, false, authic, authic, errDNS)
+	}
+
+	test(ipdomain("10.0.0.1"), ipdomains("10.0.0.1"), zerodom, false, false, false, nil)
+	test(ipdomain("cnameinauthentic.example"), ipdomains("mail.basic.example"), domain("basic.example"), false, false, false, nil)
+	test(ipdomain("cname-to-inauthentic.example"), ipdomains("mail.basic.example"), domain("basic.example"), false, true, false, nil)
+}
+
+func TestGatherIPs(t *testing.T) {
+	ctxbg := context.Background()
+	log := mlog.New("smtpclient")
+
+	resolver := dns.MockResolver{
+		A: map[string][]string{
+			"host1.example.":       {"10.0.0.1"},
+			"host2.example.":       {"10.0.0.2"},
+			"temperror-a.example.": {"10.0.0.3"},
+		},
+		AAAA: map[string][]string{
+			"host2.example.": {"2001:db8::1"},
+		},
+		CNAME: map[string]string{
+			"cname1.example.":               "host1.example.",
+			"cname-to-inauthentic.example.": "cnameinauthentic.example.",
+			"cnameinauthentic.example.":     "host1.example.",
+			"cnameloop.example.":            "cnameloop2.example.",
+			"cnameloop2.example.":           "cnameloop.example.",
+			"danglingcname.example.":        "absent.example.", // Points to missing name.
+			"temperror-cname.example.":      "absent.example.",
+		},
+		Fail: map[dns.Mockreq]struct{}{
+			{Type: "host", Name: "temperror-a.example."}:      {},
+			{Type: "cname", Name: "temperror-cname.example."}: {},
+		},
+		Inauthentic: []string{"cname cnameinauthentic.example."},
+	}
+
+	test := func(host dns.IPDomain, expAuthic, expAuthicExp bool, expHostExp dns.Domain, expIPs []net.IP, expErr any) {
+		t.Helper()
+
+		authic, authicExp, hostExp, ips, _, err := GatherIPs(ctxbg, log, resolver, host, nil)
+		if (err == nil) != (expErr == nil) || err != nil && !(errors.Is(err, expErr.(error)) || errors.As(err, &expErr)) {
+			// todo: could also check the individual errors?
+			t.Fatalf("gather hosts: %v, expected %v", err, expErr)
+		}
+		if err != nil {
+			return
+		}
+		if expHostExp == zerohost {
+			expHostExp = host.Domain
+		}
+		if authic != expAuthic || authicExp != expAuthicExp || hostExp != expHostExp || !reflect.DeepEqual(ips, expIPs) {
+			t.Fatalf("got authic %v %v, host %v, ips %v, expected %v %v %v %v", authic, authicExp, hostExp, ips, expAuthic, expAuthicExp, expHostExp, expIPs)
+		}
+	}
+
+	ips := func(l ...string) (r []net.IP) {
+		for _, s := range l {
+			r = append(r, net.ParseIP(s))
+		}
+		return r
+	}
+
+	for i := 0; i < 2; i++ {
+		authic := i == 1
+		resolver.AllAuthentic = authic
+
+		test(ipdomain("host1.example"), authic, authic, zerohost, ips("10.0.0.1"), nil)
+		test(ipdomain("host2.example"), authic, authic, zerohost, ips("10.0.0.2", "2001:db8::1"), nil)
+		test(ipdomain("cname-to-inauthentic.example"), authic, false, domain("host1.example"), ips("10.0.0.1"), nil)
+		test(ipdomain("cnameloop.example"), authic, authic, zerohost, nil, errCNAMELimit)
+		test(ipdomain("bogus.example"), authic, authic, zerohost, nil, &adns.DNSError{})
+		test(ipdomain("danglingcname.example"), authic, authic, zerohost, nil, &adns.DNSError{})
+		test(ipdomain("temperror-a.example"), authic, authic, zerohost, nil, &adns.DNSError{})
+		test(ipdomain("temperror-cname.example"), authic, authic, zerohost, nil, &adns.DNSError{})
+
+	}
+	test(ipdomain("cnameinauthentic.example"), false, false, domain("host1.example"), ips("10.0.0.1"), nil)
+	test(ipdomain("cname-to-inauthentic.example"), true, false, domain("host1.example"), ips("10.0.0.1"), nil)
+}
+
+func TestGatherTLSA(t *testing.T) {
+	ctxbg := context.Background()
+	log := mlog.New("smtpclient")
+
+	record := func(usage, selector, matchType uint8) adns.TLSA {
+		return adns.TLSA{
+			Usage:     adns.TLSAUsage(usage),
+			Selector:  adns.TLSASelector(selector),
+			MatchType: adns.TLSAMatchType(matchType),
+			CertAssoc: make([]byte, sha256.Size), // Assume sha256.
+		}
+	}
+	records := func(l ...adns.TLSA) []adns.TLSA {
+		return l
+	}
+
+	record0 := record(3, 1, 1)
+	list0 := records(record0)
+	record1 := record(3, 0, 1)
+	list1 := records(record1)
+
+	resolver := dns.MockResolver{
+		TLSA: map[string][]adns.TLSA{
+			"_25._tcp.host0.example.":           list0,
+			"_25._tcp.host1.example.":           list1,
+			"_25._tcp.inauthentic.example.":     list1,
+			"_25._tcp.temperror-cname.example.": list1,
+		},
+		CNAME: map[string]string{
+			"_25._tcp.cname.example.":                "_25._tcp.host1.example.",
+			"_25._tcp.cnameloop.example.":            "_25._tcp.cnameloop2.example.",
+			"_25._tcp.cnameloop2.example.":           "_25._tcp.cnameloop.example.",
+			"_25._tcp.cname-to-inauthentic.example.": "_25._tcp.cnameinauthentic.example.",
+			"_25._tcp.cnameinauthentic.example.":     "_25._tcp.host1.example.",
+			"_25._tcp.danglingcname.example.":        "_25._tcp.absent.example.", // Points to missing name.
+		},
+		Fail: map[dns.Mockreq]struct{}{
+			{Type: "cname", Name: "_25._tcp.temperror-cname.example."}: {},
+		},
+		Inauthentic: []string{
+			"cname _25._tcp.cnameinauthentic.example.",
+			"tlsa _25._tcp.inauthentic.example.",
+		},
+	}
+
+	test := func(host dns.Domain, expandedAuthentic bool, expandedHost dns.Domain, expDANERequired bool, expRecords []adns.TLSA, expBaseDom dns.Domain, expErr any) {
+		t.Helper()
+
+		daneReq, records, baseDom, err := GatherTLSA(ctxbg, log, resolver, host, expandedAuthentic, expandedHost)
+		if (err == nil) != (expErr == nil) || err != nil && !(errors.Is(err, expErr.(error)) || errors.As(err, &expErr)) {
+			// todo: could also check the individual errors?
+			t.Fatalf("gather tlsa: %v, expected %v", err, expErr)
+		}
+		if daneReq != expDANERequired {
+			t.Fatalf("got daneRequired %v, expected %v", daneReq, expDANERequired)
+		}
+		if err != nil {
+			return
+		}
+		if !reflect.DeepEqual(records, expRecords) || baseDom != expBaseDom {
+			t.Fatalf("got records, baseDomain %v %v, expected %v %v", records, baseDom, expRecords, expBaseDom)
+		}
+	}
+
+	resolver.AllAuthentic = true
+	test(domain("host1.example"), false, domain("host1.example"), true, list1, domain("host1.example"), nil)
+	test(domain("host1.example"), true, domain("host1.example"), true, list1, domain("host1.example"), nil)
+	test(domain("host0.example"), true, domain("host1.example"), true, list1, domain("host1.example"), nil)
+	test(domain("host0.example"), false, domain("host1.example"), true, list0, domain("host0.example"), nil)
+
+	// CNAME for TLSA at cname.example should be followed.
+	test(domain("host0.example"), true, domain("cname.example"), true, list1, domain("cname.example"), nil)
+	// TLSA records at original domain should be followed.
+	test(domain("host0.example"), false, domain("cname.example"), true, list0, domain("host0.example"), nil)
+
+	test(domain("cnameloop.example"), false, domain("cnameloop.example"), true, nil, zerohost, errCNAMELimit)
+
+	test(domain("host0.example"), false, domain("inauthentic.example"), true, list0, domain("host0.example"), nil)
+	test(domain("inauthentic.example"), false, domain("inauthentic.example"), false, nil, zerohost, nil)
+	test(domain("temperror-cname.example"), false, domain("temperror-cname.example"), true, nil, zerohost, &adns.DNSError{})
+
+	test(domain("host1.example"), true, domain("cname-to-inauthentic.example"), true, list1, domain("host1.example"), nil)
+	test(domain("host1.example"), true, domain("danglingcname.example"), true, list1, domain("host1.example"), nil)
+	test(domain("danglingcname.example"), true, domain("danglingcname.example"), false, nil, zerohost, nil)
+}
+
+func TestGatherTLSANames(t *testing.T) {
+	a, b, c, d := domain("nexthop.example"), domain("nexthopexpanded.example"), domain("base.example"), domain("baseexpanded.example")
+	test := func(haveMX, nexthopExpAuth, tlsabaseExpAuth bool, expDoms ...dns.Domain) {
+		t.Helper()
+		doms := GatherTLSANames(haveMX, nexthopExpAuth, tlsabaseExpAuth, a, b, c, d)
+		if !reflect.DeepEqual(doms, expDoms) {
+			t.Fatalf("got domains %v, expected %v", doms, expDoms)
+		}
+	}
+
+	test(false, false, false, c)
+	test(false, false, true, d, c)
+	test(true, true, true, d, c, a, b)
+	test(true, true, false, c, a, b)
+	test(true, false, false, a)
+}