Mail reverse DNS check, what Jarl adds to named.conf, lists one per line

jarld checks the reverse DNS of the public zones' MX and SPF addresses as the internet sees it, every 6 hours (Exposure page, jarl exposure mail, jarl_mail_reverse_dns_ok). The Server options page, jarl option generated and GET /options/generated list what Jarl writes into named.conf by itself; stats.rate_limit_log turns off the query-errors logging. Option lists of three or more elements are shown one per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/server.go

@@ -24,6 +24,7 @@ import (
 	"jarl/internal/certs"
 	"jarl/internal/encdns"
 	"jarl/internal/engine"
+	"jarl/internal/mailcheck"
 	"jarl/internal/nscheck"
 	"jarl/internal/porkbun"
 	"jarl/internal/stats"
@@ -63,6 +64,12 @@ type Config struct {
 	TOTPIssuer  string
 	// Metrics configures /metrics (metrics.go).
 	Metrics Metrics
+	// RateLimitLog says rate limiting's log lines reach the statistics
+	// (stats.rate_limit_log), for the Exposure page.
+	RateLimitLog bool
+	// Resolvers are public recursive resolvers (acme.resolvers), to see
+	// the mail addresses' reverse DNS as receivers do.
+	Resolvers []string
 	// Certs manages TLS certificates (nil in tests that don't need it),
 	// including the one jarld serves (h_certs.go, sniff.go).
 	Certs *certs.Manager
@@ -99,6 +106,11 @@ type Server struct {
 		h *encdns.Health
 	}
 	encRoots *x509.CertPool
+	// mail is the last check of the mail addresses' reverse DNS (h_mail.go).
+	mail struct {
+		sync.Mutex
+		r *mailcheck.Report
+	}
 
 	mu   sync.Mutex
 	srvs []*http.Server
@@ -235,6 +247,7 @@ func (s *Server) Serve(ctx context.Context, ready func()) error {
 		ready()
 	}
 	go s.housekeeping(ctx)
+	go s.mailLoop(ctx)
 	go func() {
 		// Once jarld and named have settled after a start.
 		select {