Mail reverse DNS check, what Jarl adds to named.conf, lists one per line

jarld checks the reverse DNS of the public zones' MX and SPF addresses as the internet sees it, every 6 hours (Exposure page, jarl exposure mail, jarl_mail_reverse_dns_ok). The Server options page, jarl option generated and GET /options/generated list what Jarl writes into named.conf by itself; stats.rate_limit_log turns off the query-errors logging. Option lists of three or more elements are shown one per line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/static/assets/pages/exposure.js

@@ -1,8 +1,8 @@
 // Internet exposure (docs/exposure.md): which views are reachable from
 // the internet, why, and what to harden, with fixes staged like any edit
 // and findings that can be accepted on purpose.
-import { h, mount, table, toast, badge, modal, input, field, errorBox, select, plural } from "../ui.js";
-import { get, change, describeResult, can } from "../api.js";
+import { h, mount, table, toast, badge, modal, input, field, errorBox, select, plural, relTime } from "../ui.js";
+import { api, get, change, describeResult, can } from "../api.js";
 import { rerender } from "../app.js";
 
 const sevKind = { warning: "warn", error: "err", info: "" };
@@ -28,7 +28,11 @@ export async function render(el) {
   parts.push(h("div", { class: "panel" }, h("h2", null, "Findings ", badge(plural(all.filter((f) => f.severity === "warning").length, "warning"), all.some((f) => f.severity === "warning") ? "warn" : "ok")),
     all.length ? h("div", { class: "findings" }, all.map((f) => findingRow(f, writable))) : h("div", { class: "empty" }, r.scopes.some((s) => s.public) ? "Nothing to harden." : "No view is reachable from the internet, so there is nothing to check.")));
 
-  if (r.rate_limiting) parts.push(activity(r.rate_limiting, r.scopes));
+  if (r.rate_limiting && r.rate_limit_log) parts.push(activity(r.rate_limiting, r.scopes));
+  else if (r.rate_limiting && r.scopes.some((s) => s.public && s.rate_limit !== "off")) {
+    parts.push(h("div", { class: "msg info" }, "What rate limiting limits isn't counted: stats.rate_limit_log is off in /etc/jarl/jarl.yaml, so its log lines stay in named's syslog only."));
+  }
+  if (r.scopes.some((s) => s.public)) parts.push(mailPanel(r.mail));
   mount(el, parts);
 }
 
@@ -118,3 +122,31 @@ function activity(a, scopes) {
         table([{ label: "Client network (limited or would be)", render: (e) => h("span", { class: "mono" }, e.key) }, { label: "Responses", render: (e) => String(e.count) }], a.networks || []),
         table([{ label: "Name and type", render: (e) => h("span", { class: "mono" }, e.key) }, { label: "Responses", render: (e) => String(e.count) }], a.names || []))]);
 }
+
+// mailPanel: the reverse DNS of the addresses that send and receive the
+// public zones' mail, as receivers check it (docs/exposure.md#mail).
+function mailPanel(m) {
+  const out = h("div");
+  const lv = { ok: "ok", info: "", warning: "warn" };
+  const draw = (x) => {
+    if (!x) return mount(out, h("div", { class: "muted" }, "Not checked yet: Jarl checks a minute after it starts, then every 6 hours."));
+    const rows = x.results.length ? table([
+      { label: "Address", render: (r) => [h("span", { class: "mono" }, r.address), h("div", { class: "muted small" }, r.zone + ": " + r.roles.join(", "))] },
+      { label: "PTR", render: (r) => r.ptr.length ? h("span", { class: "mono" }, r.ptr.join(", ")) : h("span", { class: "muted" }, "none") },
+      { label: "Reverse zone run by", render: (r) => h("span", { class: "small" }, r.managed_by || "–") },
+      { label: "", render: (r) => [badge(r.ok ? (r.level === "info" ? "works, note" : "works") : "problem", lv[r.level]),
+        r.level !== "ok" ? h("div", { class: "small" }, r.message) : null,
+        r.local_zone ? h("div", { class: "muted small" }, "Jarl's reverse zone " + r.local_zone + " only answers your own clients: receivers ask " + (r.managed_by || "the address's owner") + ".") : null] },
+    ], x.results) : h("div", { class: "empty" }, "No public zone has an MX record or SPF addresses.");
+    mount(out, rows, (x.errors || []).map((e) => h("div", { class: "msg err small" }, e)),
+      h("div", { class: "muted small" }, "Checked ", relTime(x.checked), "."));
+  };
+  draw(m);
+  const btn = h("button", { class: "small", onclick: async () => {
+    btn.disabled = true;
+    try { draw(await api("POST", "/exposure/mail", { body: {} })); } catch (e) { toast(e.message, "err", 8000); } finally { btn.disabled = false; }
+  } }, "Check now");
+  return h("div", { class: "panel" }, h("div", { class: "page-head" }, h("h2", { class: "grow" }, "Mail reverse DNS"), h("div", { class: "actions" }, btn)),
+    h("p", { class: "muted small" }, "Receivers such as Gmail and Outlook reject or mark mail from an address without a PTR record whose name resolves back to it. These records belong to whoever owns the address (your hosting provider or ISP), so Jarl looks them up as the internet sees them: the addresses of your public zones' MX hosts and SPF records."),
+    out);
+}