Initial commit

checker/collect.go

@@ -0,0 +1,848 @@
+package checker
+
+import (
+	"bytes"
+	"context"
+	"crypto/dsa"
+	"crypto/ecdsa"
+	"crypto/ed25519"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/ProtonMail/go-crypto/openpgp"
+	"github.com/ProtonMail/go-crypto/openpgp/packet"
+	"github.com/miekg/dns"
+
+	sdk "git.happydns.org/checker-sdk-go/checker"
+)
+
+// serviceBody is the common envelope for the two services.
+type serviceBody struct {
+	Username string          `json:"username,omitempty"`
+	OpenPGP  *dns.OPENPGPKEY `json:"openpgpkey,omitempty"`
+	SMIMEA   *dns.SMIMEA     `json:"smimea,omitempty"`
+}
+
+// Collect runs the full DANE-email testsuite and returns an *EmailKeyData
+// carrying every finding it produced. The function never returns an error
+// for domain-level problems; they are recorded as findings so that a
+// subsequent call from the rule can fold them into a single CheckState.
+// A non-nil error is returned only for unrecoverable input problems
+// (missing options, unknown service type).
+func (p *emailKeyProvider) Collect(ctx context.Context, opts sdk.CheckerOptions) (any, error) {
+	svcMsg, err := serviceFromOptions(opts)
+	if err != nil {
+		return nil, err
+	}
+
+	kind := kindForServiceType(svcMsg.Type)
+	if kind == "" {
+		return nil, fmt.Errorf("service type %q is not supported by this checker", svcMsg.Type)
+	}
+
+	var body serviceBody
+	if err := json.Unmarshal(svcMsg.Service, &body); err != nil {
+		return nil, fmt.Errorf("decode service body: %w", err)
+	}
+
+	originOpt, _ := sdk.GetOption[string](opts, "domain_name")
+	subdomainOpt, _ := sdk.GetOption[string](opts, "subdomain")
+	resolverOpt, _ := sdk.GetOption[string](opts, OptionResolver)
+	expiryWarnDays := sdk.GetIntOption(opts, OptionCertExpiryWarnDays, 30)
+	requireDNSSEC := sdk.GetBoolOption(opts, OptionRequireDNSSEC, true)
+	requireEmailProtection := sdk.GetBoolOption(opts, OptionRequireEmailProtection, true)
+
+	origin := strings.TrimSuffix(firstNonEmpty(originOpt, svcMsg.Domain), ".")
+	if origin == "" {
+		return nil, fmt.Errorf("missing 'domain_name' option")
+	}
+	parent := joinSubdomain(subdomainOpt, origin)
+
+	data := &EmailKeyData{
+		Kind:        kind,
+		Domain:      dns.Fqdn(origin),
+		Subdomain:   strings.TrimSuffix(subdomainOpt, "."),
+		Username:    body.Username,
+		CollectedAt: time.Now().UTC(),
+	}
+
+	prefix := OpenPGPKeyPrefix
+	if kind == KindSMIMEA {
+		prefix = SMIMEACertPrefix
+	}
+	expectedOwner, recordedOwner := computeOwner(body, prefix, parent)
+	data.ExpectedOwner = expectedOwner
+	data.QueriedOwner = firstNonEmpty(recordedOwner, expectedOwner)
+
+	// Username hash prefix verification (RFC 7929 §3, RFC 8162 §3).
+	if data.Username != "" {
+		actualPrefix, want := extractOwnerPrefix(data.QueriedOwner, prefix, parent), ownerHashHex(data.Username)
+		if actualPrefix != "" && !strings.EqualFold(actualPrefix, want) {
+			data.Findings = append(data.Findings, Finding{
+				Code:     CodeOwnerHashMismatch,
+				Severity: SeverityCrit,
+				Message:  fmt.Sprintf("Owner name prefix %q does not match SHA-256(%q)[:28]=%q.", actualPrefix, data.Username, want),
+				Fix:      "Republish the record at the hash-derived name for the intended user, or update the Username field to match the record's owner name.",
+			})
+		}
+	}
+
+	// DNS lookup + DNSSEC flag.
+	if data.QueriedOwner != "" {
+		servers := resolvers(resolverOpt)
+		qtype := dns.TypeOPENPGPKEY
+		if kind == KindSMIMEA {
+			qtype = dns.TypeSMIMEA
+		}
+		ans, err := lookup(ctx, servers, data.QueriedOwner, qtype)
+		if err != nil {
+			data.Findings = append(data.Findings, Finding{
+				Code:     CodeDNSQueryFailed,
+				Severity: SeverityCrit,
+				Message:  fmt.Sprintf("DNS lookup for %s %s failed: %v", dns.TypeToString[qtype], data.QueriedOwner, err),
+				Fix:      "Check that the zone is published at an authoritative server reachable from this checker.",
+			})
+		} else {
+			data.Resolver = ans.Server
+			secure := ans.AD
+			data.DNSSECSecure = &secure
+			data.RecordCount = len(ans.Records)
+
+			if ans.Rcode == dns.RcodeNameError || len(ans.Records) == 0 {
+				data.Findings = append(data.Findings, Finding{
+					Code:     CodeDNSNoRecord,
+					Severity: SeverityCrit,
+					Message:  fmt.Sprintf("Authoritative DNS returned no %s record at %s.", dns.TypeToString[qtype], data.QueriedOwner),
+					Fix:      "Ensure the record is present in the zone and that the zone has been loaded by the authoritative servers.",
+				})
+			} else {
+				if !ans.AD {
+					sev := SeverityWarn
+					if requireDNSSEC {
+						sev = SeverityCrit
+					}
+					data.Findings = append(data.Findings, Finding{
+						Code:     CodeDNSNotSecure,
+						Severity: sev,
+						Message:  "The validating resolver did not set the AD flag: the record is not DNSSEC-authenticated, which defeats the whole DANE trust model.",
+						Fix:      "Sign the zone with DNSSEC and publish the DS record at the parent so RFC 7929/8162 consumers can authenticate the key.",
+					})
+				}
+				// Compare observed record with the service-published one.
+				mismatch := false
+				if kind == KindOpenPGPKey && body.OpenPGP != nil {
+					mismatch = !anyOpenPGPMatches(ans.Records, body.OpenPGP)
+				} else if kind == KindSMIMEA && body.SMIMEA != nil {
+					mismatch = !anySMIMEAMatches(ans.Records, body.SMIMEA)
+				}
+				if mismatch {
+					data.Findings = append(data.Findings, Finding{
+						Code:     CodeDNSRecordMismatch,
+						Severity: SeverityWarn,
+						Message:  "The record returned by DNS does not match the one declared in the service. The zone may not have been re-published since the last edit.",
+						Fix:      "Propagate the zone to the authoritative servers, then wait for TTL/negative-cache expiry.",
+					})
+				}
+			}
+		}
+	}
+
+	// Parse the payload from the service body (so we can analyze even if
+	// DNS lookup failed to reach the authoritative servers).
+	if kind == KindOpenPGPKey {
+		data.OpenPGP, data.Findings = analyzeOpenPGP(body, data.Findings, time.Duration(expiryWarnDays)*24*time.Hour)
+	} else {
+		data.SMIMEA, data.Findings = analyzeSMIMEA(body, data.Findings, time.Duration(expiryWarnDays)*24*time.Hour, requireEmailProtection)
+	}
+
+	return data, nil
+}
+
+// serviceFromOptions pulls the "service" option out of the options map,
+// accepting both the in-process plugin path (native Go value) and the
+// HTTP path (JSON-decoded map[string]any). Normalising via a JSON
+// round-trip keeps both paths working without importing the upstream
+// type.
+func serviceFromOptions(opts sdk.CheckerOptions) (*serviceMessage, error) {
+	v, ok := opts["service"]
+	if !ok {
+		return nil, fmt.Errorf("service option missing")
+	}
+	raw, err := json.Marshal(v)
+	if err != nil {
+		return nil, fmt.Errorf("marshal service option: %w", err)
+	}
+	var svc serviceMessage
+	if err := json.Unmarshal(raw, &svc); err != nil {
+		return nil, fmt.Errorf("decode service option: %w", err)
+	}
+	// Fall back to the service_type option when the envelope doesn't
+	// carry _svctype (older hosts).
+	if svc.Type == "" {
+		if st, ok := sdk.GetOption[string](opts, "service_type"); ok {
+			svc.Type = st
+		}
+	}
+	return &svc, nil
+}
+
+func kindForServiceType(t string) string {
+	switch t {
+	case ServiceOpenPGP:
+		return KindOpenPGPKey
+	case ServiceSMimeCert:
+		return KindSMIMEA
+	default:
+		return ""
+	}
+}
+
+// ownerHashHex returns the RFC 7929 / 8162 label: hex(sha256(localpart)[:28]).
+func ownerHashHex(username string) string {
+	sum := sha256.Sum256([]byte(username))
+	return hex.EncodeToString(sum[:DANEOwnerHashSize])
+}
+
+// computeOwner derives the expected FQDN from the service body. It
+// returns the expected-by-specification owner and, when the service
+// body carries its own Hdr.Name, the recorded owner, so we can detect
+// discrepancies between the two.
+func computeOwner(body serviceBody, prefix, parent string) (expected, recorded string) {
+	if body.Username != "" {
+		expected = dns.Fqdn(ownerHashHex(body.Username) + "." + strings.TrimPrefix(prefix, "") + "." + strings.TrimSuffix(parent, "."))
+		// Normalise: no double dots.
+		expected = strings.Replace(expected, "..", ".", -1)
+	}
+	switch {
+	case body.OpenPGP != nil && body.OpenPGP.Hdr.Name != "":
+		recorded = dns.Fqdn(body.OpenPGP.Hdr.Name)
+	case body.SMIMEA != nil && body.SMIMEA.Hdr.Name != "":
+		recorded = dns.Fqdn(body.SMIMEA.Hdr.Name)
+	}
+	return
+}
+
+// extractOwnerPrefix pulls the leading label from an owner name of the
+// form <hash>._openpgpkey.<...> (or _smimecert), returning the hash
+// portion only. Returns "" when the owner does not follow that shape.
+func extractOwnerPrefix(owner, prefix, parent string) string {
+	owner = strings.TrimSuffix(strings.ToLower(owner), ".")
+	// Look for ".<prefix>." just after the first label.
+	marker := "." + prefix + "."
+	if i := strings.Index(owner, marker); i > 0 {
+		return owner[:i]
+	}
+	return ""
+}
+
+// anyOpenPGPMatches reports whether any of rrs carries the same public
+// key bytes as ref.
+func anyOpenPGPMatches(rrs []dns.RR, ref *dns.OPENPGPKEY) bool {
+	want := strings.TrimSpace(ref.PublicKey)
+	for _, rr := range rrs {
+		if r, ok := rr.(*dns.OPENPGPKEY); ok && strings.TrimSpace(r.PublicKey) == want {
+			return true
+		}
+	}
+	return false
+}
+
+// anySMIMEAMatches reports whether any of rrs matches ref on (usage,
+// selector, matching type, certificate bytes).
+func anySMIMEAMatches(rrs []dns.RR, ref *dns.SMIMEA) bool {
+	want := strings.ToLower(strings.TrimSpace(ref.Certificate))
+	for _, rr := range rrs {
+		r, ok := rr.(*dns.SMIMEA)
+		if !ok {
+			continue
+		}
+		if r.Usage == ref.Usage && r.Selector == ref.Selector && r.MatchingType == ref.MatchingType &&
+			strings.ToLower(strings.TrimSpace(r.Certificate)) == want {
+			return true
+		}
+	}
+	return false
+}
+
+// ── OpenPGP analysis ─────────────────────────────────────────────────────────
+
+// analyzeOpenPGP parses the OpenPGP key from the service record and
+// emits findings. It returns the summary and the (possibly extended)
+// findings list.
+func analyzeOpenPGP(body serviceBody, findings []Finding, expiryWarn time.Duration) (*OpenPGPInfo, []Finding) {
+	if body.OpenPGP == nil {
+		findings = append(findings, Finding{
+			Code:     CodePGPParseError,
+			Severity: SeverityCrit,
+			Message:  "Service body has no OPENPGPKEY record.",
+			Fix:      "Attach a valid OPENPGPKEY record to the service.",
+		})
+		return nil, findings
+	}
+
+	raw, err := base64.StdEncoding.DecodeString(body.OpenPGP.PublicKey)
+	if err != nil {
+		findings = append(findings, Finding{
+			Code:     CodePGPParseError,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("OPENPGPKEY record carries invalid base64: %v", err),
+			Fix:      "Re-export the public key as a binary OpenPGP packet stream (no ASCII armor) and base64 it exactly as stored in the RDATA.",
+		})
+		return nil, findings
+	}
+
+	info := &OpenPGPInfo{RawSize: len(raw)}
+
+	// Large records get fragmented over UDP and force TCP re-queries.
+	// RFC 7929 is silent on the exact threshold; >1200 bytes is a
+	// reasonable "will not fit in a typical UDP answer" line.
+	if len(raw) > 4096 {
+		findings = append(findings, Finding{
+			Code:     CodePGPRecordTooLarge,
+			Severity: SeverityWarn,
+			Message:  fmt.Sprintf("The OpenPGP key packet is %d bytes. Large records force every resolver to fall back to TCP, slowing down the DANE lookup.", len(raw)),
+			Fix:      "Publish only the minimum key material needed for email encryption (primary + encryption subkey) and strip image UIDs / extra attributes before export.",
+		})
+	}
+
+	entities, err := openpgp.ReadKeyRing(bytes.NewReader(raw))
+	if err != nil || len(entities) == 0 {
+		// Fallback: try parsing as a single packet stream; some
+		// implementations omit markers between entities.
+		if err == nil {
+			err = fmt.Errorf("no OpenPGP entity found")
+		}
+		findings = append(findings, Finding{
+			Code:     CodePGPParseError,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Cannot parse OpenPGP key: %v", err),
+			Fix:      "Regenerate the key with `gpg --export <fpr> | base64` and paste the result; do not armor the key.",
+		})
+		return info, findings
+	}
+
+	info.EntityCount = len(entities)
+	if len(entities) > 1 {
+		findings = append(findings, Finding{
+			Code:     CodePGPMultipleEntities,
+			Severity: SeverityWarn,
+			Message:  fmt.Sprintf("The record contains %d OpenPGP entities; RFC 7929 recommends a single entity per OPENPGPKEY record.", len(entities)),
+			Fix:      "Split each user's key into its own OPENPGPKEY RR.",
+		})
+	}
+
+	ent := entities[0]
+	pub := ent.PrimaryKey
+	info.CreatedAt = pub.CreationTime
+	info.Fingerprint = strings.ToUpper(hex.EncodeToString(pub.Fingerprint))
+	info.KeyID = fmt.Sprintf("%016X", pub.KeyId)
+	info.PrimaryAlgorithm = algorithmName(pub)
+	info.PrimaryBits = publicKeyBits(pub)
+
+	// Identity UIDs.
+	for name := range ent.Identities {
+		info.UIDs = append(info.UIDs, name)
+	}
+
+	// Revocations on the primary key.
+	if len(ent.Revocations) > 0 {
+		info.Revoked = true
+		findings = append(findings, Finding{
+			Code:     CodePGPRevoked,
+			Severity: SeverityCrit,
+			Message:  "The OpenPGP primary key carries a revocation signature. Consumers will refuse to encrypt to it.",
+			Fix:      "Publish a fresh, non-revoked key at this name, or withdraw the OPENPGPKEY record entirely.",
+		})
+	}
+
+	// Expiry on the primary key, derived from the self-signature.
+	now := time.Now()
+	if selfSig, _ := ent.PrimarySelfSignature(); selfSig != nil {
+		if selfSig.KeyLifetimeSecs != nil && *selfSig.KeyLifetimeSecs > 0 {
+			exp := pub.CreationTime.Add(time.Duration(*selfSig.KeyLifetimeSecs) * time.Second)
+			info.ExpiresAt = exp
+			if exp.Before(now) {
+				findings = append(findings, Finding{
+					Code:     CodePGPExpired,
+					Severity: SeverityCrit,
+					Message:  fmt.Sprintf("The OpenPGP primary key expired on %s.", exp.Format(time.RFC3339)),
+					Fix:      "Extend the key's expiry (`gpg --edit-key <fpr>` → `expire`) or issue a new key and republish the OPENPGPKEY record.",
+				})
+			} else if expiryWarn > 0 && exp.Sub(now) < expiryWarn {
+				findings = append(findings, Finding{
+					Code:     CodePGPExpiringSoon,
+					Severity: SeverityWarn,
+					Message:  fmt.Sprintf("The OpenPGP primary key expires on %s.", exp.Format(time.RFC3339)),
+					Fix:      "Extend the key's expiry before it lapses, then re-export and republish.",
+				})
+			}
+		}
+	}
+
+	// Identity presence and UID vs username matching.
+	if len(ent.Identities) == 0 {
+		findings = append(findings, Finding{
+			Code:     CodePGPNoIdentity,
+			Severity: SeverityWarn,
+			Message:  "The OpenPGP key has no self-signed User ID. Most clients require at least one identity to bind the key to an email address.",
+			Fix:      "Add a UID containing the user's email (e.g. `gpg --edit-key <fpr>` → `adduid`) and re-export.",
+		})
+	} else if body.Username != "" {
+		wantedLocal := strings.ToLower(body.Username)
+		matched := false
+		for name := range ent.Identities {
+			if strings.Contains(strings.ToLower(name), "<"+wantedLocal+"@") ||
+				strings.Contains(strings.ToLower(name), wantedLocal+"@") {
+				matched = true
+				break
+			}
+		}
+		if !matched {
+			findings = append(findings, Finding{
+				Code:     CodePGPUIDMismatch,
+				Severity: SeverityInfo,
+				Message:  fmt.Sprintf("None of the OpenPGP UIDs reference <%s@…>.", body.Username),
+				Fix:      "Add a UID bound to the email address that the record attests to.",
+			})
+		}
+	}
+
+	// Primary key algorithm + size checks.
+	if warn := pgpAlgorithmWarning(pub); warn != nil {
+		findings = append(findings, *warn)
+	}
+
+	// Subkeys + encryption capability.
+	for _, sk := range ent.Subkeys {
+		si := SubkeyInfo{
+			Algorithm: algorithmName(sk.PublicKey),
+			Bits:      publicKeyBits(sk.PublicKey),
+			CreatedAt: sk.PublicKey.CreationTime,
+			Revoked:   len(sk.Revocations) > 0,
+		}
+		if sk.Sig != nil {
+			if sk.Sig.FlagsValid {
+				si.CanSign = sk.Sig.FlagSign
+				si.CanEncrypt = sk.Sig.FlagEncryptCommunications || sk.Sig.FlagEncryptStorage
+				si.CanAuth = sk.Sig.FlagAuthenticate
+			}
+			if sk.Sig.KeyLifetimeSecs != nil && *sk.Sig.KeyLifetimeSecs > 0 {
+				si.ExpiresAt = sk.PublicKey.CreationTime.Add(time.Duration(*sk.Sig.KeyLifetimeSecs) * time.Second)
+			}
+		}
+		info.Subkeys = append(info.Subkeys, si)
+
+		if si.CanEncrypt && !si.Revoked && (si.ExpiresAt.IsZero() || si.ExpiresAt.After(now)) {
+			info.HasEncryptionCapability = true
+		}
+		if warn := pgpAlgorithmWarning(sk.PublicKey); warn != nil {
+			findings = append(findings, *warn)
+		}
+	}
+	// Primary can also be an encryption key if flagged so.
+	if selfSig, _ := ent.PrimarySelfSignature(); selfSig != nil && selfSig.FlagsValid &&
+		(selfSig.FlagEncryptCommunications || selfSig.FlagEncryptStorage) &&
+		!info.Revoked && (info.ExpiresAt.IsZero() || info.ExpiresAt.After(now)) {
+		info.HasEncryptionCapability = true
+	}
+	if !info.HasEncryptionCapability {
+		findings = append(findings, Finding{
+			Code:     CodePGPNoEncryption,
+			Severity: SeverityCrit,
+			Message:  "No active (non-revoked, non-expired) key in the entity advertises encryption capability. The record is useless for email encryption.",
+			Fix:      "Generate an encryption subkey (`gpg --edit-key <fpr>` → `addkey`) and re-export.",
+		})
+	}
+
+	return info, findings
+}
+
+func algorithmName(pub *packet.PublicKey) string {
+	switch pub.PubKeyAlgo {
+	case packet.PubKeyAlgoRSA, packet.PubKeyAlgoRSAEncryptOnly, packet.PubKeyAlgoRSASignOnly:
+		return "RSA"
+	case packet.PubKeyAlgoDSA:
+		return "DSA"
+	case packet.PubKeyAlgoElGamal:
+		return "ElGamal"
+	case packet.PubKeyAlgoECDH:
+		return "ECDH"
+	case packet.PubKeyAlgoECDSA:
+		return "ECDSA"
+	case packet.PubKeyAlgoEdDSA:
+		return "EdDSA"
+	case packet.PubKeyAlgoX25519:
+		return "X25519"
+	case packet.PubKeyAlgoX448:
+		return "X448"
+	case packet.PubKeyAlgoEd25519:
+		return "Ed25519"
+	case packet.PubKeyAlgoEd448:
+		return "Ed448"
+	default:
+		return fmt.Sprintf("algo-%d", pub.PubKeyAlgo)
+	}
+}
+
+func publicKeyBits(pub *packet.PublicKey) int {
+	if pub == nil {
+		return 0
+	}
+	switch k := pub.PublicKey.(type) {
+	case *rsa.PublicKey:
+		if k == nil || k.N == nil {
+			return 0
+		}
+		return k.N.BitLen()
+	case *dsa.PublicKey:
+		if k == nil || k.P == nil {
+			return 0
+		}
+		return k.P.BitLen()
+	case *ecdsa.PublicKey:
+		if k == nil || k.Params() == nil {
+			return 0
+		}
+		return k.Params().BitSize
+	case ed25519.PublicKey:
+		return 256
+	}
+	// Fallback to the packet's advertised length.
+	if n, err := pub.BitLength(); err == nil {
+		return int(n)
+	}
+	return 0
+}
+
+func pgpAlgorithmWarning(pub *packet.PublicKey) *Finding {
+	switch pub.PubKeyAlgo {
+	case packet.PubKeyAlgoRSA, packet.PubKeyAlgoRSAEncryptOnly, packet.PubKeyAlgoRSASignOnly:
+		bits := publicKeyBits(pub)
+		if bits == 0 {
+			return nil
+		}
+		if bits < 2048 {
+			return &Finding{
+				Code:     CodePGPWeakKeySize,
+				Severity: SeverityCrit,
+				Message:  fmt.Sprintf("RSA key of %d bits is considered broken. NIST SP 800-131A deprecates anything below 2048 bits.", bits),
+				Fix:      "Generate a fresh RSA-3072/4096 or Ed25519/Curve25519 key and republish.",
+			}
+		}
+		if bits < 3072 {
+			return &Finding{
+				Code:     CodePGPWeakKeySize,
+				Severity: SeverityWarn,
+				Message:  fmt.Sprintf("RSA-%d is aging; NIST recommends at least 3072 bits for new deployments.", bits),
+				Fix:      "Plan a migration to RSA-3072/4096 or Ed25519/Curve25519 at the next key rotation.",
+			}
+		}
+	case packet.PubKeyAlgoDSA, packet.PubKeyAlgoElGamal:
+		return &Finding{
+			Code:     CodePGPWeakAlgorithm,
+			Severity: SeverityWarn,
+			Message:  fmt.Sprintf("Primary/subkey uses %s, which modern OpenPGP stacks are phasing out.", algorithmName(pub)),
+			Fix:      "Migrate to RSA-3072+, ECDSA, or Ed25519/Curve25519.",
+		}
+	}
+	return nil
+}
+
+// ── SMIMEA analysis ──────────────────────────────────────────────────────────
+
+// analyzeSMIMEA parses the SMIMEA certificate, computes a structured
+// summary, and emits findings.
+func analyzeSMIMEA(body serviceBody, findings []Finding, expiryWarn time.Duration, requireEmailProtection bool) (*SMIMEAInfo, []Finding) {
+	if body.SMIMEA == nil {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertParseError,
+			Severity: SeverityCrit,
+			Message:  "Service body has no SMIMEA record.",
+			Fix:      "Attach a valid SMIMEA record to the service.",
+		})
+		return nil, findings
+	}
+	rec := body.SMIMEA
+
+	info := &SMIMEAInfo{
+		Usage:        rec.Usage,
+		Selector:     rec.Selector,
+		MatchingType: rec.MatchingType,
+		HashHex:      strings.ToLower(rec.Certificate),
+	}
+
+	// Usage (RFC 6698 + 8162): 0 PKIX-TA, 1 PKIX-EE, 2 DANE-TA, 3 DANE-EE.
+	if rec.Usage > 3 {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEABadUsage,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Unknown SMIMEA usage %d (expected 0 PKIX-TA, 1 PKIX-EE, 2 DANE-TA, 3 DANE-EE).", rec.Usage),
+			Fix:      "Use usage 3 (DANE-EE) for self-hosted S/MIME certificates.",
+		})
+	}
+	if rec.Selector > 1 {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEABadSelector,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Unknown SMIMEA selector %d (expected 0 Cert or 1 SPKI).", rec.Selector),
+			Fix:      "Use selector 0 to publish the full certificate.",
+		})
+	}
+	if rec.MatchingType > 2 {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEABadMatchType,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Unknown SMIMEA matching type %d (expected 0 Full, 1 SHA-256, 2 SHA-512).", rec.MatchingType),
+			Fix:      "Use matching type 0 so the whole certificate is transported, or type 1 (SHA-256) for a digest.",
+		})
+	}
+
+	// Matching types 1 and 2 only carry a digest; no certificate to
+	// parse. Surface that as info so the user knows the checker's
+	// findings are limited.
+	if rec.MatchingType != 0 {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEAHashOnly,
+			Severity: SeverityInfo,
+			Message:  "Record carries only a digest; the certificate itself cannot be verified by this checker.",
+			Fix:      "Switch to matching type 0 (Full) to let verifiers inspect and pin the certificate.",
+		})
+		return info, findings
+	}
+
+	der, err := hex.DecodeString(rec.Certificate)
+	if err != nil || len(der) == 0 {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertParseError,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Cannot decode certificate bytes: %v", err),
+			Fix:      "Re-export the certificate as DER and hex-encode it into the SMIMEA RDATA.",
+		})
+		return info, findings
+	}
+
+	// Selector 1 carries only a SubjectPublicKeyInfo; parse it that way.
+	if rec.Selector == 1 {
+		info.PublicKey = analyzeSPKI(der, &findings)
+		return info, findings
+	}
+
+	cert, err := x509.ParseCertificate(der)
+	if err != nil {
+		// Try a PEM fallback for robustness.
+		if block, _ := pem.Decode(der); block != nil && block.Type == "CERTIFICATE" {
+			cert, err = x509.ParseCertificate(block.Bytes)
+		}
+	}
+	if err != nil || cert == nil {
+		if err == nil {
+			err = fmt.Errorf("no certificate found")
+		}
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertParseError,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Cannot parse X.509 certificate: %v", err),
+			Fix:      "Ensure the certificate is DER-encoded (not PEM) before hex-encoding it into SMIMEA RDATA.",
+		})
+		return info, findings
+	}
+
+	ci := &CertInfo{
+		Subject:            cert.Subject.String(),
+		Issuer:             cert.Issuer.String(),
+		SerialHex:          strings.ToUpper(hex.EncodeToString(cert.SerialNumber.Bytes())),
+		NotBefore:          cert.NotBefore,
+		NotAfter:           cert.NotAfter,
+		SignatureAlgorithm: cert.SignatureAlgorithm.String(),
+		PublicKeyAlgorithm: cert.PublicKeyAlgorithm.String(),
+		EmailAddresses:     cert.EmailAddresses,
+		DNSNames:           cert.DNSNames,
+		IsCA:               cert.IsCA,
+	}
+	ci.IsSelfSigned = cert.Subject.String() == cert.Issuer.String() && cert.CheckSignatureFrom(cert) == nil
+	ci.PublicKeyBits = x509PublicKeyBits(cert.PublicKey)
+
+	for _, eku := range cert.ExtKeyUsage {
+		if eku == x509.ExtKeyUsageEmailProtection {
+			ci.HasEmailProtectionEKU = true
+		}
+	}
+	if cert.KeyUsage&x509.KeyUsageDigitalSignature != 0 {
+		ci.HasDigitalSignature = true
+	}
+	if cert.KeyUsage&x509.KeyUsageKeyEncipherment != 0 {
+		ci.HasKeyEncipherment = true
+	}
+
+	info.Certificate = ci
+
+	now := time.Now()
+	if now.Before(cert.NotBefore) {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertNotYetValid,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Certificate is not yet valid (NotBefore = %s).", cert.NotBefore.Format(time.RFC3339)),
+			Fix:      "Check the system clock on the CA/signer, or wait until the certificate's notBefore date.",
+		})
+	}
+	if now.After(cert.NotAfter) {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertExpired,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Certificate expired on %s.", cert.NotAfter.Format(time.RFC3339)),
+			Fix:      "Issue a fresh certificate and republish the SMIMEA record.",
+		})
+	} else if expiryWarn > 0 && cert.NotAfter.Sub(now) < expiryWarn {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEACertExpiringSoon,
+			Severity: SeverityWarn,
+			Message:  fmt.Sprintf("Certificate expires on %s.", cert.NotAfter.Format(time.RFC3339)),
+			Fix:      "Renew before expiry and update the SMIMEA record with the new certificate.",
+		})
+	}
+
+	if !ci.HasEmailProtectionEKU {
+		sev := SeverityWarn
+		if requireEmailProtection {
+			sev = SeverityCrit
+		}
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEANoEmailProtection,
+			Severity: sev,
+			Message:  "Certificate lacks the emailProtection Extended Key Usage; RFC 8550/8551 agents will refuse it.",
+			Fix:      "Re-issue the certificate with `extendedKeyUsage = emailProtection` (OID 1.3.6.1.5.5.7.3.4).",
+		})
+	}
+	if !ci.HasDigitalSignature && !ci.HasKeyEncipherment {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEANoKeyUsage,
+			Severity: SeverityWarn,
+			Message:  "Certificate has neither digitalSignature nor keyEncipherment key usage; S/MIME signing or encryption will be refused.",
+			Fix:      "Add `keyUsage = digitalSignature, keyEncipherment` to the certificate profile.",
+		})
+	}
+
+	// Weak signature algorithms (MD5/SHA-1 based signatures).
+	switch cert.SignatureAlgorithm {
+	case x509.MD2WithRSA, x509.MD5WithRSA, x509.SHA1WithRSA,
+		x509.DSAWithSHA1, x509.ECDSAWithSHA1:
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEAWeakSignatureAlg,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Certificate is signed with %s, a deprecated algorithm.", cert.SignatureAlgorithm),
+			Fix:      "Re-issue the certificate with SHA-256 (or better) signatures.",
+		})
+	}
+
+	// Weak key sizes.
+	if _, isRSA := cert.PublicKey.(*rsa.PublicKey); isRSA && ci.PublicKeyBits > 0 {
+		if ci.PublicKeyBits < 2048 {
+			findings = append(findings, Finding{
+				Code:     CodeSMIMEAWeakKeySize,
+				Severity: SeverityCrit,
+				Message:  fmt.Sprintf("RSA key is %d bits (below the 2048-bit minimum).", ci.PublicKeyBits),
+				Fix:      "Re-issue the certificate with an RSA-3072 or ECDSA-P256 key.",
+			})
+		} else if ci.PublicKeyBits < 3072 {
+			findings = append(findings, Finding{
+				Code:     CodeSMIMEAWeakKeySize,
+				Severity: SeverityWarn,
+				Message:  fmt.Sprintf("RSA key is %d bits; prefer 3072+ for new deployments.", ci.PublicKeyBits),
+				Fix:      "Plan a rotation to RSA-3072+ or ECDSA at the next certificate renewal.",
+			})
+		}
+	}
+
+	// Self-signed certificate flagged for EE usages. For TA usages (0/2)
+	// self-signed is expected.
+	if ci.IsSelfSigned && (rec.Usage == 1 || rec.Usage == 3) {
+		findings = append(findings, Finding{
+			Code:     CodeSMIMEASelfSigned,
+			Severity: SeverityInfo,
+			Message:  "End-entity usage advertises a self-signed certificate; DANE-EE (usage 3) makes this safe, but PKIX-EE (usage 1) consumers will reject it.",
+			Fix:      "Switch the record to usage 3 (DANE-EE) if you operate your own CA, or chain the certificate under a public CA for usage 1.",
+		})
+	}
+
+	// Email-address / username pairing.
+	if body.Username != "" {
+		wantPrefix := strings.ToLower(body.Username) + "@"
+		matched := false
+		for _, e := range cert.EmailAddresses {
+			if strings.HasPrefix(strings.ToLower(e), wantPrefix) {
+				matched = true
+				break
+			}
+		}
+		if !matched && len(cert.EmailAddresses) > 0 {
+			findings = append(findings, Finding{
+				Code:     CodeSMIMEAEmailMismatch,
+				Severity: SeverityInfo,
+				Message:  fmt.Sprintf("None of the certificate's email SANs (%s) begin with %s; clients that strictly match SAN to envelope address will reject it.", strings.Join(cert.EmailAddresses, ", "), body.Username+"@"),
+				Fix:      "Re-issue the certificate with the correct `subjectAltName = email:<user>@<domain>`.",
+			})
+		}
+	}
+
+	return info, findings
+}
+
+func analyzeSPKI(der []byte, findings *[]Finding) *PubKeyInfo {
+	pub, err := x509.ParsePKIXPublicKey(der)
+	if err != nil {
+		*findings = append(*findings, Finding{
+			Code:     CodeSMIMEACertParseError,
+			Severity: SeverityCrit,
+			Message:  fmt.Sprintf("Cannot parse SubjectPublicKeyInfo: %v", err),
+			Fix:      "Ensure the SMIMEA selector=1 record carries a DER-encoded SPKI (not a full certificate).",
+		})
+		return nil
+	}
+	info := &PubKeyInfo{Bits: x509PublicKeyBits(pub)}
+	switch pub.(type) {
+	case *rsa.PublicKey:
+		info.Algorithm = "RSA"
+	case *ecdsa.PublicKey:
+		info.Algorithm = "ECDSA"
+	case ed25519.PublicKey:
+		info.Algorithm = "Ed25519"
+	default:
+		info.Algorithm = fmt.Sprintf("%T", pub)
+	}
+	return info
+}
+
+func x509PublicKeyBits(pub any) int {
+	switch k := pub.(type) {
+	case *rsa.PublicKey:
+		if k == nil || k.N == nil {
+			return 0
+		}
+		return k.N.BitLen()
+	case *ecdsa.PublicKey:
+		if k == nil || k.Params() == nil {
+			return 0
+		}
+		return k.Params().BitSize
+	case ed25519.PublicKey:
+		return 256
+	}
+	return 0
+}
+
+func firstNonEmpty(vals ...string) string {
+	for _, v := range vals {
+		if strings.TrimSpace(v) != "" {
+			return v
+		}
+	}
+	return ""
+}