Harden contract validation, STARTTLS edge cases, and rule output

main.go

@@ -10,11 +10,19 @@ import (
 
 var Version = "custom-build"
 
+// EHLOHostname is set via -ldflags to identify this checker instance in SMTP
+// EHLO greetings. Falls back to the package default ("checker.localhost") when
+// left empty.
+var EHLOHostname = ""
+
 var listenAddr = flag.String("listen", ":8080", "HTTP listen address")
 
 func main() {
 	flag.Parse()
 	tls.Version = Version
+	if EHLOHostname != "" {
+		tls.EHLOHostname = EHLOHostname
+	}
 
 	srv := server.New(tls.Provider())
 	if err := srv.ListenAndServe(*listenAddr); err != nil {