DNS False Negatives

[adhilto]

🐛 Summary

If ScubaGoggles is unable to make DNS queries at all (e.g., due to network issues), the report will display passes for all SPF, DKIM, and DMARC checks.

To reproduce

Easiest way to reproduce this is to hard-code an error at the top of the query function within the RobustDNSClient so that the DNS calls don't work.

Expected behavior

You'd expect the report to display failures.

Any helpful log output or screenshots

The fix is super easy. Within Gmail.rego, change

AllDomains contains Domain.domain if {
    some Domain in input.dkim_records
}

to

AllDomains := {Domain | some Domain in input.domains}

Note that you'll also need to update the rego unit tests.

[adhilto]

Blocked by #146.