Repository navigation
fix(score): no score without a measurement - #72
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
When a DNS lookup got no answer (timeout, SERVFAIL) a check was marked "not verified" but still counted 0 points, so `check` printed "0/100 CRITICAL" and exited with 2 — what a script reads as a domain measured and found bad. Reported behind a company resolver for asufc.sanita.fvg.it, which scores 19 from outside. If any of DMARC, SPF, DKIM, BIMI, MTA-STS or TLS-RPT is not verified, the analysis now has no score: total_score is None and the grade N/A. `check` prints "Score: N/A — analysis incomplete, not verified: ..." and exits with 3, a new and documented code; `batch` lists the domain as N/A after the graded ones. DomainReport.unverified names the checks. A keyserver that does not answer still leaves a score, as `report` and `send` already treat it: it withholds at most the 5 GPG points. The _mock_checks helper now says its results are verified (error=""): a MagicMock's own `error` is truthy and read as an unanswered lookup. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
CodeQL read startswith("example.com") as a URL check on a substring
(py/incomplete-url-substring-sanitization). The row is now the one whose
first cell equals the domain, which is also what the test means.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
maksimtech
force-pushed
the
fix/no-score-without-measure
branch
from
October 28, 2026 17:54
628460c to
6955dac
Compare
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When a DNS lookup got no answer (timeout, SERVFAIL) a check was marked "not verified" but still counted 0 points, so
checkprinted0/100 CRITICALand exited with 2 — what a script reads as a domain measured and found bad. Reported behind a company resolver for asufc.sanita.fvg.it, which scores 19 from outside.checker.analyze_domain: if any of DMARC, SPF, DKIM, BIMI, MTA-STS or TLS-RPT is not verified,total_scoreisNoneand the gradeN/A.DomainReport.unverifiednames those checks.checkprintsScore: N/A — analysis incomplete, not verified: …and exits with 3 (new, in the README's exit-code table);batchlists the domain as N/A after the graded ones.reportandsendalready treat it: a keyserver that rate-limits withholds at most its 5 points and says so in its own issue.reportandsendalready refused an incomplete analysis; they are unchanged.TDD:
TestNoScoreWithoutMeasureintests/test_checker.pyandtests/test_cli.py(6 tests) on the DNS replay, where_dmarc.example.com TXTreally times out; red before the change. Full suite 678 passed, ruff and mypy clean; 6/6 hand mutants killed. The_mock_checkshelper now declareserror="": a MagicMock's ownerroris truthy and read as an unanswered lookup.Follow-up in apkradar after a release: its DPO letter reads this score, and with
Noneand a verified publisher domain it could reach "no issues found in the publisher's technical measures".🤖 Generated with Claude Code