mta sts policy audit derived

{
  "input": {
    "body": {
      "domain": "example.test",
      "policy": "version: STSv1\nmode: testing\nmx: *.vendor.test\nmax_age: 3600",
      "mx_hosts": [
        "mx1.vendor.test",
        "mx2.vendor.test",
        "backup-mx.other-vendor.test"
      ],
      "dns_record": "v=STSv1;"
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "mode": "testing",
      "valid": false,
      "domain": "example.test",
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "complete": true,
      "findings": [
        {
          "tag": "id",
          "code": "DNS_ID_ABSENT",
          "detail": "The DNS record declares no id. The id is how a receiver notices the policy changed, so without one a cached policy is never refreshed."
        },
        {
          "code": "MODE_IS_TESTING",
          "detail": "The policy is in testing mode, so a failure is reported and the message is delivered anyway. Nothing is enforced."
        },
        {
          "code": "MAX_AGE_VERY_SHORT",
          "detail": "The policy declares max_age of 3600 seconds, under a day. A short lifetime means a receiver that cannot fetch the policy stops honouring it almost immediately, which is the failure mode this protocol ..."
        }
      ],
      "request_id": "example-request",
      "service_id": "mta_sts_policy_audit",
      "assumptions": [
        "A wildcard mx pattern matches exactly one label, as the specification defines it, so *.example.test matches mx1.example.test and not a.mx1.example.test.",
        "A policy whose DNS record was not supplied is reported as not having been checked for discoverability, since a policy nobody can find is never applied.",
        "Testing and none mode are reported with their consequence rather than as defects, because both are documented postures and both mean nothing is enforced."
      ],
      "limitations": [
        "The policy and records supplied. Nothing is fetched, no certificate is validated, and whether a sending host honours the policy is outside this.",
        "valid is true only when the policy parsed, authorised every MX host supplied, and every check the caller asked for was performed."
      ],
      "mx_patterns": [
        "*.vendor.test"
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "finding_count": 4,
      "mx_host_count": 3,
      "max_age_seconds": 3600,
      "service_version": "1.0.0",
      "findings_by_code": {
        "DNS_ID_ABSENT": 1,
        "MODE_IS_TESTING": 1,
        "MAX_AGE_VERY_SHORT": 1,
        "MX_HOST_NOT_AUTHORISED": 1
      },
      "mx_pattern_count": 1
    }
  }
}