MAIL2FAB — Email Security Fabric (Module Map)
Audience: operators, auditors, contributors.
Purpose: the release archive is named YAS_MAIL2FAB.tar.gz but there is no
single mail2fab file — this document is the canonical map of where the
"MAIL → FABRIC" capability lives.
What MAIL2FAB means
MAIL2FAB = "mail to fabric" — the tool suite that converts raw mail infrastructure signals (DNS records, TLS handshakes, policy documents) into an actionable, validated fabric of email-security posture data. It is implemented as part of the public Tools API, not as a standalone service.
Where the logic lives
| Component | File | Responsibility |
|---|---|---|
| Bounded network resolvers | lib/dns-tools.ts |
DNS (A/AAAA/MX/TXT/NS/CAA…), TLS handshake probing, MTA-STS/TLS-RPT and DANE/TLSA fetch — all with timeouts and size caps |
| Tool runners (network) | lib/tool-runners-network.ts |
spf-inspector, dkim-inspector, dmarc-inspector, mx-health, mta-sts-tlsrpt, dane-tlsa, tls-analyzer, dns-lookup, what-is-my-ip |
| SSRF safety | lib/url-safety.ts |
assertSafeOutboundHost — resolves A/AAAA and rejects loopback/RFC1918/link-local/CGNAT/metadata (169.254.169.254), .local/.internal hostnames, IPv4 integer/hex/octal literal tricks, blocked service ports; guards against DNS-rebinding by pinned resolution |
| Public API surface | app/api/v1/tools/[slug]/route.ts |
POST/GET execution, 64 KiB input cap, generic errors, 60 req/min/IP |
| Tool pages | app/tools/[slug]/page.tsx + lib/tools-def.ts |
UI shells, SEO metadata, client-only tool sentinels |
Security posture (as audited)
- No shell execution anywhere in the fabric: only
net.connect,tls.connect,dns/promises— command injection is structurally impossible. - Timeouts: 3–6 s per probe; overall request bounded — resource-exhaustion resistant.
- Rate limited: 60 req/min per IP at the route layer; in-memory buckets are size-capped (50 k) with 60 s sweeps.
- Fail-closed inputs: invalid hosts/ports return
InputError400 with a generic message; internals are logged server-side only (RFC 9457 problem documents).
Extending the fabric
pnpm new:tool scaffolds a runner + page + definition. Network-capable tools
MUST route outbound calls through assertSafeOutboundHost (lib/url-safety.ts)
— direct fetch/net.connect to user-supplied hosts is rejected in review.
Added in v3.2.8 during the STATUS_ASSESSMENT remediation (finding L-06).