Detect Google Workspace via `google._domainkey` TXT (DKIM) behind gateways — pending upstream validation

[fpietrosanti]

Follow-up to #14 (gateway look-through). While censusing unmapped gateways (scripts/find_gateway_candidates.py) we found a Microsoft/Google detection asymmetry in the inherited classification logic.

Finding

Our DKIM lookup (dns.lookup_dkim) follows CNAMEs only (selectors selector1, selector2, google):

# src/mail_sovereignty/dns.py
chain = await lookup_cname_chain(f"{selector}._domainkey.{domain}", max_hops=1)

• Microsoft: selector1._domainkey is a CNAME → *.onmicrosoft.com → detected. Plus the getuserrealm tenant check (lookup_tenant).
• Google: google._domainkey is a TXT key (v=DKIM1; k=rsa; p=…), not a CNAME → not read. There is no Google equivalent of the getuserrealm tenant check.

The same limitation exists upstream in davidhuser/mxmap (probes.probe_dkim is CNAME-only) — reported and pending validation there: davidhuser/mxmap-ch#28.

Effect

Google-behind-gateway entities fall to independent/local-isp despite include:_spf.google.com and a google._domainkey TXT key. Example: the Sardinian regional health agencies (ASL) behind the sardegnasalute.it antispam relay — 11 entities → Google Workspace, currently classified independent (e.g. aslnuoro.it, aslgallura.it both have google._domainkey TXT). Also halleysardegna.it, ouverture.it.

Plan (ON HOLD pending upstream feedback)

1. Add a google._domainkey TXT check (query the selector as TXT; a v=DKIM1 key → Google), closing the asymmetry — mirrored to whatever the upstream agrees on.
2. Then add the Google gateway keywords: sardegnasalute.it, halleysardegna.it, ouverture.it.
3. Re-run the pipeline + verify the affected entities flip to Google; quantify the CLOUD-Act/ISD impact.

Do not implement until davidhuser/mxmap-ch#28 is validated. We want to keep parity with upstream rather than diverge.

cc #14

[fpietrosanti]

✅ Implementato downstream (commit 8415b732). lookup_dkim ora controlla anche il TXT google._domainkey (Google Workspace pubblica DKIM come TXT v=DKIM1, non CNAME) → classify_from_dkim lo mappa a Google.

Validazione su dati reali (DoH):

• Recall sui 6405 google IT confermati: 16,5% pubblicano il TXT (DKIM è opzionale in Workspace).
• Precision: falsi positivi 0,67% su campione di 600 microsoft → alta.

Segnale additivo/corroborante ad alta precisione: utile soprattutto per Google-dietro-gateway; MX diretto e DKIM-Microsoft mantengono la precedenza, quindi i pochi falsi positivi non mordono. Upstream davidhuser/mxmap-ch#28 resta aperto come riferimento.

[fpietrosanti]

Upstream aggiornato: il vecchio davidhuser/mxmap-ch#28 è stato chiuso dal maintainer con invito a rifilarlo sul successore. Rifilato come PR con fix incluso (issue disabilitate lì): mxmap/secassure2026#34 — patch nel loro idioma (probe_dkim TXT-fallback gated su GOOGLE), 3 test aggiunti, 68/68 verdi, con i nostri numeri di validazione (recall 16,5%, FP 0,67%).