Every audit so far had scoped itself to “everything changed since the last one.” This one reviews the DNS Only role end to end regardless of when each piece landed: role gating, the sync channel in both directions, the linking and trust flow, and the DNS Only actions in the provisioning script. Each finding was independently re-verified against the actual code before being trusted.
The real finding
A review of the sync channel found a place where information reported by a satellite was accepted without checking that it arrived over a fully verified connection. The fix ensures such information is only trusted when the connection is verified. The self-correction feature it supports works the same way as before for the common case.
What else turned up
Three smaller items, all defense in depth rather than live gaps:
- The account area had no explicit role check. No hosting account can exist on a DNS Only or Mail Only box, but we added the same explicit check every other role-sensitive area carries.
- One secret comparison was brought in line with the constant-time comparison used elsewhere.
- A generated secret written into DNS configuration now has a character-set check at the point it is first stored, as cheap insurance against its source changing.
Clean
Role gating, the zone-sync content path, the linking and trust primitives, and every DNS Only action in the provisioning script came back clean against this series’ established bug classes.
Verified
Full local suite (1,688 tests) and the code-style check green after every fix.