Harden tests for caa/dns/rdap/email_auth (mutation-testing findings)

[MSAdministrator]

Summary

Tests-only PR. A mutation-testing pass (mutmut) against main surfaced behavior that was executed but never asserted — often because tests mocked the very method under test. This adds 67 tests to close those gaps. No production code changes.

What was untested → now covered

dns.py

• is_ip_in_cidr had no test at all (IPv4/IPv6 in/out of range, invalid IP/CIDR, boundaries).
• Real TXT/SPF parsing (_parse_txt_record quote/whitespace handling) and get_report argument wiring were only exercised through mocks — added tests that run the real code paths.

caa.py

• _query_caa was fully mocked in every existing test, so its rdata decoding, flag/critical handling, and error paths never ran. Added tests driving the real method via fake dnspython rdata.
• Tree-climb query order + stop-at-first-match, strict result-dict shape, and the and→or (forbids_issuance) / continue→break (climb-past-error) logic branches.

rdap.py

• The raw ip/domain/autnum HTTP methods had no coverage — added tests asserting verb/URL/timeout.
• Strict parse_domain field assertions, the not-a-domain error guard, and _vcard_field edge cases (missing/short vcard, list vs scalar value).

email_auth.py

• The SPF-resolution helpers (_query, _resolve_addresses, _resolve_mx, _query_dkim_selector, _rdata_to_string) were entirely unexercised.
• Full-dict parser assertions for SPF/DKIM/DMARC/BIMI (every mechanism/tag form + defaults), and resolution-tree tests (node shape, a/mx/ptr/exists handling, loop guard, depth limit).

Why it matters

Several gaps were the "tests validate a mock, not the code" anti-pattern — the assertions passed regardless of whether the real function worked. These tests exercise the actual logic and lock in real contracts (e.g. CAA must keep climbing past a transient error; DNS must collect IPs from a later TXT record, not stop at the first).

Testing

• uv run pytest: 344 passed (was 277).
• uv run mypy src/domain_profiler: clean.
• The mutmut tooling/config was not committed — this is pytest-only.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens the test suite for DNS/CAA/RDAP/email-auth functionality based on mutation-testing findings, adding assertions that exercise real code paths rather than validating mocks.

Changes:

• Expanded RDAP tests to cover strict parsed-field shapes, HTTP method wiring, and error-guard branches.
• Added extensive SPF/DKIM/DMARC/BIMI parsing + SPF resolution-tree tests, including previously uncovered helper methods.
• Added DNS tests for is_ip_in_cidr, real TXT/SPF parsing behavior, and get_report argument wiring; expanded CAA tests to exercise real _query_caa parsing and climb behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/test_rdap.py	Adds strict RDAP parsing assertions, raw HTTP method contract tests, and vCard/error-guard edge cases.
tests/test_email_auth.py	Adds full-dict parser assertions and deep coverage for SPF/DKIM/DMARC/BIMI resolution helpers and tree behavior.
tests/test_dns.py	Adds coverage for CIDR checks, TXT/SPF parsing in get_dns_info, and get_report argument propagation.
tests/test_caa.py	Adds coverage for real _query_caa decoding/error cases and additional analyze() shape/tree-climb assertions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.