Reject invalid characters in domains

Domains in addresses had very lax validation, which allowed them to
include characters like "/".

That could be exploited to trigger a daemon panic: a MAIL FROM
"x@evil/foo" could be accepted and, on failed delivery, a DSN queued.
Attempting to deliver the DSN would cause an MTA-STS cache lookup, which
would panic because the domain includes a "/" and crash the server.
Because the DSN would be queued, the server would crash again on
restarts, and only self-recover after give_up_send_after (20h by
default).

To fix this, we now explicitly validate the domain when normalizing it,
make MTA-STS cache not panic on invalid domains, and also make the SMTP
courier fail permanently on invalid domains.

Thanks to John JEAN <john@wargan.com> for finding and reporting this
problem. The detailed report can be found in
https://johnjean.io/advisories/chasquid-unauthenticated-remote-dos/.

internal/courier/smtp_test.go

@@ -262,6 +262,33 @@ func TestSTSNoMXAllowed(t *testing.T) {
 	}
 }
 
+func TestDeliverInvalidDomain(t *testing.T) {
+	// Mimic what the real resolver returns for invalid domains, so delivery
+	// would fall back to A if we didn't check the domain.
+	testMXErr["a/b"] = &net.DNSError{
+		Err:        "no such host (test)",
+		IsNotFound: true,
+	}
+	t.Cleanup(func() { delete(testMXErr, "a/b") })
+
+	// Set up an STS cache, as that is one of the things that can't handle
+	// invalid domains.
+	stsCache, err := sts.NewCache(t.ArtifactDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	s := newSMTP(t)
+	s.STSCache = stsCache
+	err, permanent := s.Deliver("me@me", "to@a/b", []byte("data"))
+	if err == nil {
+		t.Errorf("expected error, got nil")
+	}
+	if !permanent {
+		t.Errorf("expected permanent failure, got transient")
+	}
+}
+
 func TestNoMXServer(t *testing.T) {
 	testMX["to"] = []*net.MX{}