Method verifyDane

app/src/main/java/eu/faircode/email/DnsHelper.java:372–420

(X509Certificate[] chain, String server, int port)

    }

    static void verifyDane(X509Certificate[] chain, String server, int port) throws CertificateException {
        if (!hasDnsSec())
            return;

        List<String> log = new ArrayList<>();

        Handler handler = new Handler() {
            @Override
            public void publish(LogRecord record) {
                log.add(record.getMessage());
                Log.w("DANE " + record.getMessage());
            }

            @Override
            public void flush() {
            }

            @Override
            public void close() throws SecurityException {
            }
        };

        String clazz = DaneVerifier.class.getName();
        try {
            Logger.getLogger(clazz).addHandler(handler);
            Log.w("DANE verify " + server + ":" + port);

            DnssecClient client = DnssecResolverApi.INSTANCE.getDnssecClient();

            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.Q)
                client.setDataSource(new AndroidDataSource());

            client.getDataSource().setTimeout(LOOKUP_TIMEOUT * 1000);

            client.setUseHardcodedDnsServers(false);

            boolean verified = new DaneVerifier(client).verifyCertificateChain(chain, server, port);
            Log.w("DANE verified=" + verified + " " + server + ":" + port);
            if (!verified)
                throw new CertificateException("DANE missing or invalid",
                        new CertificateException(TextUtils.join("\n", log)));
        } catch (CertificateException ex) {
            throw ex;
        } catch (Throwable ex) {
            throw new CertificateException("DANE error", ex);
        } finally {
            Logger.getLogger(clazz).removeHandler(handler);
        }
    }

    static List<String> getDnsServers(Context context) {
        SharedPreferences prefs = PreferenceManager.getDefaultSharedPreferences(context);