@blamejs/core 0.18.54 → 0.18.56

package/lib/mail-server-mx.js

@@ -157,8 +157,8 @@
 
 var net   = require("node:net");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var C         = require("./constants");
-var bCrypto   = require("./crypto");
 var numericBounds = require("./numeric-bounds");
 var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
@@ -322,17 +322,18 @@ function _stripForgedAuthResults(messageBuf, authservId) {
  *   greylist:          b.mail.greylist.create(…), // optional gate — defer first-seen (ip, from, rcpt)
  *   agent:             b.mail.agent,    // optional delivery handoff
  *   relayAllowedFor:   [{ cidr, scope }],  // operator-explicit relay allowlist; default [] = MX-only
- *   localDomains:      [string],        // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1)
+ *   localDomains:      [string]|fn,     // RCPT TO local-domain allowlist (refuse non-local with 550 5.7.1). A function returning the array is answered per RCPT, for a hosted set the operator changes while the server runs; an entry it returns that b.guardDomain refuses is dropped with an audit event rather than throwing on the connection that happened to arrive.
  *   recipientPolicy:   function (ctx) → { ok } | { ok: false, reason },  // optional RCPT-time mailbox check; refuses 550 5.1.1, defers 451 when it throws
  *   maxLineBytes:      number,          // default 1 KiB — per-command line cap
  *   maxMessageBytes:   number,          // default 50 MiB — DATA body cap
  *   maxRcptsPerMessage: number,         // default 100 — per RFC 5321 §4.5.3.1.8
  *   idleTimeoutMs:     number,          // default 5 minutes — RFC 5321 §4.5.3.2.7
+ *   maxConnections:    number,          // default 1024 — listener-wide ceiling
  *   profile:           "strict" | "balanced" | "permissive",  // gate posture cascade
  *   guardEnvelope:     true | {        // optional gate — DATA-phase SPF/DKIM/DMARC/ARC via b.mail.inbound.verify
  *     mode?:          "enforce" | "monitor",   // default: enforce (monitor when profile is permissive)
  *     onTemperror?:   "defer" | "accept",      // DNS temperror disposition; default "defer" (451 4.7.5)
- *     authservId?:    string,                  // RFC 8601 authserv-id; default localDomains[0]
+ *     authservId?:    string,                  // RFC 8601 authserv-id; defaults to the first local domain, re-read per message when localDomains is a function
  *     dnsLookup?:     function,                // async (qname, type) override for SPF/DKIM/DMARC lookups
  *     maxSignatures?: number,                  // DKIM verify cap (1-16)
  *     clockSkewMs?:   number,                  // DKIM timestamp skew tolerance
@@ -365,12 +366,22 @@ function create(opts) {
       "output directly. Cert provisioning lives in b.acme (RFC 8555 + RFC 9773 ARI).");
   }
   numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs"],
+    ["maxLineBytes", "maxMessageBytes", "maxRcptsPerMessage", "idleTimeoutMs", "maxConnections"],
     "mail.server.mx.", MailServerMxError, "mail-server-mx/bad-bound");
-  if (opts.localDomains !== undefined &&
-      (!Array.isArray(opts.localDomains) || opts.localDomains.length === 0)) {
+  // An EMPTY array is accepted and means "this server hosts no domains", which
+  // is a real state — a first boot before the first domain is added — and the
+  // only honest thing to do with it is refuse every recipient. Refusing it at
+  // construction left the operator with one spelling that started a server
+  // (omitting the option), and that spelling used to skip the relay check
+  // entirely, so the only way to get a listener was to get one that accepted
+  // everything. An allowlist that disappears when it is empty is a firewall
+  // rule set that opens when the last rule is deleted.
+  if (opts.localDomains !== undefined && !Array.isArray(opts.localDomains) &&
+      typeof opts.localDomains !== "function") {
     throw new MailServerMxError("mail-server-mx/bad-opts",
-      "mail.server.mx.create: localDomains must be a non-empty array if provided");
+      "mail.server.mx.create: localDomains must be an array of domain strings, or a " +
+      "function returning one when the hosted set changes while the server runs " +
+      "(an empty array means this server hosts no domains and refuses every recipient)");
   }
   if (opts.relayAllowedFor !== undefined && !Array.isArray(opts.relayAllowedFor)) {
     throw new MailServerMxError("mail-server-mx/bad-opts",
@@ -401,7 +412,22 @@ function create(opts) {
   var maxMessageBytes   = opts.maxMessageBytes   || DEFAULT_MAX_MESSAGE_BYTES;
   var maxRcptsPerMsg    = opts.maxRcptsPerMessage || DEFAULT_MAX_RCPTS_PER_MESSAGE;
   var idleTimeoutMs     = opts.idleTimeoutMs     || DEFAULT_IDLE_TIMEOUT_MS;
-  var localDomains      = (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
+  // The hosted-domain set is administrative state, not configuration: operators
+  // add and withdraw domains while the process runs, and that is an ordinary
+  // act rather than a reconfiguration. Captured once, a withdrawn domain kept
+  // drawing 250 at RCPT until a restart — with every management surface
+  // agreeing it was gone and nothing telling the operator mail was still
+  // arriving for it — while a newly added one drew 550 5.7.1, which a sending
+  // queue reads as "never retry" rather than "not yet".
+  //
+  // So it may be a function, answered per RCPT. The neighbouring
+  // recipientPolicy already is, which is what made the frozen half odd: the two
+  // parts of one question were answered a line apart with different currency.
+  // The array form is unchanged and still validated once at boot.
+  var localDomainsFn    = typeof opts.localDomains === "function" ? opts.localDomains : null;
+  var localDomains      = localDomainsFn
+    ? []
+    : (opts.localDomains || []).map(function (d) { return String(d).toLowerCase(); });
   var relayAllowedFor   = (opts.relayAllowedFor || []).map(function (__e) {
     return (__e && typeof __e === "object" && !Array.isArray(__e))
       ? Object.assign({}, __e, { cidr: _normalizeRelayCidr(__e.cidr) })
@@ -493,7 +519,10 @@ function create(opts) {
       // Authentication-Results header. Defaults to the first local
       // domain; with neither, the header is skipped (the verdict
       // still reaches the agent handoff).
-      authservId:    ge.authservId || localDomains[0] || null,
+      // A getter, so a listener whose hosted set is a function does not pin the
+      // authserv-id to whichever domain happened to be first at boot. Freezing
+      // the object prevents redefining this, not invoking it.
+      get authservId() { return ge.authservId || _resolveLocalDomains()[0] || null; },
       dnsLookup:     ge.dnsLookup || undefined,
       maxSignatures: ge.maxSignatures,
       clockSkewMs:   ge.clockSkewMs,
@@ -551,6 +580,165 @@ function create(opts) {
     }
   }
 
+  // Resolve the hosted set at the point it is needed.
+  //
+  // The array form was checked at boot and cannot change, so it is returned as
+  // is. The function form is checked when it is read, because a set that can
+  // change can acquire a bad entry after boot — an IDN homograph typed into an
+  // admin form is exactly the case the boot check exists for, and it would
+  // otherwise reach RCPT unexamined.
+  //
+  // A bad entry is DROPPED rather than thrown on. This is the request path: a
+  // throw here would take down the connection that happened to arrive, and the
+  // operator would see a mail outage rather than a typo. Dropping refuses mail
+  // for the entry that failed and keeps serving the domains that passed, which
+  // is what an allowlist with one bad line should do. Each distinct bad value
+  // is reported once so it does not become a per-recipient log flood.
+  //
+  // The cache key is the CONTENT of the returned set, never its identity. An
+  // operator holding one array and mutating it — push on add, splice on
+  // withdraw — hands back the same object every time, which is the most
+  // ordinary way to keep this state. Keyed on identity, that array would be
+  // normalized once and then frozen: added domains refused forever and
+  // withdrawn ones accepted forever, which is this very bug wearing a hat.
+  var _ldSeenKey = null;
+  var _ldSeenOut = [];
+  // Bounded, because its keys come from the operator's live set and a control
+  // plane that churns tenants — or an admin form collecting typos — would
+  // otherwise grow this without limit for the life of the process, one entry
+  // per distinct bad value ever seen. It exists only to stop a per-recipient
+  // log flood, so evicting the oldest costs at most a repeated warning about a
+  // domain nobody has mentioned in a long time.
+  var _ldWarned = boundedMap.boundedMap({ maxEntries: 256, policy: "evict-oldest" });
+
+  // Warn once per distinct reason. getOrInsert runs the factory only when the
+  // key is absent, which is the whole "first time only" rule — a hand-rolled
+  // has-then-set says the same thing in two statements that can drift apart.
+  function _warnOnce(key, emitFn) {
+    boundedMap.getOrInsert(_ldWarned, key, function () { emitFn(); return true; });
+  }
+
+  // Backstop for the whole resolution, not any one operation inside it.
+  //
+  // Three separate throws were found here one at a time — the callback itself,
+  // serializing its result, coercing an entry — and each was guarded where it
+  // stood. The rule is what matters rather than the list: NOTHING in resolving
+  // an operator-supplied set may reach the RCPT handler as an exception, since
+  // there it ends the connection of whoever happened to be delivering. An
+  // unreadable set means no domains are known, and no domains known means every
+  // recipient is refused, which is what an empty hosted set already means.
+  function _resolveLocalDomains() {
+    try { return _resolveLocalDomainsInner(); }
+    catch (err) {
+      _warnOnce("__resolver", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "resolver-threw",
+            remark: String((err && err.message) || err).slice(0, 200) },
+          "warning");
+      });
+      return [];
+    }
+  }
+
+  function _resolveLocalDomainsInner() {
+    if (!localDomainsFn) return localDomains;
+    var raw;
+    try { raw = localDomainsFn(); }
+    catch (err) {
+      _warnOnce("__threw", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "threw", remark: String((err && err.message) || err).slice(0, 200) },
+          "warning");
+      });
+      return [];
+    }
+    if (!Array.isArray(raw)) {
+      _warnOnce("__shape", function () {
+        _emit("mail.server.mx.local_domains_unavailable",
+          { reason: "not-an-array", remark: "localDomains() returned " + (typeof raw) },
+          "warning");
+      });
+      return [];
+    }
+    // Coerce first, and key the cache on the COERCED strings.
+    //
+    // Keying on the raw array does not work: JSON.stringify is not injective
+    // with respect to the String() that follows it. Two objects with different
+    // toString() results both serialize as {}, and undefined, null and
+    // functions are indistinguishable inside an array — so two genuinely
+    // different hosted sets could share a key and the second one would be
+    // answered from the first one's cache. A withdrawn domain would stay
+    // accepted, which is the bug the callback exists to fix.
+    //
+    // Coercion is per ENTRY and guarded, because it runs with operator-supplied
+    // runtime data inside RCPT handling: an object whose toString throws must
+    // drop that entry, not end the connection that happened to arrive.
+    var coerced = [];
+    for (var i = 0; i < raw.length; i += 1) {
+      try {
+        coerced.push(String(raw[i]).toLowerCase());
+      } catch (entryErr) {
+        var entryIndex = i;
+        var entryReason = String((entryErr && entryErr.message) || entryErr).slice(0, 160);
+        _warnOnce("__entry" + entryIndex, function () {
+          _emit("mail.server.mx.local_domain_refused",
+            { domain: null, kind: "unreadable",
+              remark: "localDomains() entry " + entryIndex + " could not be read (" +
+                      entryReason +
+                      "); it is refused and the rest of the set still serves" },
+            "warning");
+        });
+      }
+    }
+
+    // Every element is a string now, so this key is injective over exactly the
+    // values the decision below is made from. Coercion is cheap and runs every
+    // time; what the cache buys is skipping a b.guardDomain call per entry per
+    // recipient, which is the expensive half.
+    var contentKey = JSON.stringify(coerced);
+    if (contentKey === _ldSeenKey) return _ldSeenOut;
+
+    // One bad entry drops and the rest of the set still serves, which is the
+    // same answer the guard gives for one it rejects on its merits.
+    var out = [];
+    for (var ci = 0; ci < coerced.length; ci += 1) {
+      var d = coerced[ci];
+      if (guardDomainProfile) {
+        var verdict;
+        try { verdict = guardDomain.validate(d, guardDomainProfile); }
+        catch (guardErr) {
+          var guardReason = String((guardErr && guardErr.message) || guardErr).slice(0, 160);
+          _warnOnce("__guard:" + d, function () {
+            _emit("mail.server.mx.local_domain_refused",
+              { domain: d, kind: "guard-threw",
+                remark: "b.guardDomain threw on this entry (" + guardReason +
+                        "); it is refused and the rest of the set still serves" },
+              "warning");
+          });
+          continue;
+        }
+        if (!verdict.ok) {
+          var refusedDomain = d;
+          var refusedKind =
+            (verdict.issues && verdict.issues[0] && verdict.issues[0].kind) || null;
+          _warnOnce(refusedDomain, function () {
+            _emit("mail.server.mx.local_domain_refused",
+              { domain: refusedDomain,
+                kind: refusedKind,
+                remark: "rejected by b.guardDomain; mail for it is refused and the rest " +
+                        "of the set still serves" },
+              "warning");
+          });
+          continue;
+        }
+      }
+      out.push(d);
+    }
+    _ldSeenKey = contentKey;
+    _ldSeenOut = out;
+    return out;
+  }
+
   var connections  = new Set();
 
   var _emit = auditEmit.emit;
@@ -559,15 +747,17 @@ function create(opts) {
   function _handleConnection(socket) {
     // 421 4.7.0 — transient refusal; sender retries elsewhere or later.
     // RFC 5321 §3.8 + §4.5.4.2 (transient negative completion).
-    var remoteAddress = mailServerNet.admitConnection(socket, rateLimit, _emit, {
+    var accepted = mailServerNet.acceptConnection(socket, {
+      rateLimit:    rateLimit,
+      connections:  connections,
+      emit:         _emit,
       refusedEvent: "mail.server.mx.rate_limit_refused",
       refusalLine:  "421 4.7.0 Too many connections from your IP\r\n",
+      idPrefix:     "mxconn-",
     });
-    if (remoteAddress === null) return;
-    socket.once("close", function () { rateLimit.releaseConnection(remoteAddress); });
-
-    var connectionId = "mxconn-" + bCrypto.generateToken(8);                                          // connection-id length
-    connections.add(socket);
+    if (accepted === null) return;
+    var remoteAddress = accepted.remoteAddress;
+    var connectionId  = accepted.connectionId;
 
     // Backpressure observer — `_writeReply` flips `_bpEmitted` after
     // the first audit emission per socket to bound the audit volume.
@@ -597,6 +787,15 @@ function create(opts) {
     // message. Decode to string only for the per-command line parse.
     var lineBuffer = Buffer.alloc(0);
     var bodyCollector = null;
+    // Watches the DATA body for its terminator and the smuggling shape as bytes
+    // arrive, so neither screen re-reads what it has already seen. Lives exactly
+    // as long as bodyCollector.
+    var bodyScanner = null;
+    // The slow-loris byte-rate floor, measured over bounded windows so an early
+    // burst cannot buy credit for a slow tail.
+    var bodyRateWindow = mailServerNet.createBodyRateWindow(rateLimit);
+    // Every byte this connection has received, counted once at the wire funnel.
+    var wireBytes = 0;
     var inDataBody = false;
     // Async command pump: gates (HELO / RBL / greylist / envelope /
     // DMARC) may await DNS or a store, so command handling is async.
@@ -621,10 +820,9 @@ function create(opts) {
       _closeConnection(socket);
     });
 
-    socket.on("close", function () {
-      connClosed = true;
-      connections.delete(socket);
-    });
+    // The set entry and the rate-limit slot are released by trackConnection;
+    // this handler carries only the per-transaction flag the drain reads.
+    socket.on("close", function () { connClosed = true; });
 
     _emit("mail.server.mx.connect", {
       connectionId:  state.id,
@@ -647,6 +845,12 @@ function create(opts) {
     // 421 path. `activeSock` is whichever socket is current (plaintext or
     // TLS) so the 421/close lands on the right transport.
     function _feedChunk(activeSock, chunk) {
+      // Every wire byte, counted once, on the single funnel both the plaintext
+      // and the post-STARTTLS socket feed. The rate window takes its baseline
+      // from this, so the measurement is "bytes since the transfer opened"
+      // rather than "bytes the body parser happened to see" — the distinction
+      // that let the sibling listener's count go flat across a window roll.
+      wireBytes += chunk.length;
       pumpChain = pumpChain.then(function () {
         if (connClosed) return undefined;
         return _ingestBytes(state, activeSock, chunk);
@@ -665,6 +869,27 @@ function create(opts) {
 
     // ---- Byte-level ingestion --------------------------------------------
     async function _ingestBytes(state, socket, chunk) {
+      // The body-rate floor is enforced HERE, on every inbound byte, rather
+      // than inside the DATA handler below. A check reached only from a body
+      // handler is one the peer chooses whether to reach: on the sibling
+      // listener the same floor was skipped first by using BDAT, then by a
+      // zero-length chunk, then by interleaving NOOP, each of which resets the
+      // socket idle timer without passing through a body handler. What a peer
+      // cannot do is hold the connection without sending bytes, and every byte
+      // arrives here.
+      if (inDataBody && bodyRateWindow.starved(wireBytes, Date.now())) {
+        _emit("mail.server.mx.data_refused",
+          { connectionId: state.id, reason: "body-rate-below-floor",
+            minBytesPerSecond: rateLimit.minBytesPerSecond() }, "denied");
+        _writeReply(socket, REPLY_421_SERVICE_NOT_AVAIL,
+          "4.7.0 Message body arriving below the minimum rate; closing connection");
+        _resetTransaction(state);
+        inDataBody = false;
+        bodyCollector = null;
+        bodyScanner = null;
+        _closeConnection(socket);
+        return;
+      }
       if (inDataBody) {
         // DATA body — accumulate via boundedChunkCollector, watch for
         // canonical "\r\n.\r\n" terminator only. Bare-LF dot terminator
@@ -679,13 +904,25 @@ function create(opts) {
           _resetTransaction(state);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           return;
         }
-        var collected = bodyCollector.result();
-        // Smuggling detector — bare LF dot-line in body before the
-        // CRLF dot terminator. Refuse the whole transaction; emit
-        // smuggling-detected audit.
-        if (guardSmtpCommand.detectBodySmuggling(collected)) {
+        // Scanned INCREMENTALLY — only this chunk plus a four-byte overlap.
+        // Re-deriving the whole accumulated body per chunk (`result()` is a
+        // fresh concat of everything received so far) and scanning it twice
+        // made acceptance quadratic in the message size. The byte cap bounds
+        // BYTES, not processor time, so a message well inside maxMessageBytes
+        // still cost 4949 ms at 8 MiB against 143 ms at 1 MiB — and on this
+        // listener that is reachable unauthenticated. `result()` is now called
+        // ONCE, when the terminator is found.
+        //
+        // The slow-loris floor is NOT applied here — it runs at the top of
+        // _ingestBytes, where every inbound byte passes whatever command it
+        // belongs to.
+        var seen = bodyScanner.push(chunk);
+        // Smuggling detector — bare LF dot-line in body before the CRLF dot
+        // terminator. Refuse the whole transaction; emit a smuggling audit.
+        if (seen.smuggling) {
           _emit("mail.server.mx.smtp_smuggling_detected",
             { connectionId: state.id, mailFrom: state.mailFrom, rcptCount: state.rcpts.length },
             "denied");
@@ -694,14 +931,15 @@ function create(opts) {
           _resetTransaction(state);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           return;
         }
         // Canonical \r\n.\r\n terminator?
-        var endIdx = safeSmtp.findDotTerminator(collected);
-        if (endIdx !== -1) {
-          var body = collected.subarray(0, endIdx);
+        if (seen.terminatorAt !== -1) {
+          var body = bodyCollector.result().subarray(0, seen.terminatorAt);
           inDataBody = false;
           bodyCollector = null;
+          bodyScanner = null;
           await _finalizeDataBody(state, socket, body);
         }
         return;
@@ -868,6 +1106,7 @@ function create(opts) {
       // shared upgradeSocket helper (b.mail.server.tls.upgradeSocket).
       lineBuffer    = Buffer.alloc(0);
       bodyCollector = null;
+      bodyScanner   = null;
       inDataBody    = false;
       mailServerTls.upgradeSocket({
         plainSocket:   socket,
@@ -1003,17 +1242,21 @@ function create(opts) {
       }
       // Local-domain check — refuse non-local recipients unless the
       // operator explicitly allowed relay for this scope.
-      if (localDomains.length > 0) {
-        if (localDomains.indexOf(rcptDomain) === -1 &&
-            !_isRelayAllowed(state.remoteAddress, rcpt)) {
-          rateLimit.noteRcptFailure(state.remoteAddress);
-          _trackRefusedRcpt(state, rcpt, "relay-denied");
-          _emit("mail.server.mx.relay_refused",
-            { connectionId: state.id, mailFrom: state.mailFrom, rcptTo: rcpt,
-              remoteAddress: state.remoteAddress }, "denied");
-          _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL, "5.7.1 Relaying denied");
-          return;
-        }
+      //
+      // Run UNCONDITIONALLY. This used to sit inside `if (localDomains.length
+      // > 0)`, so a server hosting no domains ran no check at all and accepted
+      // every recipient. An empty hosted set now refuses everything naturally,
+      // which is what an empty allowlist has to mean; `relayAllowedFor` is
+      // still the way to permit a scope deliberately.
+      if (_resolveLocalDomains().indexOf(rcptDomain) === -1 &&
+          !_isRelayAllowed(state.remoteAddress, rcpt)) {
+        rateLimit.noteRcptFailure(state.remoteAddress);
+        _trackRefusedRcpt(state, rcpt, "relay-denied");
+        _emit("mail.server.mx.relay_refused",
+          { connectionId: state.id, mailFrom: state.mailFrom, rcptTo: rcpt,
+            remoteAddress: state.remoteAddress }, "denied");
+        _writeReply(socket, REPLY_550_MAILBOX_UNAVAIL, "5.7.1 Relaying denied");
+        return;
       }
       // RBL gate (b.mail.rbl) — DNS blocklist check on the connecting
       // IP. The verdict is per-connection, so it's evaluated once and
@@ -1131,6 +1374,8 @@ function create(opts) {
         sizeCode:    "mail-server-mx/body-too-large",
         sizeMessage: "DATA body exceeded maxMessageBytes (" + maxMessageBytes + ")",
       });
+      bodyScanner    = safeSmtp.createBodyScanner();
+      bodyRateWindow.start(Date.now(), wireBytes);
     }
 
     async function _finalizeDataBody(state, socket, body) {
@@ -1165,6 +1410,18 @@ function create(opts) {
       var inboundAuth = null;
       if (envelopeGate) {
         var inboundVerdict = null;
+        // Resolve the authserv-id ONCE for this message and use that value for
+        // both the header written and the forged headers stripped.
+        //
+        // It can now come from a hosted-domain callback, so two reads either
+        // side of an await can disagree — and these two reads are exactly the
+        // pair that must not. The strip removes sender-attached
+        // Authentication-Results claiming this receiver's identity (RFC 8601
+        // §5) before the computed one is prepended. Strip under the old id and
+        // write under the new one, and a forged header claiming the id the
+        // trusted verdict was written under survives next to it, which is the
+        // shadowing this defense exists to prevent.
+        var messageAuthservId = envelopeGate.authservId;
         try {
           // Wall-clock ceiling around the whole pipeline — a message
           // stuffed with signatures pointing at slow resolvers must
@@ -1180,7 +1437,7 @@ function create(opts) {
               maxSignatures: envelopeGate.maxSignatures,
               clockSkewMs:   envelopeGate.clockSkewMs,
               minRsaBits:    envelopeGate.minRsaBits,
-              authservId:    envelopeGate.authservId || undefined,
+              authservId:    messageAuthservId || undefined,
             }),
             envelopeGate.timeoutMs,
             { name: "mail.server.mx.guardEnvelope" });
@@ -1215,6 +1472,11 @@ function create(opts) {
             dkim:         dkimSummary,
             dmarc:        inboundVerdict.dmarc.result,
             arc:          inboundVerdict.arc && inboundVerdict.arc.chainStatus,
+            // The status alone cannot tell an operator reading the audit
+            // whether a chain failed because a seal was bad or because a
+            // resolver was down — the two want opposite responses.
+            arcReason:    inboundVerdict.arc && inboundVerdict.arc.reason,
+            arcTransient: !!(inboundVerdict.arc && inboundVerdict.arc.transient),
             action:       envAction,
             mode:         envelopeGate.mode,
           }, (envAction === "reject" || envAction === "defer") ? "denied" : "success");
@@ -1247,7 +1509,7 @@ function create(opts) {
             // RFC 8601 §5 — strip any sender-attached A-R header
             // claiming this receiver's authserv-id before prepending
             // the computed one (forged-verdict shadowing defense).
-            dedotted = _stripForgedAuthResults(dedotted, envelopeGate.authservId);
+            dedotted = _stripForgedAuthResults(dedotted, messageAuthservId);
             dedotted = Buffer.concat([
               Buffer.from(inboundVerdict.authResults + "\r\n", "utf8"),
               dedotted,
@@ -1257,6 +1519,16 @@ function create(opts) {
             spf:        inboundVerdict.spf,
             dkim:       inboundVerdict.dkim,
             dmarc:      inboundVerdict.dmarc,
+            // The ARC chain sits beside the other three because it was
+            // computed with them. It used to reach the delivered message as an
+            // `arc=` token and the audit event as a status, and stop there —
+            // so a consumer wanting to act on it re-parsed a header the
+            // pipeline had just written. The header is also lossier than the
+            // verdict: RFC 8601 has one `arc=fail` token, while the verdict
+            // separates a chain that is structurally incomplete from one whose
+            // seal did not verify, and only the second says anything about the
+            // sender.
+            arc:        inboundVerdict.arc,
             from:       inboundVerdict.from,
             action:     envAction,
             mode:       envelopeGate.mode,
@@ -1370,6 +1642,7 @@ function create(opts) {
   // explicit 0 (only an OMITTED port falls back to the default).
   var _tcpListener = mailServerNet.createTcpListener(net, {
     defaultPort:      25,                                                                             // SMTP MX port (IANA)
+    maxConnections:   opts.maxConnections,
     handleConnection: _handleConnection,
     errorFactory:     function (code, message) { return new MailServerMxError("mail-server-mx/" + code, message); },
     emit:             _emit,