@bobfrankston/mailx-types 0.1.55 → 0.1.57

package/index.js

@@ -479,9 +479,32 @@ export function displayNameClaimsOtherAddress(name, address) {
     const m = n.match(/[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g);
     if (!m)
         return null;
+    const realDomain = real.split("@").pop() || "";
     for (const claimed of m) {
-        if (claimed.toLowerCase() !== real)
-            return claimed;
+        if (claimed.toLowerCase() === real)
+            continue;
+        // Same organisation is not impersonation. Plenty of legitimate senders
+        // put a contact address in the display name that differs from the
+        // envelope address at the same org — IEEE Xplore alerts arrive as
+        // `"Content-Alert@ieee.org" <no-reply@xplore.ieee.org>`, which the
+        // first cut flagged in danger red and read as a spam marker
+        // (Bob 2026-08-20: "marked as spam but is a valid message"; that
+        // message passes SPF, DKIM and DMARC and SpamAssassin scores it -2.0).
+        //
+        // Sub/parent-domain rather than "same registrable domain" on purpose:
+        // comparing the last two labels would treat paypal.co.uk and
+        // evil.co.uk as related, which is exactly the case that must stay
+        // flagged. A subdomain relationship cannot be forged across orgs.
+        const claimedDomain = claimed.toLowerCase().split("@").pop() || "";
+        if (claimedDomain && realDomain) {
+            if (claimedDomain === realDomain)
+                continue;
+            if (claimedDomain.endsWith("." + realDomain))
+                continue;
+            if (realDomain.endsWith("." + claimedDomain))
+                continue;
+        }
+        return claimed;
     }
     return null;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.55",
+  "version": "0.1.57",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",