@bobfrankston/mailx-types 0.1.90 → 0.1.92

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.90",
+  "version": "0.1.92",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.js

@@ -216,6 +216,30 @@ function dkimSigners(input) {
     }
     return out;
 }
+/** Did the From domain's OWN organisation pass authentication at the
+ *  receiving server — a verified signature for the From domain, or an SPF
+ *  pass for an envelope at the From domain? This is DMARC's relaxed
+ *  alignment computed locally, for domains that publish no DMARC policy and
+ *  so never get a dmarc= verdict. Only the From domain's own servers can pass
+ *  SPF as that domain or sign as it, so a forger's pass for their own domain
+ *  does not count. Returns which proof, or "". (2026-09-09) */
+function alignedPass(input) {
+    const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+    if (!fromDomain)
+        return "";
+    if (dkimSigners(input).some(d => sameOrg(d, fromDomain)))
+        return "dkim";
+    const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+    for (const part of auth.split(";")) {
+        if (!/\bspf=pass\b/i.test(part))
+            continue;
+        const mailfrom = (part.match(/(?:spf|smtp)\.mailfrom=([^\s;,]+)/i)?.[1] || "").toLowerCase();
+        const domain = mailfrom.includes("@") ? mailfrom.split("@")[1] : mailfrom;
+        if (domain && sameOrg(domain, fromDomain))
+            return "spf";
+    }
+    return "";
+}
 /** The entry in `trustedIntermediaries` that provably handled this message,
  *  or "" — proof being a verified signature from its domain, or a DMARC pass
  *  when it is the author. The list alone proves nothing. (2026-09-08) */
@@ -633,6 +657,27 @@ function selfSpoof(input) {
     const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
     if (!auth)
         return null;
+    // The From domain passed DMARC, aligned, at the receiving server: the
+    // message provably came from that domain, which is the opposite of a
+    // spoof. Checked BEFORE the failure scan because the scan reads every
+    // Authentication-Results and every signature — an ISOC list post
+    // (2026-09-09) carried dkim=pass d=elists.isoc.org, dmarc=pass
+    // header.from=elists.isoc.org, AND dkim=fail for the original author's
+    // standardstrack.com signature the list had broken, and that one fail
+    // painted the whole message red as "did not come from your account"
+    // (the list address was the Delivered-To, so it counted as Bob's own).
+    // One failed signature on a message with an aligned pass is not
+    // evidence about the From line; the pass is.
+    //
+    // The same proof without the dmarc= verdict: a From domain that publishes
+    // no DMARC policy gets no dmarc=pass, but its own SPF pass or its own
+    // verified signature is the very evidence DMARC would have aligned on.
+    // The AMW list (berglist.com, 2026-09-09): spf=pass for
+    // amw-bounces@berglist.com, dkim=pass d=berglist.com, and dkim=fail for
+    // the gmail.com author signature the list broke — flagged as a spoof of
+    // the list's own address.
+    if (dmarcProof(input).pass || alignedPass(input))
+        return null;
     const failed = [
         /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",
         /\bdkim=(fail|permerror)\b/i.test(auth) ? "DKIM" : "",