@bobfrankston/rmfmail 1.2.309 → 1.2.310

package/.commitmsg

@@ -1,11 +1,13 @@
-Trust banner names the intermediary and the action that trusts it
+Redirector warning: a link that ends at the proved sender hides nothing
 
-"Is there a 'trust this intermediary' operation or do I need to edit it
-manually? If so the banner should tell which and how" (Bob 2026-09-08). The
-button existed since v1.2.308 but the finding text did not mention it. The
-spam-verdict note now ends with: Sent on the author's behalf by google.com,
-which signed it; "Trust google.com as an intermediary" stops this note for
-mail google.com signs. The redirector warning ends the same way, naming the
-signer — or, when nobody signed for the redirector host, says plainly that
-there is no intermediary to trust and only the sender could vouch for the
-link. mailx-types 0.1.85.
+"Another safe message flagged" (Bob 2026-09-08): Microsoft 365 Message
+center, dmarc=pass header.from=microsoft.com policy reject, every link
+through Microsoft's click-tracker nam.safelink.emails.azure.net ending at
+admin.microsoft.com. The three existing escapes all miss — azure.net and
+microsoft.com are different organisations by hostname, nobody signed for
+azure.net, and the redirector is not the sender. Rule 4: when the link ENDS
+at the party that provably sent the mail, the reader lands exactly where a
+plain link would have taken them; the hop hides nothing from them. Requires
+proof (DMARC pass, or DKIM_VALID_AU / ALL_TRUSTED per the existing proof
+logic); an unproved message with the same links stays flagged. mailx-types
+0.1.87.

package/client/android-bootstrap.bundle.js

@@ -2533,6 +2533,8 @@ function redirectorLink(input) {
         continue;
       if (sameOrg(target.hostname, url.hostname))
         continue;
+      if (senderDomain && sameOrg(target.hostname, senderDomain))
+        continue;
       const signer = signers.find((s) => sameOrg(s, url.hostname));
       const how = signer ? ` ${signer} signed this message; "Trust ${signer} as an intermediary" stops this warning for links through ${signer} in mail it signs.` : ` Nobody signed this message for ${url.hostname}, so there is no intermediary to trust; only the sender could vouch for the link.`;
       return {