@bobfrankston/rmfmail 1.2.314 → 1.2.315

package/.commitmsg

@@ -1,27 +1,17 @@
-Self-spoof: a DMARC-proved From is not a spoof, whatever else failed
+Self-spoof: the From domain's own SPF or DKIM pass is proof, DMARC verdict or not
 
-Bob 2026-09-09, the ISOC Internet Policy list post, red banner "This
-message is not what it says it is — claims to be from your own address,
-internetpolicy@elists.isoc.org, but it did not come from your account.
-DKIM authentication failed". The list rewrote From to itself and signed
-it; iecc.com recorded dkim=pass d=elists.isoc.org and dmarc=pass
-header.from=elists.isoc.org — and dkim=fail for the original author's
-standardstrack.com signature the list had broken. Delivered-To was the
-list address, so it counted as one of Bob's own, and selfSpoof read every
-Authentication-Results and every signature and took the one failure as
-"did not come from your account". One broken signature on a message whose
-From domain passed DMARC aligned is not evidence about the From line; the
-pass is. selfSpoof now returns before the failure scan when dmarcProof
-passes for the actual From domain (a pass for some other domain still
-proves nothing — tested).
+Follow-up to v1.2.314 (which vetoed the self-spoof finding on a DMARC pass).
+The AMW list (berglist.com) publishes no DMARC policy, so its posts carry
+no dmarc= verdict at all — but iecc.com recorded spf=pass for
+amw-bounces@berglist.com and dkim=pass d=berglist.com, which is the very
+evidence DMARC would have aligned on. The dkim=fail beside them was the
+gmail.com author signature the list broke, and the post was red as a spoof
+of the list's own address (Delivered-To). New alignedPass() in trust.ts:
+a verified signature for the From domain, or an SPF pass for an envelope at
+the From domain, computed as DMARC's relaxed alignment; a forger's pass for
+their own domain clears nothing (tested).
 
-Measured over the last 120 days: 977 messages whose From is their own
-Delivered-To, 35 self-spoof findings before, 20 after; the 15 cleared are
-all ISOC list posts, the 20 that remain are the sextortion/phish/NDA-scam
-mail the check exists for.
-
-Also: a danger banner on a proved-list post now says which list delivered
-it and that trusting the list (right-click the From address) would not
-clear the finding — a red banner with no way forward sends the reader
-hunting (Bob: "right mouse on the From … that's not obvious to the normal
-user"). mailx-types 0.1.90.
+Store, last 120 days, messages whose From is their own Delivered-To: 977;
+self-spoof findings 35 before v1.2.314, 20 after it, 15 now. The 15 that
+remain are the sextortion, "failed to deliver", NDA-review and
+document-share phishes the check exists for. mailx-types 0.1.91.

package/.llm/trusted-lists.md

@@ -40,6 +40,10 @@ tests/trust.test.ts, .commitmsg, TODO.md C165, root version 1.2.311. Then rebuil
 ## Follow-up 2026-09-09 evening
 - Button beside the chip ("Trust the ‹List-Id› list"), From-menu item now toggles (Stop trusting…), docs reworded re editing allowlist.jsonc. Danger banners keep no list button: 123/123 proved-list danger cases in 120 days were URL phish/malware listings.
 
+## Self-spoof false positive (found from Bob's screenshot, 2026-09-09 late)
+- ISOC + berglist posts red as "claims to be from your own address": Delivered-To = list address = From, and selfSpoof took ANY dkim=fail in ANY Authentication-Results as proof of forgery. v1.2.314: DMARC-aligned pass vetoes. Next (v1.2.315): alignedPass() — From domain's own SPF pass or DKIM pass vetoes (relaxed alignment for domains with no DMARC policy). Store: 35 → 20 → 15 findings; the 15 are real phish.
+- Danger banner on a proved-list post now names the list and says right-click From / that trust would not clear it.
+
 ## Status
 - [x] trust.ts
 - [x] settings/store/service/web

package/client/android-bootstrap.bundle.js

@@ -2267,6 +2267,23 @@ function dkimSigners(input) {
   }
   return out;
 }
+function alignedPass(input) {
+  const fromDomain = (bare(input.fromAddress).split("@")[1] || "").toLowerCase();
+  if (!fromDomain)
+    return "";
+  if (dkimSigners(input).some((d) => sameOrg(d, fromDomain)))
+    return "dkim";
+  const auth = headerAll(input.headerLines, "authentication-results")[0] || "";
+  for (const part of auth.split(";")) {
+    if (!/\bspf=pass\b/i.test(part))
+      continue;
+    const mailfrom = (part.match(/(?:spf|smtp)\.mailfrom=([^\s;,]+)/i)?.[1] || "").toLowerCase();
+    const domain = mailfrom.includes("@") ? mailfrom.split("@")[1] : mailfrom;
+    if (domain && sameOrg(domain, fromDomain))
+      return "spf";
+  }
+  return "";
+}
 function provedIntermediary(input) {
   const list = (input.trustedIntermediaries || []).map((d) => (d || "").trim().toLowerCase()).filter(Boolean);
   if (!list.length)
@@ -2483,7 +2500,7 @@ function selfSpoof(input) {
   const auth = headerAll(input.headerLines, "authentication-results").join(" ; ");
   if (!auth)
     return null;
-  if (dmarcProof(input).pass)
+  if (dmarcProof(input).pass || alignedPass(input))
     return null;
   const failed = [
     /\bspf=(fail|softfail)\b/i.test(auth) ? "SPF" : "",