@novacraft-engineering/mailbox 0.4.18 → 0.4.20

package/lib/mailbox.ts

@@ -573,6 +573,17 @@ const listFrom = (raw: string | undefined, fallback: Iterable<string>): Set<stri
 // Read per call, so a deployment can change any of them without a release.
 const freeProviders = () => listFrom(process.env.MAIL_FREE_PROVIDERS, FREE_MAIL_DEFAULT)
 const throwawayTlds = () => listFrom(process.env.MAIL_THROWAWAY_TLDS, THROWAWAY_TLDS_DEFAULT)
+
+// Bulk senders put their own bounce domain in From and the real correspondent in Reply-To.
+// That is how the campaign gets replies, not an attempt to redirect them somewhere unexpected.
+const BULK_SENDERS_DEFAULT = new Set([
+  'mailchimpapp.com', 'mcsv.net', 'rsgsv.net', 'mailchimp.com',
+  'sendgrid.net', 'sendgrid.com', 'sparkpostmail.com', 'amazonses.com',
+  'mailgun.org', 'mandrillapp.com', 'postmarkapp.com', 'sendinblue.com',
+  'brevo.com', 'constantcontact.com', 'cmail19.com', 'createsend.com',
+  'hubspotemail.net', 'mailerlite.com', 'klaviyomail.com', 'salesforce.com',
+])
+const bulkSenders = () => listFrom(process.env.MAIL_BULK_SENDERS, BULK_SENDERS_DEFAULT)
 const scamPhrases = () => [...listFrom(process.env.MAIL_SCAM_PHRASES, SCAM_PHRASES_DEFAULT)]
 
 /** Weight at which a message stops being labelled and is held out of the inbox instead. */
@@ -593,7 +604,15 @@ export type RiskJudgement = { risk: Risk; reasons: string[]; score: number; quar
 export function judgeMessage(signals: RiskSignals, standing: SenderStanding): RiskJudgement {
   const reasons: string[] = []
   let score = 0
-  const add = (weight: number, why: string) => { score += weight; reasons.push(why) }
+  // A finding is "telling" when it is hard to trip by accident. Failing an authentication
+  // check or shouting in the subject line is neither: ordinary mail does both. Holding a
+  // message back takes at least one finding of the first kind, however the weights add up.
+  let telling = 0
+  const add = (weight: number, why: string, isTelling = false) => {
+    score += weight
+    if (isTelling) telling += 1
+    reasons.push(why)
+  }
 
   if (/^fail$/i.test((signals.virus ?? '').trim())) {
     return { risk: 'virus', reasons: ['A virus scan failed on this message'], score: 100, quarantine: true }
@@ -604,12 +623,12 @@ export function judgeMessage(signals: RiskSignals, standing: SenderStanding): Ri
   const trusted = standing.replied > 0 && standing.markedSpam === 0
   if (standing.markedSpam > 0) {
     add(4 + Math.min(standing.markedSpam, 4),
-      `You marked ${standing.markedSpam} earlier message${standing.markedSpam === 1 ? '' : 's'} from this sender as spam`)
+      `You marked ${standing.markedSpam} earlier message${standing.markedSpam === 1 ? '' : 's'} from this sender as spam`, true)
   } else if (standing.trashed >= 3 && standing.replied === 0) {
-    add(3, `You have deleted ${standing.trashed} messages from this sender without ever replying`)
+    add(3, `You have deleted ${standing.trashed} messages from this sender without ever replying`, true)
   }
 
-  if (/^fail$/i.test((signals.spam ?? '').trim())) add(4, 'The provider\u2019s spam filter flagged this message')
+  if (/^fail$/i.test((signals.spam ?? '').trim())) add(4, 'The provider\u2019s spam filter flagged this message', true)
 
   const authenticated = /^pass$/i.test((signals.dmarc ?? '').trim())
   // Heavy, but not enough on its own to hide a message: mail forwarded through a list
@@ -627,15 +646,19 @@ export function judgeMessage(signals: RiskSignals, standing: SenderStanding): Ri
     .filter(entry => entry && entry !== fromDomain)
   const free = freeProviders()
   const freeReply = replyDomains.find(entry => free.has(entry))
-  if (freeReply && fromDomain && !free.has(fromDomain)) {
-    add(4, `Replies to this message go to ${freeReply}, not to ${fromDomain}`)
+  const bulk = bulkSenders().has(fromDomain)
+  if (bulk) {
+    // Nothing to say: a campaign's replies are meant to land somewhere other than the
+    // sending platform, and treating that as misdirection buries ordinary bulk mail.
+  } else if (freeReply && fromDomain && !free.has(fromDomain)) {
+    add(4, `Replies to this message go to ${freeReply}, not to ${fromDomain}`, true)
   } else if (replyDomains.length) {
     add(1, `Replies go to ${replyDomains[0]} rather than ${fromDomain || 'the sender'}`)
   }
 
   const tld = fromDomain.split('.').pop() ?? ''
-  if (throwawayTlds().has(tld)) add(2, `The sender\u2019s domain ends in .${tld}, which is cheap to register and often disposable`)
-  if (/^\d{4,}$/.test(fromDomain.split('.')[0] ?? '')) add(2, 'The sender\u2019s domain name is just a string of digits')
+  if (throwawayTlds().has(tld)) add(2, `The sender\u2019s domain ends in .${tld}, which is cheap to register and often disposable`, true)
+  if (/^\d{4,}$/.test(fromDomain.split('.')[0] ?? '')) add(2, 'The sender\u2019s domain name is just a string of digits', true)
 
   const subject = (signals.subject ?? '').trim()
   const letters = subject.replace(/[^A-Za-z]/g, '')
@@ -643,7 +666,7 @@ export function judgeMessage(signals: RiskSignals, standing: SenderStanding): Ri
 
   const body = (signals.text ?? '').toLowerCase()
   const hits = scamPhrases().filter(phrase => body.includes(phrase))
-  if (hits.length >= 2) add(3, `The wording follows a known advance-fee approach (${hits.slice(0, 3).join(', ')})`)
+  if (hits.length >= 2) add(3, `The wording follows a known advance-fee approach (${hits.slice(0, 3).join(', ')})`, true)
   else if (hits.length === 1) add(1, `Wording associated with advance-fee mail (${hits[0]})`)
 
   // Never heard from before is not suspicious by itself — everyone writes once for the
@@ -660,7 +683,7 @@ export function judgeMessage(signals: RiskSignals, standing: SenderStanding): Ri
   // time teaches the reader to ignore the warning.
   if (score < flagAt()) return { risk: 'clean', reasons: [], score, quarantine: false }
 
-  const quarantine = score >= limit
+  const quarantine = score >= limit && telling > 0
   return { risk: quarantine ? 'spam' : 'suspicious', reasons, score, quarantine }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@novacraft-engineering/mailbox",
-  "version": "0.4.18",
+  "version": "0.4.20",
   "description": "A shared webmail app: one codebase, one deployment per mailbox. Threads, a rich composer with signatures, attachments on S3-compatible storage, sharing links, full-text search, web push and PWA install.",
   "keywords": [
     "webmail",