@push.rocks/smartmta 8.0.0 → 8.1.0

package/ts/mail/routing/classes.unified.email.server.ts

@@ -10,7 +10,14 @@ import {
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 import type { IStorageManager } from '../interfaces.storage.js';
 import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
-import type { IEmailReceivedEvent, IRcptToRequestEvent, IAuthRequestEvent, IScramCredentialRequestEvent } from '../../security/classes.rustsecuritybridge.js';
+import type {
+  IAuthRequestEvent,
+  IEmailReceivedEvent,
+  IEmailSecurityResult,
+  IInboundEmailSecurityResult,
+  IRcptToRequestEvent,
+  IScramCredentialRequestEvent,
+} from '../../security/classes.rustsecuritybridge.js';
 import { EmailRouter } from './classes.email.router.js';
 import type { IEmailRoute, IEmailContext, IEmailDomainConfig } from './interfaces.js';
 import { Email } from '../core/classes.email.js';
@@ -35,6 +42,41 @@ interface DcRouter {
   options?: any;
 }
 
+export type TRecipientRouteSource = 'explicit-route' | 'domain-policy' | 'no-route';
+export type TRecipientRejectionReason =
+  | 'explicit-route'
+  | 'domain-policy'
+  | 'no-route'
+  | 'domain-not-hosted'
+  | 'relay-denied'
+  | 'recipient-hook'
+  | 'policy-error';
+
+export interface IResolvedRecipientRoute {
+  recipient: string;
+  localDomain: string | null;
+  route: IEmailRoute | null;
+  source: TRecipientRouteSource;
+}
+
+export interface IRecipientRejectedEvent {
+  timestamp: string;
+  sender: string;
+  recipient: string;
+  localDomain: string | null;
+  remoteAddress: string;
+  smtpCode: number;
+  smtpMessage: string;
+  routeName: string | null;
+  reason: TRecipientRejectionReason;
+}
+
+interface IRecipientPolicyResolution extends IResolvedRecipientRoute {
+  decision: ISmtpDecision;
+  rejectionReason?: TRecipientRejectionReason;
+  policyRouteName?: string;
+}
+
 /**
  * Extended SMTP session interface with route information
  */
@@ -43,6 +85,10 @@ export interface IExtendedSmtpSession extends ISmtpSession {
    * Matched route for this session
    */
   matchedRoute?: IEmailRoute;
+  /** Per-envelope-recipient routes resolved before DATA acceptance. */
+  resolvedRecipientRoutes?: IResolvedRecipientRoute[];
+  /** Results computed by the Rust inbound pipeline before the message event is emitted. */
+  securityResults?: IInboundEmailSecurityResult | null;
 }
 
 export interface ISmtpDecision {
@@ -68,9 +114,34 @@ export interface IMessageAcceptanceContext {
   email: Email;
   rawMessage: Buffer;
   session: IExtendedSmtpSession;
+  matchedRoute?: IEmailRoute;
+  /** Full-envelope route resolution. */
+  resolvedRecipientRoutes: IResolvedRecipientRoute[];
   abortSignal?: AbortSignal;
 }
 
+/**
+ * Terminal durable acceptance context for an envelope containing at least one `store` route.
+ * The consumer owns persistence and all recipient fan-out before this hook resolves.
+ */
+export interface IAcceptEnvelopeContext {
+  email: Email;
+  /** Exact bytes received during SMTP DATA, before parsing or transformation. */
+  rawMessage: Buffer;
+  session: IExtendedSmtpSession;
+  envelope: {
+    mailFrom: string;
+    rcptTo: string[];
+  };
+  /** Complete resolved plan for every SMTP envelope recipient. */
+  resolvedRecipientRoutes: IResolvedRecipientRoute[];
+  abortSignal?: AbortSignal;
+  /** Immutable attachment count derived from the parsed message. */
+  readonly attachmentCount: number;
+  /** Rust-computed inbound verdicts, available before durable acceptance. */
+  securityResults: IInboundEmailSecurityResult | null;
+}
+
 export interface IMessageAcceptanceDecision extends ISmtpDecision {
   /** Continue SmartMTA's built-in route processing after the consumer accepted responsibility. */
   continueProcessing?: boolean;
@@ -95,6 +166,18 @@ export interface IOutboundConnectionProxy {
   close?: () => Promise<void> | void;
 }
 
+export interface IOutboundTopologyIdentity {
+  hostnames?: string[];
+  ipAddresses?: string[];
+}
+
+export interface ISelfMxIdentityMatch {
+  isSelf: boolean;
+  source: 'explicit' | 'dns-derived' | 'dynamic' | null;
+  indeterminate: boolean;
+  evidence: string[];
+}
+
 /**
  * Options for the unified email server
  */
@@ -159,10 +242,14 @@ export interface IUnifiedEmailServerOptions {
   };
 
   hooks?: {
-    /** Async recipient policy hook, called before each RCPT TO is accepted. */
+    /** Async recipient policy hook that may further restrict an accepted built-in decision. */
     onRcptTo?: (context: IRcptToPolicyContext) => Promise<ISmtpDecision>;
-    /** Async message acceptance hook, called after DATA before the final SMTP response. */
+    /** Async message acceptance hook for envelopes with no resolved `store` action. */
     onMessageData?: (context: IMessageAcceptanceContext) => Promise<IMessageAcceptanceDecision>;
+    /** Required terminal durable owner for any envelope containing a resolved `store` action. */
+    onAcceptEnvelope?: (context: IAcceptEnvelopeContext) => Promise<void>;
+    /** Observer-safe callback for SMTP recipient rejections. */
+    onRecipientRejected?: (event: IRecipientRejectedEvent) => Promise<void> | void;
   };
 
   // Global defaults for all domains
@@ -181,6 +268,10 @@ export interface IUnifiedEmailServerOptions {
     socketTimeout?: number;
     retryAttempts?: number;
     defaultFrom?: string;
+    /** Static public listener identities that must never be selected as outbound MX targets. */
+    selfListenerIdentities?: IOutboundTopologyIdentity;
+    /** Current proven mail-edge identities. Connection proxy targets are deliberately not identities. */
+    topologyIdentityProvider?: () => Promise<IOutboundTopologyIdentity | null | undefined>;
     connectionProxyProvider?: (context: IOutboundConnectionProxyContext) => Promise<IOutboundConnectionProxy | null | undefined>;
   };
 
@@ -390,6 +481,18 @@ export class UnifiedEmailServer extends EventEmitter {
     // We'll create the SMTP servers during the start() method
   }
 
+  public onRecipientRejected(
+    listener: (event: IRecipientRejectedEvent) => Promise<void> | void,
+  ): this {
+    return super.on('recipientRejected', listener);
+  }
+
+  public offRecipientRejected(
+    listener: (event: IRecipientRejectedEvent) => Promise<void> | void,
+  ): this {
+    return super.off('recipientRejected', listener);
+  }
+
   private getAdvertisedHostname(): string {
     return this.options.hostname;
   }
@@ -398,6 +501,120 @@ export class UnifiedEmailServer extends EventEmitter {
     return this.options.outbound?.hostname || this.options.hostname;
   }
 
+  private normalizeTopologyIdentity(valueArg: string): string {
+    const value = valueArg.trim().replace(/^\[|\]$/g, '').replace(/\.$/, '');
+    if (!value) return '';
+    if (plugins.net.isIP(value)) {
+      if (plugins.net.isIPv6(value)) {
+        try {
+          return new URL(`http://[${value}]/`).hostname.slice(1, -1).toLowerCase();
+        } catch {
+          return value.toLowerCase();
+        }
+      }
+      return value;
+    }
+    return plugins.url.domainToASCII(value).toLowerCase();
+  }
+
+  private getExplicitTopologyIdentity(): Required<IOutboundTopologyIdentity> {
+    const configured = this.options.outbound?.selfListenerIdentities;
+    return {
+      hostnames: [
+        this.options.hostname,
+        this.options.outbound?.hostname || '',
+        ...(configured?.hostnames || []),
+      ].map((value) => this.normalizeTopologyIdentity(value)).filter(Boolean),
+      ipAddresses: (configured?.ipAddresses || [])
+        .map((value) => this.normalizeTopologyIdentity(value))
+        .filter((value) => Boolean(plugins.net.isIP(value))),
+    };
+  }
+
+  private async withTopologyTimeout<T>(operation: Promise<T>): Promise<T> {
+    let timer: ReturnType<typeof setTimeout> | undefined;
+    try {
+      return await Promise.race([
+        operation,
+        new Promise<T>((_resolve, reject) => {
+          timer = setTimeout(() => reject(new Error('self-MX DNS resolution timed out')), 3_000);
+        }),
+      ]);
+    } finally {
+      if (timer) clearTimeout(timer);
+    }
+  }
+
+  private async resolveTopologyHostname(hostnameArg: string): Promise<{
+    hostnames: Set<string>;
+    ipAddresses: Set<string>;
+    indeterminate: boolean;
+    evidence: string[];
+  }> {
+    const hostname = this.normalizeTopologyIdentity(hostnameArg);
+    const hostnames = new Set<string>();
+    const ipAddresses = new Set<string>();
+    const evidence: string[] = [];
+    if (!hostname) return { hostnames, ipAddresses, indeterminate: false, evidence };
+    if (plugins.net.isIP(hostname)) {
+      ipAddresses.add(hostname);
+      return { hostnames, ipAddresses, indeterminate: false, evidence };
+    }
+
+    const resolver = new plugins.dns.promises.Resolver();
+    const isAbsent = (errorArg: unknown): boolean => {
+      const code = (errorArg as NodeJS.ErrnoException)?.code;
+      return code === 'ENODATA' || code === 'ENOTFOUND';
+    };
+    let current = hostname;
+    let indeterminate = false;
+    for (let depth = 0; depth < 8; depth++) {
+      if (hostnames.has(current)) {
+        evidence.push(`CNAME loop at ${current}`);
+        indeterminate = true;
+        break;
+      }
+      hostnames.add(current);
+      let aliases: string[];
+      try {
+        aliases = await resolver.resolveCname(current);
+      } catch (error) {
+        if (!isAbsent(error)) {
+          evidence.push(`CNAME lookup failed for ${current}`);
+          indeterminate = true;
+        }
+        break;
+      }
+      const alias = this.normalizeTopologyIdentity(aliases[0] || '');
+      if (!alias) break;
+      evidence.push(`${current} CNAME ${alias}`);
+      current = alias;
+      if (depth === 7) {
+        evidence.push('CNAME chain exceeded 8 hops');
+        indeterminate = true;
+      }
+    }
+
+    const resolveAddresses = async (family: 4 | 6): Promise<{ addresses: string[]; indeterminate: boolean }> => {
+      try {
+        const values = family === 4 ? await resolver.resolve4(current) : await resolver.resolve6(current);
+        return { addresses: values, indeterminate: false };
+      } catch (error) {
+        return { addresses: [], indeterminate: !isAbsent(error) };
+      }
+    };
+    const [ipv4, ipv6] = await Promise.all([resolveAddresses(4), resolveAddresses(6)]);
+    for (const address of [...ipv4.addresses, ...ipv6.addresses]) {
+      const normalized = this.normalizeTopologyIdentity(address);
+      if (normalized) ipAddresses.add(normalized);
+    }
+    if (ipv4.indeterminate || ipv6.indeterminate) {
+      evidence.push(`address lookup failed for ${current}`);
+      indeterminate = true;
+    }
+    return { hostnames, ipAddresses, indeterminate, evidence };
+  }
+
   /**
    * Whether a hostname refers to this server's own SMTP identity.
    * Used by MTA delivery to refuse self-addressed relaying: a domain whose
@@ -405,13 +622,115 @@ export class UnifiedEmailServer extends EventEmitter {
    * full outbound/inbound pipeline forever.
    */
   public isSelfHostname(hostname: string): boolean {
-    const normalize = (name: string) => name.toLowerCase().replace(/\.$/, '');
-    const candidate = normalize(hostname);
+    const candidate = this.normalizeTopologyIdentity(hostname);
     if (!candidate) return false;
-    return (
-      candidate === normalize(this.options.hostname) ||
-      candidate === normalize(this.options.outbound?.hostname || '')
-    );
+    const explicit = this.getExplicitTopologyIdentity();
+    return explicit.hostnames.includes(candidate) || explicit.ipAddresses.includes(candidate);
+  }
+
+  /** Resolve a candidate MX against explicit and current proven listener topology. */
+  public async resolveSelfMxIdentity(hostnameArg: string): Promise<ISelfMxIdentityMatch> {
+    const candidate = this.normalizeTopologyIdentity(hostnameArg);
+    const evidence: string[] = [];
+    if (!candidate) {
+      return { isSelf: false, source: null, indeterminate: true, evidence: ['empty MX identity'] };
+    }
+
+    const explicit = this.getExplicitTopologyIdentity();
+    if (explicit.hostnames.includes(candidate) || explicit.ipAddresses.includes(candidate)) {
+      return { isSelf: true, source: 'explicit', indeterminate: false, evidence: [`exact identity ${candidate}`] };
+    }
+
+    let dynamic: Required<IOutboundTopologyIdentity> = { hostnames: [], ipAddresses: [] };
+    try {
+      const topologyIdentityProvider = this.options.outbound?.topologyIdentityProvider;
+      const provided = topologyIdentityProvider
+        ? await this.withTopologyTimeout(topologyIdentityProvider())
+        : undefined;
+      if (topologyIdentityProvider && provided == null) {
+        return {
+          isSelf: false,
+          source: null,
+          indeterminate: true,
+          evidence: ['dynamic topology identity provider returned no proof'],
+        };
+      }
+      dynamic = {
+        hostnames: (provided?.hostnames || [])
+          .map((value) => this.normalizeTopologyIdentity(value)).filter(Boolean),
+        ipAddresses: (provided?.ipAddresses || [])
+          .map((value) => this.normalizeTopologyIdentity(value))
+          .filter((value) => Boolean(plugins.net.isIP(value))),
+      };
+      if (
+        topologyIdentityProvider
+        && dynamic.hostnames.length === 0
+        && dynamic.ipAddresses.length === 0
+      ) {
+        return {
+          isSelf: false,
+          source: null,
+          indeterminate: true,
+          evidence: ['dynamic topology identity provider returned no valid proof'],
+        };
+      }
+    } catch {
+      return { isSelf: false, source: null, indeterminate: true, evidence: ['dynamic topology identity unavailable'] };
+    }
+    if (dynamic.hostnames.includes(candidate) || dynamic.ipAddresses.includes(candidate)) {
+      return { isSelf: true, source: 'dynamic', indeterminate: false, evidence: [`dynamic identity ${candidate}`] };
+    }
+
+    try {
+      const candidateResolution = await this.withTopologyTimeout(this.resolveTopologyHostname(candidate));
+      evidence.push(...candidateResolution.evidence);
+      const intersects = (left: Set<string>, right: Iterable<string>): string | undefined => {
+        for (const value of right) if (left.has(value)) return value;
+        return undefined;
+      };
+
+      const explicitHostname = intersects(candidateResolution.hostnames, explicit.hostnames);
+      const explicitIp = intersects(candidateResolution.ipAddresses, explicit.ipAddresses);
+      if (explicitHostname || explicitIp) {
+        evidence.push(`resolved to explicit identity ${explicitHostname || explicitIp}`);
+        return { isSelf: true, source: 'dns-derived', indeterminate: false, evidence };
+      }
+      const dynamicHostname = intersects(candidateResolution.hostnames, dynamic.hostnames);
+      const dynamicIp = intersects(candidateResolution.ipAddresses, dynamic.ipAddresses);
+      if (dynamicHostname || dynamicIp) {
+        evidence.push(`resolved to dynamic identity ${dynamicHostname || dynamicIp}`);
+        return { isSelf: true, source: 'dynamic', indeterminate: false, evidence };
+      }
+
+      const identities = [
+        ...explicit.hostnames.map((hostname) => ({ hostname, source: 'explicit' as const })),
+        ...dynamic.hostnames.map((hostname) => ({ hostname, source: 'dynamic' as const })),
+      ];
+      for (const identity of identities) {
+        const resolved = await this.withTopologyTimeout(this.resolveTopologyHostname(identity.hostname));
+        const matchedIp = intersects(candidateResolution.ipAddresses, resolved.ipAddresses);
+        if (matchedIp) {
+          evidence.push(`shares address ${matchedIp} with ${identity.hostname}`);
+          return {
+            isSelf: true,
+            source: identity.source === 'explicit' ? 'dns-derived' : 'dynamic',
+            indeterminate: false,
+            evidence,
+          };
+        }
+        if (resolved.indeterminate) {
+          evidence.push(...resolved.evidence);
+          return { isSelf: false, source: null, indeterminate: true, evidence };
+        }
+      }
+      if (candidateResolution.indeterminate) {
+        return { isSelf: false, source: null, indeterminate: true, evidence };
+      }
+      return { isSelf: false, source: null, indeterminate: false, evidence };
+    } catch (error) {
+      evidence.push((error as Error).message);
+      return { isSelf: false, source: null, indeterminate: true, evidence };
+    }
   }
 
   /**
@@ -455,6 +774,12 @@ export class UnifiedEmailServer extends EventEmitter {
       text: email.text || '',
       html: email.html || undefined,
       headers: email.headers as Record<string, string> || {},
+      attachments: email.attachments.map((attachment) => ({
+        filename: attachment.filename,
+        contentBase64: attachment.content.toString('base64'),
+        contentType: attachment.contentType,
+        ...(attachment.contentId ? { contentId: attachment.contentId } : {}),
+      })),
     };
 
     const secure = port === 465;
@@ -740,7 +1065,7 @@ export class UnifiedEmailServer extends EventEmitter {
       authEnabled: !!this.options.auth?.required || !!(this.options.auth?.users?.length),
       maxAuthFailures: 3,
       socketTimeoutSecs: this.options.socketTimeout ? Math.floor(this.options.socketTimeout / 1000) : 300,
-      processingTimeoutSecs: this.options.hooks?.onMessageData
+      processingTimeoutSecs: this.options.hooks?.onMessageData || this.options.hooks?.onAcceptEnvelope
         ? Math.ceil(this.getMessageAcceptanceTimeoutMs() / 1000) + 1
         : 30,
       maxConcurrentMessages: this.options.smtp?.maxConcurrentMessages ?? 4,
@@ -803,6 +1128,9 @@ export class UnifiedEmailServer extends EventEmitter {
       this.bounceManager.stop();
       logger.log('info', 'Bounce manager stopped');
 
+      this.rateLimiter.stop();
+      logger.log('info', 'Rate limiter stopped');
+
       // Close all Rust SMTP client connection pools
       try {
         await this.rustBridge.closeSmtpPool();
@@ -835,16 +1163,47 @@ export class UnifiedEmailServer extends EventEmitter {
       authenticatedUser: data.authenticatedUser,
     };
 
-    const hookDecision = this.options.hooks?.onRcptTo
-      ? await this.runHookWithTimeout(
+    const resolution = await this.resolveRecipientPolicy(context);
+    let decision = resolution.decision;
+    if (resolution.decision.accepted && this.options.hooks?.onRcptTo) {
+      try {
+        decision = await this.runHookWithTimeout(
           this.getRecipientValidationTimeoutMs(),
           'Recipient policy timeout',
-          (abortSignal) => this.options.hooks!.onRcptTo!({ ...context, abortSignal })
-        )
-      : await this.evaluateDefaultRcptToPolicy(context);
-    const decision = this.options.hooks?.onRcptTo
-      ? await this.enforceAcceptedRcptToRelayPolicy(context, hookDecision)
-      : hookDecision;
+          (abortSignal) => this.options.hooks!.onRcptTo!({ ...context, abortSignal }),
+        );
+      } catch (error) {
+        logger.log(
+          'error',
+          `Recipient policy callback failed for ${context.rcptTo}: ${getErrorMessage(error)}`,
+        );
+        decision = {
+          accepted: false,
+          smtpCode: 451,
+          smtpMessage: 'Recipient policy error',
+        };
+        await this.notifyRecipientRejected(context, decision, resolution, 'policy-error');
+        await this.rustBridge.sendRcptToResult({
+          correlationId: data.correlationId,
+          accepted: false,
+          smtpCode: 451,
+          smtpMessage: 'Recipient policy error',
+        });
+        return;
+      }
+    }
+
+    if (!decision.accepted) {
+      const rejectedByHook = resolution.decision.accepted;
+      await this.notifyRecipientRejected(
+        context,
+        decision,
+        resolution,
+        rejectedByHook
+          ? 'recipient-hook'
+          : resolution.rejectionReason || this.getRejectionReasonForResolution(resolution),
+      );
+    }
 
     await this.rustBridge.sendRcptToResult({
       correlationId: data.correlationId,
@@ -855,65 +1214,158 @@ export class UnifiedEmailServer extends EventEmitter {
   }
 
   private async evaluateDefaultRcptToPolicy(context: IRcptToPolicyContext): Promise<ISmtpDecision> {
+    return (await this.resolveRecipientPolicy(context)).decision;
+  }
+
+  private async resolveRecipientPolicy(
+    context: IRcptToPolicyContext,
+    emailArg?: Email,
+    sessionArg?: IExtendedSmtpSession,
+  ): Promise<IRecipientPolicyResolution> {
     const currentRecipientContext = { ...context, acceptedRcptTo: [] };
-    const email = new Email({
+    const email = emailArg || new Email({
       from: context.mailFrom || '<>',
       to: [context.rcptTo],
       subject: '',
       text: '',
     });
-    const session = this.buildPolicySession(currentRecipientContext);
+    const session = sessionArg || this.buildPolicySession(currentRecipientContext);
     const route = await this.emailRouter.evaluateRoutes({ email, session });
+    const recipientDomain = this.getAddressDomain(context.rcptTo);
+    const isLocalRecipient = !!recipientDomain && this.domainRegistry.isDomainRegistered(recipientDomain);
+    const localDomain = isLocalRecipient ? recipientDomain! : null;
+
+    if (route) {
+      if (route.action.type === 'reject') {
+        return {
+          recipient: context.rcptTo,
+          localDomain,
+          route,
+          source: 'explicit-route',
+          decision: {
+            accepted: false,
+            smtpCode: route.action.reject?.code || 550,
+            smtpMessage: route.action.reject?.message || 'Recipient rejected',
+          },
+          rejectionReason: 'explicit-route',
+        };
+      }
+
+      if (!isLocalRecipient && !route.action.allowRelay) {
+        return {
+          recipient: context.rcptTo,
+          localDomain: null,
+          route,
+          source: 'explicit-route',
+          decision: { accepted: false, smtpCode: 550, smtpMessage: 'Relay not permitted' },
+          rejectionReason: 'relay-denied',
+        };
+      }
 
-    if (!route) {
-      return { accepted: false, smtpCode: 550, smtpMessage: 'No route for recipient' };
-    }
-    if (route.action.type === 'reject') {
       return {
-        accepted: false,
-        smtpCode: route.action.reject?.code || 550,
-        smtpMessage: route.action.reject?.message || 'Recipient rejected',
+        recipient: context.rcptTo,
+        localDomain,
+        route,
+        source: 'explicit-route',
+        decision: { accepted: true, smtpCode: 250, smtpMessage: 'OK' },
       };
     }
 
-    const recipientDomain = this.getAddressDomain(context.rcptTo);
-    const isLocalRecipient = !!recipientDomain && this.domainRegistry.isDomainRegistered(recipientDomain);
-    if (!isLocalRecipient && !route.action.allowRelay) {
-      return { accepted: false, smtpCode: 550, smtpMessage: 'Relay not permitted' };
+    if (!isLocalRecipient) {
+      return {
+        recipient: context.rcptTo,
+        localDomain: null,
+        route: null,
+        source: 'no-route',
+        decision: { accepted: false, smtpCode: 550, smtpMessage: 'domain not hosted here' },
+        rejectionReason: 'domain-not-hosted',
+      };
     }
 
-    return { accepted: true, smtpCode: 250, smtpMessage: 'OK' };
-  }
-
-  private async enforceAcceptedRcptToRelayPolicy(
-    context: IRcptToPolicyContext,
-    decision: ISmtpDecision
-  ): Promise<ISmtpDecision> {
-    if (!decision.accepted) {
-      return decision;
+    const inboundPolicy = this.domainRegistry.getDomainConfig(recipientDomain!)?.inboundPolicy;
+    if (!inboundPolicy) {
+      return {
+        recipient: context.rcptTo,
+        localDomain,
+        route: null,
+        source: 'no-route',
+        decision: {
+          accepted: false,
+          smtpCode: 550,
+          smtpMessage: `no mailbox configured for ${context.rcptTo}`,
+        },
+        rejectionReason: 'no-route',
+      };
     }
 
-    const recipientDomain = this.getAddressDomain(context.rcptTo);
-    const isLocalRecipient = !!recipientDomain && this.domainRegistry.isDomainRegistered(recipientDomain);
-    if (isLocalRecipient) {
-      return decision;
+    const policyRouteName = `__smartmta_inbound_${inboundPolicy.defaultAction}:${recipientDomain}`;
+    if (inboundPolicy.defaultAction === 'reject') {
+      return {
+        recipient: context.rcptTo,
+        localDomain,
+        route: null,
+        source: 'domain-policy',
+        decision: {
+          accepted: false,
+          smtpCode: 550,
+          smtpMessage: `no mailbox configured for ${context.rcptTo}`,
+        },
+        rejectionReason: 'domain-policy',
+        policyRouteName,
+      };
     }
 
-    const currentRecipientContext = { ...context, acceptedRcptTo: [] };
-    const email = new Email({
-      from: context.mailFrom || '<>',
-      to: [context.rcptTo],
-      subject: '',
-      text: '',
-    });
-    const session = this.buildPolicySession(currentRecipientContext);
-    const route = await this.emailRouter.evaluateRoutes({ email, session });
+    return {
+      recipient: context.rcptTo,
+      localDomain,
+      route: {
+        name: policyRouteName,
+        match: { recipients: `*@${recipientDomain}` },
+        action: {
+          type: 'store',
+          store: { retentionDays: inboundPolicy.retentionDays },
+        },
+      },
+      source: 'domain-policy',
+      decision: { accepted: true, smtpCode: 250, smtpMessage: 'OK' },
+      policyRouteName,
+    };
+  }
 
-    if (route?.action.type !== 'reject' && route?.action.allowRelay) {
-      return decision;
-    }
+  private getRejectionReasonForResolution(
+    resolution: IRecipientPolicyResolution,
+  ): TRecipientRejectionReason {
+    if (resolution.source === 'explicit-route') return 'explicit-route';
+    if (resolution.source === 'domain-policy') return 'domain-policy';
+    return resolution.localDomain ? 'no-route' : 'domain-not-hosted';
+  }
+
+  private async notifyRecipientRejected(
+    context: IRcptToPolicyContext,
+    decision: ISmtpDecision,
+    resolution: IRecipientPolicyResolution,
+    reason: TRecipientRejectionReason,
+  ): Promise<void> {
+    const event: IRecipientRejectedEvent = {
+      timestamp: new Date().toISOString(),
+      sender: context.mailFrom,
+      recipient: context.rcptTo,
+      localDomain: resolution.localDomain,
+      remoteAddress: context.remoteAddress,
+      smtpCode: decision.smtpCode || 550,
+      smtpMessage: decision.smtpMessage || 'Recipient rejected',
+      routeName: resolution.route?.name || resolution.policyRouteName || null,
+      reason,
+    };
 
-    return { accepted: false, smtpCode: 550, smtpMessage: 'Relay not permitted' };
+    if (this.options.hooks?.onRecipientRejected) {
+      await callObserverSafely(
+        'recipientRejected callback',
+        this.options.hooks.onRecipientRejected,
+        event,
+      );
+    }
+    await emitSafely(this, 'recipientRejected', event);
   }
 
   private buildPolicySession(context: IRcptToPolicyContext): IExtendedSmtpSession {
@@ -986,6 +1438,130 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  /** Build a route-evaluation view containing only the current SMTP envelope recipient. */
+  private cloneEmailForRoutingRecipient(email: Email, recipient: string): Email {
+    return new Email({
+      from: email.from,
+      to: [recipient],
+      cc: [],
+      bcc: [],
+      subject: email.subject,
+      text: email.text,
+      html: email.html,
+      attachments: email.attachments,
+      headers: { ...email.headers },
+      mightBeSpam: email.mightBeSpam,
+      priority: email.priority,
+      variables: { ...email.variables },
+    });
+  }
+
+  private scopeSessionForRoutingRecipient(
+    session: IExtendedSmtpSession,
+    recipient: string,
+  ): IExtendedSmtpSession {
+    return {
+      ...session,
+      rcptTo: [recipient],
+      envelope: {
+        mailFrom: { ...session.envelope.mailFrom },
+        rcptTo: [{ address: recipient, args: {} }],
+      },
+      matchedRoute: undefined,
+      resolvedRecipientRoutes: undefined,
+    };
+  }
+
+  private buildDataPolicyContext(
+    session: IExtendedSmtpSession,
+    recipient: string,
+  ): IRcptToPolicyContext {
+    return {
+      sessionId: session.id,
+      mailFrom: session.envelope.mailFrom.address,
+      rcptTo: recipient,
+      acceptedRcptTo: session.envelope.rcptTo
+        .map((entry) => entry.address)
+        .filter((address) => address !== recipient),
+      remoteAddress: session.remoteAddress || '',
+      clientHostname: session.clientHostname || null,
+      secure: !!session.secure,
+      authenticated: !!session.authenticated,
+      authenticatedUser: session.user?.username || null,
+    };
+  }
+
+  private async resolveDataRecipientRoutes(
+    email: Email,
+    session: IExtendedSmtpSession,
+  ): Promise<IRecipientPolicyResolution[]> {
+    const resolutions: IRecipientPolicyResolution[] = [];
+    for (const envelopeRecipient of session.envelope.rcptTo) {
+      const recipient = envelopeRecipient.address;
+      const scopedEmail = this.cloneEmailForRoutingRecipient(email, recipient);
+      const scopedSession = this.scopeSessionForRoutingRecipient(session, recipient);
+      resolutions.push(await this.resolveRecipientPolicy(
+        this.buildDataPolicyContext(session, recipient),
+        scopedEmail,
+        scopedSession,
+      ));
+    }
+
+    session.resolvedRecipientRoutes = resolutions.map((resolution) => ({
+      recipient: resolution.recipient,
+      localDomain: resolution.localDomain,
+      route: resolution.route,
+      source: resolution.source,
+    }));
+    const routeNames = new Set(
+      session.resolvedRecipientRoutes.map((resolution) => resolution.route?.name || ''),
+    );
+    if (routeNames.size === 1) {
+      session.matchedRoute = session.resolvedRecipientRoutes[0]?.route || undefined;
+    }
+    return resolutions;
+  }
+
+  private async acceptDurableEnvelope(
+    email: Email,
+    rawMessage: Buffer,
+    session: IExtendedSmtpSession,
+  ): Promise<void> {
+    const onAcceptEnvelope = this.options.hooks?.onAcceptEnvelope;
+    if (!onAcceptEnvelope) {
+      throw new Error('No durable onAcceptEnvelope hook is configured');
+    }
+
+    let hookContext: IAcceptEnvelopeContext | undefined;
+    await this.runHookWithTimeout(
+      this.getMessageAcceptanceTimeoutMs(),
+      'Envelope acceptance timeout',
+      (abortSignal) => {
+        hookContext = {
+          email,
+          rawMessage,
+          session,
+          envelope: {
+            mailFrom: session.envelope.mailFrom.address,
+            rcptTo: session.envelope.rcptTo.map((recipient) => recipient.address),
+          },
+          resolvedRecipientRoutes: session.resolvedRecipientRoutes || [],
+          attachmentCount: email.attachments.length,
+          securityResults: session.securityResults ?? null,
+          abortSignal,
+        };
+        return onAcceptEnvelope(hookContext);
+      },
+      () => {
+        if (hookContext) {
+          hookContext.rawMessage = Buffer.alloc(0);
+          (hookContext as any).email = undefined;
+          (hookContext as any).session = undefined;
+        }
+      },
+    );
+  }
+
   /**
    * Handle an emailReceived event from the Rust SMTP server.
    */
@@ -1013,18 +1589,71 @@ export class UnifiedEmailServer extends EventEmitter {
           mailFrom: { address: mailFrom, args: {} },
           rcptTo: rcptTo.map(addr => ({ address: addr, args: {} })),
         },
+        securityResults: data.securityResults,
       };
 
       if (authenticatedUser) {
         session.user = { username: authenticatedUser };
       }
 
-      // Attach pre-computed security results from Rust in-process pipeline
-      if (data.securityResults) {
-        (session as any)._precomputedSecurityResults = data.securityResults;
-      }
 
       const email = await this.createEmailFromBuffer(rawMessageBuffer, session);
+      const resolvedRecipientRoutes = await this.resolveDataRecipientRoutes(email, session);
+      const rejectedRecipients = resolvedRecipientRoutes.filter(
+        (resolution) => !resolution.decision.accepted,
+      );
+      if (rejectedRecipients.length > 0) {
+        for (const rejection of rejectedRecipients) {
+          await this.notifyRecipientRejected(
+            this.buildDataPolicyContext(session, rejection.recipient),
+            rejection.decision,
+            rejection,
+            rejection.rejectionReason || this.getRejectionReasonForResolution(rejection),
+          );
+        }
+        const primaryRejection = rejectedRecipients[0];
+        await this.rustBridge.sendEmailProcessingResult({
+          correlationId,
+          accepted: false,
+          smtpCode: primaryRejection.decision.smtpCode || 550,
+          smtpMessage: primaryRejection.decision.smtpMessage || 'Message not accepted',
+        });
+        return;
+      }
+
+      const hasStoreRoute = resolvedRecipientRoutes.some(
+        (resolution) => resolution.route?.action.type === 'store',
+      );
+      if (hasStoreRoute) {
+        try {
+          await this.acceptDurableEnvelope(
+            email,
+            rawMessageBuffer,
+            session,
+          );
+        } catch (acceptanceError) {
+          logger.log(
+            'error',
+            `Durable envelope acceptance failed: ${(acceptanceError as Error).message}`,
+          );
+          await this.rustBridge.sendEmailProcessingResult({
+            correlationId,
+            accepted: false,
+            smtpCode: 451,
+            smtpMessage: 'Envelope acceptance temporarily unavailable',
+          });
+          return;
+        }
+
+        await this.rustBridge.sendEmailProcessingResult({
+          correlationId,
+          accepted: true,
+          smtpCode: 250,
+          smtpMessage: '2.0.0 Message accepted for delivery',
+        });
+        return;
+      }
+
       let acceptanceDecision: IMessageAcceptanceDecision | undefined;
       if (this.options.hooks?.onMessageData) {
         let hookContext: IMessageAcceptanceContext | undefined;
@@ -1037,6 +1666,8 @@ export class UnifiedEmailServer extends EventEmitter {
                 email,
                 rawMessage: rawMessageBuffer,
                 session,
+                matchedRoute: session.matchedRoute,
+                resolvedRecipientRoutes: session.resolvedRecipientRoutes || [],
                 abortSignal,
               };
               return this.options.hooks!.onMessageData!(hookContext);
@@ -1257,28 +1888,28 @@ export class UnifiedEmailServer extends EventEmitter {
   private async verifyInboundSecurity(email: Email, session: IExtendedSmtpSession): Promise<void> {
     try {
       // Check for pre-computed results from Rust in-process security pipeline
-      const precomputed = (session as any)._precomputedSecurityResults;
-      let result: any;
+      const precomputed = session.securityResults;
 
       if (precomputed) {
         logger.log('info', 'Using pre-computed security results from Rust in-process pipeline');
-        result = precomputed;
-      } else {
+      }
+      const result: IInboundEmailSecurityResult | IEmailSecurityResult =
+        precomputed || await (async () => {
         // Fallback: IPC round-trip to Rust (for backward compat)
         const rawMessage = session.emailData || email.toRFC822String();
-        result = await this.rustBridge.verifyEmail({
+        return this.rustBridge.verifyEmail({
           rawMessage,
           ip: session.remoteAddress,
           heloDomain: session.clientHostname || '',
           hostname: this.options.hostname,
           mailFrom: session.envelope?.mailFrom?.address || session.mailFrom || '',
         });
-      }
+      })();
 
       // Apply DKIM result headers
       if (result.dkim && result.dkim.length > 0) {
         const dkimSummary = result.dkim
-          .map((d: any) => `${d.status}${d.domain ? ` (${d.domain})` : ''}`)
+          .map((d) => `${d.status}${d.domain ? ` (${d.domain})` : ''}`)
           .join(', ');
         email.addHeader('X-DKIM-Result', dkimSummary);
       }
@@ -1308,8 +1939,8 @@ export class UnifiedEmailServer extends EventEmitter {
       }
 
       // Apply content scan results (from pre-computed pipeline)
-      if (result.contentScan) {
-        const scan = result.contentScan;
+      if (precomputed?.contentScan) {
+        const scan = precomputed.contentScan;
         if (scan.threatScore > 0) {
           email.addHeader('X-Spam-Score', String(scan.threatScore));
           if (scan.threatType) {
@@ -1323,8 +1954,8 @@ export class UnifiedEmailServer extends EventEmitter {
       }
 
       // Apply IP reputation results (from pre-computed pipeline)
-      if (result.ipReputation) {
-        const rep = result.ipReputation;
+      if (precomputed?.ipReputation) {
+        const rep = precomputed.ipReputation;
         email.addHeader('X-IP-Reputation-Score', String(rep.score));
         if (rep.is_spam) {
           email.mightBeSpam = true;