@serve.zone/dcrouter 18.2.1 → 18.4.0

package/ts/email/classes.accepted-email-spool.ts

@@ -18,58 +18,11 @@ import type {
   UnifiedEmailServer,
 } from '@push.rocks/smartmta';
 import type { DcRouter } from '../classes.dcrouter.js';
-
-
-/** Inbound authentication verdict evaluation for acceptance semantics. */
-export interface IInboundAcceptanceEvaluation {
-  status: 'accepted' | 'flagged';
-  doubts: string[];
-  dmarcReject: boolean;
-  dmarcDomain?: string;
-}
-
-export function evaluateInboundAcceptance(securityResults: any): IInboundAcceptanceEvaluation {
-  const doubts: string[] = [];
-  let dmarcReject = false;
-  let dmarcDomain: string | undefined;
-
-  // Infrastructure failures (temperror, resolver problems) are OUR problem,
-  // not evidence against the sender — they never produce doubts.
-  const spfResult = String(securityResults?.spf?.result || '').toLowerCase();
-  if (spfResult === 'fail' || spfResult === 'softfail') {
-    doubts.push(`SPF ${spfResult} for ${securityResults?.spf?.domain || 'sender domain'}`);
-  }
-
-  // The verdict bridge emits a placeholder entry (status 'none') when a
-  // message carries no DKIM signature at all; only real failed signatures
-  // count as doubts.
-  const dkimSignatures = (Array.isArray(securityResults?.dkim) ? securityResults.dkim : [])
-    .filter((signature: any) => String(signature?.status || '').toLowerCase() !== 'none');
-  if (dkimSignatures.length > 0 && !dkimSignatures.some((signature: any) => signature?.is_valid)) {
-    doubts.push('DKIM signature(s) present but none verified');
-  }
-
-  // DMARC only matters when the sender domain publishes an enforcing policy;
-  // absent records surface as policy 'none' and are not doubts.
-  const dmarc = securityResults?.dmarc;
-  if (dmarc && dmarc.passed === false) {
-    const policy = String(dmarc.policy || '').toLowerCase();
-    const action = String(dmarc.action || '').toLowerCase();
-    if (policy === 'reject' || policy === 'quarantine' || action === 'reject' || action === 'quarantine') {
-      dmarcDomain = dmarc.domain || undefined;
-      if (action === 'reject' || policy === 'reject') {
-        dmarcReject = true;
-      }
-      doubts.push(`DMARC failed for ${dmarc.domain || 'sender domain'} (policy ${dmarc.policy || 'unknown'})`);
-    }
-  }
-  return {
-    status: doubts.length > 0 ? 'flagged' : 'accepted',
-    doubts,
-    dmarcReject,
-    dmarcDomain,
-  };
-}
+import { evaluateInboundAcceptance } from './helpers.inbound-security.js';
+export {
+  evaluateInboundAcceptance,
+  type IInboundAcceptanceEvaluation,
+} from './helpers.inbound-security.js';
 
 export const DCROUTER_CACHE_ID_HEADER = 'X-Dcrouter-Cached-Email-Id';
 const ACCEPTED_EMAIL_SPOOL_INTERVAL_MS = 60_000;
@@ -452,7 +405,21 @@ export class AcceptedEmailSpool {
     const plan = emailServer.createAcceptedEnvelopeDispatchPlan(context, idempotencyKeys);
     const nonStoreEntries = plan.filter((entry) => entry.action.type !== 'store');
 
-    const acceptance = evaluateInboundAcceptance(context.securityResults);
+    cachedEmail.direction = this.deriveDirectionFromResolvedRoutes(
+      context.resolvedRecipientRoutes,
+      context.envelope.rcptTo,
+    );
+    // Submission/relay authentication is not a receiver verdict. Only locally
+    // received mail is classified or enforced here; outbound mail gets its
+    // post-signing, actual-egress self-check from the delivery transaction.
+    const acceptance = evaluateInboundAcceptance(
+      cachedEmail.direction === 'inbound' ? context.securityResults : null,
+    );
+    if (cachedEmail.direction === 'inbound' && context.securityResults) {
+      cachedEmail.inboundSecurityDisposition = acceptance.dmarcReject
+        ? 'rejected'
+        : acceptance.status;
+    }
     const startedAtMs = Date.now();
 
     const persistedRawMessage = this.setDcRouterCacheIdHeader(
@@ -460,10 +427,6 @@ export class AcceptedEmailSpool {
       cachedEmail.id,
     );
     await this.persistRawMessage(cachedEmail, persistedRawMessage);
-    cachedEmail.direction = this.deriveDirectionFromResolvedRoutes(
-      context.resolvedRecipientRoutes,
-      context.envelope.rcptTo,
-    );
     cachedEmail.acceptedAt = startedAtMs;
 
     if (acceptance.dmarcReject) {
@@ -493,12 +456,9 @@ export class AcceptedEmailSpool {
       throw new AcceptEnvelopeRejectionError(550, rejectionMessage);
     }
 
-    if (acceptance.status === 'flagged') {
-      cachedEmail.status = 'flagged';
-      cachedEmail.lastError = acceptance.doubts.join('; ');
-    } else {
-      cachedEmail.status = 'accepted';
-    }
+    // Security disposition is orthogonal to the delivery lifecycle. The Ops
+    // API synthesizes the visible flagged badge from inboundSecurityDisposition.
+    cachedEmail.status = 'accepted';
     if (nonStoreEntries.length > 0) {
       // Relay recipients are dispatched after this row is committed. Park the
       // row in a status the spool actually scans so a crash between the commit
@@ -704,12 +664,11 @@ export class AcceptedEmailSpool {
       cachedEmail.routeData = JSON.stringify(routeData);
 
       const stillPending = outcomeArg.pendingRecipients.length > 0;
-      const acceptanceStatus = cachedEmail.lastError && !stillPending ? 'flagged' : 'accepted';
       if (stillPending) {
         cachedEmail.status = 'deferred';
         cachedEmail.nextAttempt = new Date(Date.now() + ENVELOPE_DISPATCH_RETRY_DELAY_MS);
       } else if (cachedEmail.status === 'deferred') {
-        cachedEmail.status = acceptanceStatus;
+        cachedEmail.status = 'accepted';
         cachedEmail.nextAttempt = new Date();
       }
       await cachedEmail.save();
@@ -748,7 +707,7 @@ export class AcceptedEmailSpool {
     // Nothing left to dispatch: settle the row back onto its acceptance status
     // so a fully dispatched envelope does not linger as deferred.
     if (cachedEmailArg.status === 'deferred') {
-      cachedEmailArg.status = cachedEmailArg.lastError ? 'flagged' : 'accepted';
+      cachedEmailArg.status = 'accepted';
       cachedEmailArg.nextAttempt = new Date();
       await cachedEmailArg.save();
       await this.notifyEmailQueuePersisted(cachedEmailArg, 'envelope-dispatch-settled');

package/ts/email/classes.mail-egress-coordinator.ts

@@ -134,6 +134,14 @@ export class MailEgressCoordinator {
       connectPort: proxy.listenPort,
       poolKey: `remoteIngress:${proxy.edgeId}:${context.host}:${context.port}`,
       ehloHostname: selected.hostname,
+      sourceEvidence: tunnelManager.waitForEgressConnectionEvidence(proxy.proxyId, proxy.edgeId)
+        .then((eventArg) => {
+          if (!eventArg?.sourceIp || !eventArg.addressFamily) return null;
+          return {
+            sourceIp: eventArg.sourceIp,
+            addressFamily: eventArg.addressFamily,
+          };
+        }),
       close: async () => {
         if (closed) {
           return;

package/ts/email/helpers.email-log-traffic.ts

@@ -0,0 +1,117 @@
+import type {
+  IEmail,
+  IEmailLogTraffic,
+  TEmailLogTrafficWindow,
+} from '../../ts_interfaces/requests/email-ops.js';
+
+const MINUTE_MS = 60_000;
+const HOUR_MS = 60 * MINUTE_MS;
+const DAY_MS = 24 * HOUR_MS;
+export const EMAIL_LOG_RETENTION_MS = 30 * DAY_MS;
+export const EMAIL_LOG_SEARCH_MAX_LENGTH = 200;
+
+export interface IEmailLogTrafficWindowDescriptor {
+  window: TEmailLogTrafficWindow;
+  label: string;
+  durationMs: number;
+  bucketSizeMs: number;
+}
+
+export interface IEmailLogSparseTrafficBucket {
+  bucketStart: number;
+  sent: number;
+  received: number;
+  failed: number;
+}
+
+const trafficWindows: IEmailLogTrafficWindowDescriptor[] = [
+  { window: '24h', label: 'Email Traffic — Last 24 Hours', durationMs: DAY_MS, bucketSizeMs: MINUTE_MS },
+  { window: '7d', label: 'Email Traffic — Last 7 Days', durationMs: 7 * DAY_MS, bucketSizeMs: 15 * MINUTE_MS },
+  { window: '14d', label: 'Email Traffic — Last 14 Days', durationMs: 14 * DAY_MS, bucketSizeMs: 30 * MINUTE_MS },
+  { window: '30d', label: 'Email Traffic — Last 30 Days', durationMs: 30 * DAY_MS, bucketSizeMs: HOUR_MS },
+];
+
+export function normalizeEmailLogSearch(searchArg: unknown): string {
+  if (searchArg === undefined || searchArg === null) return '';
+  if (typeof searchArg !== 'string') {
+    throw new Error('Email log search must be a string');
+  }
+  const search = searchArg.trim();
+  if (search.length > EMAIL_LOG_SEARCH_MAX_LENGTH) {
+    throw new Error(`Email log search accepts at most ${EMAIL_LOG_SEARCH_MAX_LENGTH} characters`);
+  }
+  return search;
+}
+
+export function selectEmailLogTrafficWindow(
+  searchArg: string,
+  oldestMatchAtArg: number | null,
+  nowArg = Date.now(),
+): IEmailLogTrafficWindowDescriptor {
+  if (!searchArg || oldestMatchAtArg === null || !Number.isFinite(oldestMatchAtArg)) {
+    return trafficWindows[0];
+  }
+  return trafficWindows.find((window) => {
+    const lastBucketStart = Math.floor(nowArg / window.bucketSizeMs) * window.bucketSizeMs;
+    const windowStart = lastBucketStart - window.durationMs + window.bucketSizeMs;
+    return oldestMatchAtArg >= windowStart;
+  }) || trafficWindows.at(-1)!;
+}
+
+export function buildEmailLogTraffic(
+  descriptorArg: IEmailLogTrafficWindowDescriptor,
+  sparseBucketsArg: IEmailLogSparseTrafficBucket[],
+  nowArg = Date.now(),
+): IEmailLogTraffic {
+  const lastBucketStart = Math.floor(nowArg / descriptorArg.bucketSizeMs) * descriptorArg.bucketSizeMs;
+  const windowStart = lastBucketStart - descriptorArg.durationMs + descriptorArg.bucketSizeMs;
+  const bucketsByStart = new Map(
+    sparseBucketsArg.map((bucket) => [bucket.bucketStart, bucket]),
+  );
+  const sent: IEmailLogTraffic['sent'] = [];
+  const received: IEmailLogTraffic['received'] = [];
+  const failed: IEmailLogTraffic['failed'] = [];
+  for (
+    let timestamp = windowStart;
+    timestamp <= lastBucketStart;
+    timestamp += descriptorArg.bucketSizeMs
+  ) {
+    const bucket = bucketsByStart.get(timestamp);
+    sent.push({ timestamp, value: Math.max(0, Number(bucket?.sent || 0)) });
+    received.push({ timestamp, value: Math.max(0, Number(bucket?.received || 0)) });
+    failed.push({ timestamp, value: Math.max(0, Number(bucket?.failed || 0)) });
+  }
+  return {
+    ...descriptorArg,
+    windowStart,
+    windowEnd: nowArg,
+    sent,
+    received,
+    failed,
+  };
+}
+
+export function aggregateEmailLogTrafficInMemory(
+  emailsArg: IEmail[],
+  descriptorArg: IEmailLogTrafficWindowDescriptor,
+  nowArg = Date.now(),
+): IEmailLogSparseTrafficBucket[] {
+  const lastBucketStart = Math.floor(nowArg / descriptorArg.bucketSizeMs) * descriptorArg.bucketSizeMs;
+  const windowStart = lastBucketStart - descriptorArg.durationMs + descriptorArg.bucketSizeMs;
+  const buckets = new Map<number, IEmailLogSparseTrafficBucket>();
+  for (const email of emailsArg) {
+    const timestamp = new Date(email.timestamp).getTime();
+    if (!Number.isFinite(timestamp) || timestamp < windowStart || timestamp > nowArg) continue;
+    const bucketStart = Math.floor(timestamp / descriptorArg.bucketSizeMs) * descriptorArg.bucketSizeMs;
+    const bucket = buckets.get(bucketStart) || { bucketStart, sent: 0, received: 0, failed: 0 };
+    if (email.status === 'bounced' || email.status === 'rejected') {
+      bucket.failed++;
+    } else if (email.direction === 'outbound') {
+      bucket.sent++;
+    } else {
+      bucket.received++;
+    }
+    buckets.set(bucketStart, bucket);
+  }
+  return [...buckets.values()].sort((a, b) => a.bucketStart - b.bucketStart);
+}

package/ts/email/helpers.inbound-security.ts

@@ -0,0 +1,45 @@
+/** Inbound authentication verdict evaluation shared by SMTP acceptance and ops reporting. */
+export interface IInboundAcceptanceEvaluation {
+  status: 'accepted' | 'flagged';
+  doubts: string[];
+  dmarcReject: boolean;
+  dmarcDomain?: string;
+}
+
+export function evaluateInboundAcceptance(securityResults: any): IInboundAcceptanceEvaluation {
+  const doubts: string[] = [];
+  let dmarcReject = false;
+  let dmarcDomain: string | undefined;
+
+  // Infrastructure failures are our problem, not evidence against the sender.
+  const spfResult = String(securityResults?.spf?.result || '').toLowerCase();
+  if (spfResult === 'fail' || spfResult === 'softfail') {
+    doubts.push(`SPF ${spfResult} for ${securityResults?.spf?.domain || 'sender domain'}`);
+  }
+
+  // Ignore the placeholder emitted when no DKIM signature exists.
+  const dkimSignatures = (Array.isArray(securityResults?.dkim) ? securityResults.dkim : [])
+    .filter((signature: any) => String(signature?.status || '').toLowerCase() !== 'none');
+  if (dkimSignatures.length > 0 && !dkimSignatures.some((signature: any) => signature?.is_valid)) {
+    doubts.push('DKIM signature(s) present but none verified');
+  }
+
+  // A failed DMARC alignment is a security finding even when the sender
+  // publishes p=none. Policy controls enforcement, not the authentication result.
+  const dmarc = securityResults?.dmarc;
+  if (dmarc && dmarc.passed === false) {
+    const policy = String(dmarc.policy || '').toLowerCase();
+    const action = String(dmarc.action || '').toLowerCase();
+    dmarcDomain = dmarc.domain || undefined;
+    if (action === 'reject' || policy === 'reject') {
+      dmarcReject = true;
+    }
+    doubts.push(`DMARC failed for ${dmarc.domain || 'sender domain'} (policy ${dmarc.policy || 'unknown'})`);
+  }
+  return {
+    status: doubts.length > 0 ? 'flagged' : 'accepted',
+    doubts,
+    dmarcReject,
+    dmarcDomain,
+  };
+}

package/ts/email/index.ts

@@ -15,3 +15,5 @@ export * from './classes.smtp-account.manager.js';
 export * from './smtp-scram.js';
 export * from './classes.workapp-mail-manager.js';
 export * from './email-dns-records.js';
+export * from './helpers.email-log-traffic.js';
+export * from './helpers.inbound-security.js';

package/ts/opsserver/handlers/email-ops.handler.ts

@@ -3,6 +3,14 @@ import type { OpsServer } from '../classes.opsserver.js';
 import * as interfaces from '../../../ts_interfaces/index.js';
 import { requireOpsAuth } from '../helpers/auth.js';
 import { CachedEmail } from '../../db/index.js';
+import {
+  aggregateEmailLogTrafficInMemory,
+  buildEmailLogTraffic,
+  EMAIL_LOG_RETENTION_MS,
+  normalizeEmailLogSearch,
+  selectEmailLogTrafficWindow,
+} from '../../email/helpers.email-log-traffic.js';
+import { evaluateInboundAcceptance } from '../../email/helpers.inbound-security.js';
 
 export class EmailOpsHandler {
   constructor(private opsServerRef: OpsServer) {
@@ -21,12 +29,29 @@ export class EmailOpsHandler {
         'getAllEmails',
         async (dataArg) => {
           await requireOpsAuth(this.opsServerRef, dataArg, { scope: 'emails:read' });
-          const emails = await this.getAllEmails(dataArg.direction, dataArg.limit);
-          return { emails };
+          return await this.getEmailLogSnapshot(
+            dataArg.direction,
+            dataArg.limit,
+            dataArg.search,
+            dataArg.from,
+            dataArg.to,
+          );
         }
       )
     );
 
+    viewRouter.addTypedHandler(
+      new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetEmailSecurityFindings>(
+        'getEmailSecurityFindings',
+        async (dataArg) => {
+          await requireOpsAuth(this.opsServerRef, dataArg, { scope: 'emails:read' });
+          return {
+            findings: await this.getEmailSecurityFindings(dataArg.limit),
+          };
+        },
+      ),
+    );
+
     // Get Email Detail Handler
     viewRouter.addTypedHandler(
       new plugins.typedrequest.TypedHandler<interfaces.requests.IReq_GetEmailDetail>(
@@ -92,10 +117,19 @@ export class EmailOpsHandler {
   private async getAllEmails(
     direction?: interfaces.requests.TEmailDirection,
     limitArg?: number,
+    searchArg?: string,
+    fromArg?: number,
+    toArg?: number,
   ): Promise<interfaces.requests.IEmail[]> {
     const limit = Math.min(Math.max(Math.floor(limitArg ?? 200), 1), 1000);
+    const search = normalizeEmailLogSearch(searchArg);
+    const range = this.normalizeEmailLogRange(fromArg, toArg);
     const cachedDocs = this.isCachedEmailStoreAvailable()
-      ? await CachedEmail.findRecent(limit, { direction })
+      ? await CachedEmail.findRecent(limit, {
+          direction,
+          search: search || undefined,
+          ...(range || {}),
+        })
       : [];
     const emails = cachedDocs.map((doc) => this.mapCachedEmailToEmail(doc));
     const representedIds = new Set(cachedDocs.map((doc) => doc.id));
@@ -110,7 +144,14 @@ export class EmailOpsHandler {
         if (cachedId && representedIds.has(cachedId)) {
           continue;
         }
-        emails.push(this.mapQueueItemToEmail(item));
+        const email = this.mapQueueItemToEmail(item);
+        const emailTimestamp = new Date(email.timestamp).getTime();
+        if (
+          this.matchesEmailSearch(email, search)
+          && (!range || (emailTimestamp >= range.from && emailTimestamp <= range.to))
+        ) {
+          emails.push(email);
+        }
       }
     }
 
@@ -120,6 +161,116 @@ export class EmailOpsHandler {
     return emails.slice(0, limit);
   }
 
+  private async getEmailLogSnapshot(
+    direction?: interfaces.requests.TEmailDirection,
+    limitArg?: number,
+    searchArg?: string,
+    fromArg?: number,
+    toArg?: number,
+  ): Promise<interfaces.requests.IReq_GetAllEmails['response']> {
+    const search = normalizeEmailLogSearch(searchArg);
+    const now = Date.now();
+    const storeAvailable = this.isCachedEmailStoreAvailable();
+    const filter = { direction, search: search || undefined };
+    const emails = await this.getAllEmails(direction, limitArg, search, fromArg, toArg);
+    const trafficContextEmails = !storeAvailable && (fromArg !== undefined || toArg !== undefined)
+      ? await this.getAllEmails(direction, 1000, search)
+      : emails;
+
+    let oldestMatchAt: number | null = null;
+    if (search) {
+      oldestMatchAt = storeAvailable
+        ? await CachedEmail.findOldestAcceptedAt(filter, now - EMAIL_LOG_RETENTION_MS)
+        : trafficContextEmails.reduce<number | null>((oldest, email) => {
+            const timestamp = new Date(email.timestamp).getTime();
+            if (!Number.isFinite(timestamp)) return oldest;
+            return oldest === null ? timestamp : Math.min(oldest, timestamp);
+          }, null);
+    }
+
+    const descriptor = selectEmailLogTrafficWindow(search, oldestMatchAt, now);
+    const emptyTraffic = buildEmailLogTraffic(descriptor, [], now);
+    const sparseTraffic = storeAvailable
+      ? await CachedEmail.aggregateEmailLogTraffic(
+          filter,
+          emptyTraffic.windowStart,
+          emptyTraffic.windowEnd,
+          descriptor.bucketSizeMs,
+        )
+      : aggregateEmailLogTrafficInMemory(trafficContextEmails, descriptor, now);
+
+    return {
+      emails,
+      traffic: buildEmailLogTraffic(descriptor, sparseTraffic, now),
+    };
+  }
+
+  private normalizeEmailLogRange(
+    fromArg?: number,
+    toArg?: number,
+  ): { from: number; to: number } | undefined {
+    if (fromArg === undefined && toArg === undefined) return undefined;
+    const now = Date.now();
+    if (
+      !Number.isSafeInteger(fromArg)
+      || !Number.isSafeInteger(toArg)
+      || (fromArg as number) < now - EMAIL_LOG_RETENTION_MS
+      || (toArg as number) > now + 60_000
+      || (toArg as number) < (fromArg as number)
+    ) {
+      throw new plugins.typedrequest.TypedResponseError(
+        'Email log time range is invalid or outside retention.',
+      );
+    }
+    return { from: fromArg as number, to: toArg as number };
+  }
+
+  private async getEmailSecurityFindings(
+    limitArg?: number,
+  ): Promise<interfaces.requests.IEmailSecurityFinding[]> {
+    if (!this.isCachedEmailStoreAvailable()) return [];
+    const limit = Math.min(Math.max(Math.floor(limitArg ?? 200), 1), 200);
+    const candidates = await CachedEmail.findRecentSecurityCandidates(
+      Math.min(limit * 5, 1000),
+      Date.now() - EMAIL_LOG_RETENTION_MS,
+    );
+    const findings: interfaces.requests.IEmailSecurityFinding[] = [];
+    for (const candidate of candidates) {
+      let securityResults: unknown;
+      try {
+        securityResults = JSON.parse(candidate.inboundSecurityResults || '');
+      } catch {
+        continue;
+      }
+      const evaluation = evaluateInboundAcceptance(securityResults);
+      if (evaluation.doubts.length === 0) continue;
+      findings.push({
+        id: candidate.id,
+        timestamp: new Date(candidate.acceptedAt || 0).toISOString(),
+        from: candidate.from || '',
+        to: (candidate.to || []).join(', '),
+        subject: candidate.subject || '',
+        disposition: candidate.status === 'rejected' || evaluation.dmarcReject
+          ? 'rejected'
+          : 'flagged',
+        failures: evaluation.doubts,
+        failureSummary: evaluation.doubts.join('; '),
+      });
+      if (findings.length >= limit) break;
+    }
+    return findings;
+  }
+
+  private matchesEmailSearch(
+    emailArg: interfaces.requests.IEmail,
+    searchArg: string,
+  ): boolean {
+    if (!searchArg) return true;
+    const search = searchArg.toLowerCase();
+    return [emailArg.from, emailArg.to, emailArg.subject, emailArg.messageId]
+      .some((value) => value.toLowerCase().includes(search));
+  }
+
   /**
    * Get a single email detail by ID — live queue item first (freshest state),
    * else the durable CachedEmail row (covers inbound + historical mail).
@@ -149,10 +300,15 @@ export class EmailOpsHandler {
    * Map a CachedEmail row to catalog IEmail format
    */
   private mapCachedEmailToEmail(doc: CachedEmail): interfaces.requests.IEmail {
+    const mappedStatus = this.mapStatus(doc.status);
     return {
       id: doc.id,
       direction: doc.direction,
-      status: this.mapStatus(doc.status),
+      status: doc.direction === 'inbound'
+        && mappedStatus === 'accepted'
+        && doc.inboundSecurityDisposition === 'flagged'
+        ? 'flagged'
+        : mappedStatus,
       from: doc.from || '',
       to: doc.to?.[0] || '',
       subject: doc.subject || '',
@@ -183,9 +339,13 @@ export class EmailOpsHandler {
     // Display SmartMTA's true retry schedule — doc.nextAttempt is the spool's
     // recovery lease (retry time + 30min grace), not the user-facing countdown.
     const nextAttemptMs = doc.smartMtaNextAttempt ? new Date(doc.smartMtaNextAttempt).getTime() : NaN;
+    const outboundAuthentication = doc.direction === 'outbound'
+      ? this.getLatestOutboundAuthentication(doc.smtpTransactions || [])
+      : undefined;
     return {
       ...base,
       smtpTransactions: structuredClone(doc.smtpTransactions || []),
+      ...(outboundAuthentication ? { outboundAuthentication } : {}),
       ...(base.status === 'deferred' && Number.isFinite(nextAttemptMs) && nextAttemptMs > 0
         ? {
             nextAttemptAt: nextAttemptMs,
@@ -206,7 +366,9 @@ export class EmailOpsHandler {
         authMethod: '',
         authUser: this.extractSessionUser(session),
       },
-      authenticationResults: this.mapInboundSecurityResults(doc.inboundSecurityResults),
+      authenticationResults: outboundAuthentication
+        ? this.mapOutboundAuthenticationResults(outboundAuthentication)
+        : this.mapInboundSecurityResults(doc.inboundSecurityResults),
       rejectionReason: doc.status === 'failed' ? doc.lastError : undefined,
       bounceMessage: doc.status === 'failed' ? doc.lastError : undefined,
       headers,
@@ -337,6 +499,7 @@ export class EmailOpsHandler {
     const base = this.mapQueueItemToEmail(item);
     const processingResult = item.processingResult;
 
+    const outboundAuthentication = this.getLatestOutboundAuthentication(item.smtpTransactions || []);
     let toList: string[] = [];
     let cc: string[] = [];
     let headers: Record<string, string> = {};
@@ -359,6 +522,7 @@ export class EmailOpsHandler {
       ...base,
       smtpTransactions: structuredClone(item.smtpTransactions || []),
       toList,
+      ...(outboundAuthentication ? { outboundAuthentication } : {}),
       cc,
       smtpLog: this.flattenSmtpTransactions(item.smtpTransactions || []),
       connectionInfo: {
@@ -372,14 +536,7 @@ export class EmailOpsHandler {
         authMethod: '',
         authUser: '',
       },
-      authenticationResults: {
-        spf: 'none',
-        spfDomain: '',
-        dkim: 'none',
-        dkimDomain: '',
-        dmarc: 'none',
-        dmarcPolicy: '',
-      },
+      authenticationResults: this.mapOutboundAuthenticationResults(outboundAuthentication),
       rejectionReason: item.status === 'failed' ? item.lastError : undefined,
       bounceMessage: item.status === 'failed' ? item.lastError : undefined,
       headers,
@@ -387,6 +544,47 @@ export class EmailOpsHandler {
     };
   }
 
+  private getLatestOutboundAuthentication(
+    transactionsArg: Array<{ outboundAuthentication?: interfaces.requests.IOutboundAuthenticationCheck }>,
+  ): interfaces.requests.IOutboundAuthenticationCheck | undefined {
+    for (let index = transactionsArg.length - 1; index >= 0; index--) {
+      const authentication = transactionsArg[index]?.outboundAuthentication;
+      if (!authentication) continue;
+      return structuredClone(authentication);
+    }
+    return undefined;
+  }
+
+  private mapOutboundAuthenticationResults(
+    authenticationArg?: interfaces.requests.IOutboundAuthenticationCheck,
+  ): interfaces.requests.IEmailDetail['authenticationResults'] {
+    const noneResult: interfaces.requests.IEmailDetail['authenticationResults'] = {
+      spf: 'none',
+      spfDomain: '',
+      dkim: 'none',
+      dkimDomain: '',
+      dmarc: 'none',
+      dmarcPolicy: '',
+    };
+    if (authenticationArg?.state !== 'completed') return noneResult;
+    const dkimSignatures = (authenticationArg.dkim || [])
+      .filter((signature) => signature.status.toLowerCase() !== 'none');
+    const validDkim = dkimSignatures.find((signature) => signature.is_valid);
+    const spfValue = (authenticationArg.spf?.result || '').toLowerCase();
+    const spf = (['pass', 'fail', 'softfail', 'neutral'] as string[]).includes(spfValue)
+      ? spfValue as interfaces.requests.IAuthenticationResults['spf']
+      : 'none';
+    return {
+      spf,
+      spfDomain: authenticationArg.spf?.domain || '',
+      dkim: validDkim ? 'pass' : dkimSignatures.length > 0 ? 'fail' : 'none',
+      dkimDomain: validDkim?.domain || dkimSignatures[0]?.domain || '',
+      dmarc: authenticationArg.dmarc ? (authenticationArg.dmarc.passed ? 'pass' : 'fail') : 'none',
+      dmarcPolicy: authenticationArg.dmarc?.policy || '',
+    };
+  }
+
+
   /**
    * Map queue status to catalog TEmailStatus
    */
@@ -413,7 +611,8 @@ export class EmailOpsHandler {
       };
       const spfResult = (parsed.spf?.result || '').toLowerCase();
       const spf = (['pass', 'fail', 'softfail', 'neutral'] as const).find((value) => value === spfResult) || 'none';
-      const dkimSignatures = Array.isArray(parsed.dkim) ? parsed.dkim : [];
+      const dkimSignatures = (Array.isArray(parsed.dkim) ? parsed.dkim : [])
+        .filter((signature) => String(signature?.status || '').toLowerCase() !== 'none');
       const validSignature = dkimSignatures.find((signature) => signature?.is_valid);
       const dkim = validSignature ? 'pass' : dkimSignatures.length > 0 ? 'fail' : 'none';
       const dmarc = parsed.dmarc ? (parsed.dmarc.passed ? 'pass' : 'fail') : 'none';

package/ts/remoteingress/classes.tunnel-manager.ts

@@ -370,6 +370,20 @@ export class TunnelManager {
     return { ready: false, eligibleEdgeCount: 0, reason };
   }
 
+  /**
+   * Delegate source-bound connection evidence to the owned RemoteIngress hub.
+   */
+  public async waitForEgressConnectionEvidence(
+    proxyId: string,
+    edgeId: string,
+    timeoutMs?: number,
+  ): Promise<plugins.remoteingress.IRemoteIngressHubEgressConnectionEvent | null> {
+    if (this.stopped) {
+      return null;
+    }
+    return await this.hub.waitForEgressConnectionEvidence(proxyId, edgeId, timeoutMs);
+  }
+
   public async stopEgressTcpProxy(proxyId: string): Promise<boolean> {
     if (this.stopped) {
       return false;

package/ts_web/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.2.1',
+  version: '18.4.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }