emailengine-app 2.60.1 → 2.61.0

package/lib/bounce-detect.js

@@ -196,6 +196,11 @@ function parseDeliveryHeaders(content) {
  * @returns {Object} [returns.messageHeaders] - Headers from the original message
  */
 async function bounceDetect(sourceStream) {
+    // Validate input parameter
+    if (!sourceStream) {
+        return {};
+    }
+
     let parsed;
 
     // Use pre-parsed email if available to avoid parsing twice
@@ -209,17 +214,19 @@ async function bounceDetect(sourceStream) {
     let result = {};
 
     // Look for standard bounce attachments as defined in RFC 3464
-    let deliveryStatus = parsed.attachments.find(attachment => attachment.contentType === 'message/delivery-status');
-    let messageHeaders = parsed.attachments.find(attachment => attachment.contentType === 'text/rfc822-headers');
-    let originalMessage = parsed.attachments.find(attachment => attachment.contentType === 'message/rfc822');
+    // Use case-insensitive comparison per RFC 2045 and handle missing attachments array
+    const attachments = parsed.attachments || [];
+    let deliveryStatus = attachments.find(attachment => attachment.contentType?.toLowerCase() === 'message/delivery-status');
+    let messageHeaders = attachments.find(attachment => attachment.contentType?.toLowerCase() === 'text/rfc822-headers');
+    let originalMessage = attachments.find(attachment => attachment.contentType?.toLowerCase() === 'message/rfc822');
 
     // Zoho Mail uses non-standard content type for original message
-    let zohoOriginalMessage = parsed.attachments.find(attachment => attachment.contentType === 'text/rfc822');
+    let zohoOriginalMessage = attachments.find(attachment => attachment.contentType?.toLowerCase() === 'text/rfc822');
 
     let parsedMessageHeaders;
 
     // Handle Exchange/Outlook specific header for failed recipients
-    if (parsed.headers.has('x-failed-recipients')) {
+    if (parsed.headers && parsed.headers.has('x-failed-recipients')) {
         // Parse comma and space separated list of failed recipients
         let list = []
             .concat(parsed.headers.get('x-failed-recipients'))
@@ -236,7 +243,7 @@ async function bounceDetect(sourceStream) {
 
     // Special handling for Amazon WorkMail bounces
     // WorkMail doesn't use standard delivery-status attachments
-    if (parsed.headers.has('x-mailer')) {
+    if (parsed.headers && parsed.headers.has('x-mailer')) {
         let xMailer = []
             .concat(parsed.headers.get('x-mailer') || '')
             .shift()
@@ -280,13 +287,15 @@ async function bounceDetect(sourceStream) {
                 // Build headers object from headerLines for consistent access
                 let headers = {};
 
-                parsedOriginal.headerLines.forEach(entry => {
-                    if (!headers[entry.key]) {
-                        headers[entry.key] = [];
-                    }
-                    // Preserve the original header value (after the key and colon)
-                    headers[entry.key].push(entry.line.substring(entry.key.length + 1).trim());
-                });
+                if (parsedOriginal.headerLines && Array.isArray(parsedOriginal.headerLines)) {
+                    parsedOriginal.headerLines.forEach(entry => {
+                        if (!headers[entry.key]) {
+                            headers[entry.key] = [];
+                        }
+                        // Preserve the original header value (after the key and colon)
+                        headers[entry.key].push(entry.line.substring(entry.key.length + 1).trim());
+                    });
+                }
 
                 parsedMessageHeaders = headers;
 
@@ -296,8 +305,9 @@ async function bounceDetect(sourceStream) {
                 }
 
                 // Some bounces include delivery-status within the original message attachment
+                const originalAttachments = parsedOriginal.attachments || [];
                 if (!deliveryStatus) {
-                    deliveryStatus = parsedOriginal.attachments.find(attachment => attachment.contentType === 'message/delivery-status');
+                    deliveryStatus = originalAttachments.find(attachment => attachment.contentType?.toLowerCase() === 'message/delivery-status');
                     if (deliveryStatus) {
                         result = Object.assign(result, parseDeliveryStatus(deliveryStatus.content) || {});
                     }
@@ -305,7 +315,7 @@ async function bounceDetect(sourceStream) {
 
                 // Similarly for headers attachment
                 if (!messageHeaders) {
-                    messageHeaders = parsedOriginal.attachments.find(attachment => attachment.contentType === 'text/rfc822-headers');
+                    messageHeaders = originalAttachments.find(attachment => attachment.contentType?.toLowerCase() === 'text/rfc822-headers');
                     if (messageHeaders) {
                         result = Object.assign(result, parseDeliveryHeaders(messageHeaders.content) || {});
                     }
@@ -319,23 +329,61 @@ async function bounceDetect(sourceStream) {
     }
 
     // Handle Zoho's non-standard bounce format
+    // Zoho uses text/rfc822 content type (instead of standard message/rfc822)
+    // and includes original message headers in a non-standard format
     if (zohoOriginalMessage) {
-        try {
-            let parsedOriginal = await simpleParser(zohoOriginalMessage.content, { keepDeliveryStatus: true });
-            // Zoho sometimes includes headers in the text body with no actual header structure
-            if (parsedOriginal && parsedOriginal.text && (!parsedOriginal.headerLines || !parsedOriginal.headerLines.filter(h => h.key).length)) {
-                // Remove leading spaces that indicate header continuation
-                let headerContent = (parsedOriginal.text || '').toString().replace(/^ (?=[^ ])/gm, '');
-                let headers = libmime.decodeHeaders(headerContent);
-                if (headers && headers['message-id']) {
-                    parsedMessageHeaders = headers;
-                    result = Object.assign(result, parseDeliveryHeaders(headerContent) || {});
+        // Verify this is actually a Zoho bounce to prevent false positives
+        let isZohoBounce = false;
+
+        // Check for Zoho-specific indicators in the bounce email headers
+        if (parsed.headers) {
+            // Check X-Mailer header
+            const xMailer = parsed.headers.has('x-mailer')
+                ? []
+                      .concat(parsed.headers.get('x-mailer') || '')
+                      .join(' ')
+                      .toLowerCase()
+                : '';
+            // Check From header for Zoho domain
+            const fromHeader = parsed.headers.has('from')
+                ? []
+                      .concat(parsed.headers.get('from') || '')
+                      .map(f => (f.address || f.text || f || '').toLowerCase())
+                      .join(' ')
+                : '';
+            // Check User-Agent header
+            const userAgent = parsed.headers.has('user-agent')
+                ? []
+                      .concat(parsed.headers.get('user-agent') || '')
+                      .join(' ')
+                      .toLowerCase()
+                : '';
+
+            isZohoBounce = xMailer.includes('zoho') || fromHeader.includes('zoho') || userAgent.includes('zoho');
+        }
+
+        if (isZohoBounce) {
+            try {
+                let parsedOriginal = await simpleParser(zohoOriginalMessage.content, { keepDeliveryStatus: true });
+                // Zoho sometimes includes headers in the text body with no actual header structure
+                if (parsedOriginal && parsedOriginal.text && (!parsedOriginal.headerLines || !parsedOriginal.headerLines.filter(h => h.key).length)) {
+                    // Remove leading spaces that indicate header continuation
+                    let headerContent = (parsedOriginal.text || '').toString().replace(/^ (?=[^ ])/gm, '');
+
+                    // Additional validation: content should look like email headers
+                    // Check for common header patterns (Received:, Message-ID:, Date:, From:)
+                    if (/^\s*(Received|Message-ID|Date|From):/im.test(headerContent)) {
+                        let headers = libmime.decodeHeaders(headerContent);
+                        if (headers && headers['message-id']) {
+                            parsedMessageHeaders = headers;
+                            result = Object.assign(result, parseDeliveryHeaders(headerContent) || {});
+                        }
+                    }
                 }
+            } catch (E) {
+                // Failed to parse Zoho attachment
+                // Continue processing as this is not critical
             }
-        } catch (E) {
-            // Failed to parse Zoho attachment
-            // Continue processing as this is not critical
-            // TODO: Consider logging this error for debugging
         }
     }
 
@@ -343,13 +391,20 @@ async function bounceDetect(sourceStream) {
     let text = (parsed.text || '').toString();
 
     // Some bounces put the content in an attachment with no content-type
-    if (!text && !parsed.html && parsed.attachments) {
-        let emptyContent = parsed.attachments.find(attachment => !attachment.contentType);
+    if (!text && !parsed.html && attachments.length) {
+        let emptyContent = attachments.find(attachment => !attachment.contentType);
         if (emptyContent) {
             text = (emptyContent.content || '').toString();
         }
     }
 
+    // Limit text size for pattern matching to prevent ReDoS attacks
+    // Bounce information is typically in the first part of the message
+    const MAX_TEXT_LENGTH = 50000;
+    if (text.length > MAX_TEXT_LENGTH) {
+        text = text.substring(0, MAX_TEXT_LENGTH);
+    }
+
     // Pattern matching for non-standard bounce formats
     // Only proceed if we haven't found the recipient or response message yet
 
@@ -397,10 +452,11 @@ async function bounceDetect(sourceStream) {
          * Delivery to the following recipient failed permanently:
          *     user@example.com
          */
-        let m = text.match(/Delivery\s[\s\w]*failed[\s\w]*:/im);
+        // Use bounded quantifier to prevent ReDoS with nested [\s\w]* patterns
+        let m = text.match(/Delivery[^:]{0,100}failed[^:]{0,50}:/im);
         if (m) {
             // Look for email address on the next line
-            let addrMatch = text.substr(m.index + m[0].length).match(/\s*\n*\s*([^\s\n]+)/);
+            let addrMatch = text.substring(m.index + m[0].length).match(/\s*\n*\s*([^\s\n]+)/);
             if (addrMatch && addrMatch[1].indexOf('@') >= 0) {
                 result.recipient = addrMatch[1].trim();
             }
@@ -463,16 +519,17 @@ async function bounceDetect(sourceStream) {
          * <user@example.com>:
          * 550: 5.1.1 <user@example.com>: Recipient address rejected: User unknown in relay recipient table
          */
-        let m = text.match(/\n<([^>@]+@[^>]+)>:[\s\r\n]+/);
+        // Use bounded quantifier to prevent ReDoS
+        let m = text.match(/\n<([^>@]+@[^>]+)>:[\s\r\n]{1,100}/);
         if (m) {
             result.recipient = result.recipient || m[1];
 
-            let end = text.substr(m.index + m[0].length).match(/\r?\n\r?\n|$/);
+            let end = text.substring(m.index + m[0].length).match(/\r?\n\r?\n|$/);
             if (end) {
                 result.action = result.action || 'failed';
 
                 let message = text
-                    .substr(m.index + m[0].length, end.index)
+                    .substring(m.index + m[0].length, m.index + m[0].length + end.index)
                     .replace(/\s+/g, ' ')
                     .trim();
 
@@ -509,6 +566,39 @@ async function bounceDetect(sourceStream) {
         }
     }
 
+    // Google's old bounce format (pre-2015 style)
+    if (!result.action || !result.response || !result.response.message) {
+        /*
+         * Match pattern like:
+         * Delivery to the following recipient failed permanently:
+         *
+         *      user@example.com
+         *
+         * Technical details of permanent failure:
+         * Google tried to deliver your message, but it was rejected...
+         */
+        let m = text.match(/Delivery to the following recipient(?:s)? failed permanently:\s+([^\s@]+@[^\s]+)/i);
+        if (m) {
+            result.recipient = result.recipient || m[1].trim();
+            result.action = result.action || 'failed';
+
+            // Look for technical details
+            let techMatch = text.match(/Technical details of (?:permanent )?failure:\s*(.+?)(?:\n\n|-{3,}|Original message)/is);
+            if (techMatch && techMatch[1]) {
+                result.response = result.response || {};
+                result.response.message = result.response.message || techMatch[1].replace(/\s+/g, ' ').trim();
+
+                // Extract enhanced status code if present
+                if (!result.response.status) {
+                    let statusMatch = techMatch[1].match(/(\d+\.\d+\.\d+)/);
+                    if (statusMatch) {
+                        result.response.status = statusMatch[1];
+                    }
+                }
+            }
+        }
+    }
+
     if (!result.response || !result.response.message) {
         /*
          * Match pattern like:
@@ -559,7 +649,7 @@ async function bounceDetect(sourceStream) {
         }
     }
 
-    // Complex pattern for certain MTA formats
+    // Complex pattern for certain MTA formats (Postfix style)
     if (result.recipient && result.response && !result.response.message && /A message that you sent could not be delivered/.test(text)) {
         /*
          * Match pattern like:
@@ -569,26 +659,154 @@ async function bounceDetect(sourceStream) {
          *     Recipient address rejected: User unknown in relay recipient table
          */
 
-        // Replace newlines with a special character to make regex matching easier
-        text.replace(/\r?\n/g, '\x04').replace(/\x04\s*\x04\s*([^\s@]+@[^\s@\x04]+)\s*((?:\x04\s*[^\x04]+)+)/g, (...a) => {
-            let addr = a[1];
-            // Only process if this is our recipient and we don't have a message yet
-            if (addr !== result.recipient || (result.response && result.response.message)) {
-                return;
+        // Use iterative approach instead of complex regex to prevent ReDoS
+        // Split by double newlines to find blocks, then look for the recipient's block
+        const blocks = text.split(/\r?\n\r?\n/);
+        for (const block of blocks) {
+            // Check if this block starts with or contains our recipient email
+            if (block.includes(result.recipient)) {
+                // Look for "host ... :" pattern followed by error message
+                const hostMatch = block.match(/\shost\s+[^\n:]+:\s*(.+)/s);
+                if (hostMatch && hostMatch[1]) {
+                    const message = hostMatch[1].replace(/\s+/g, ' ').trim();
+                    if (message) {
+                        result.response = result.response || {};
+                        result.response.message = message;
+                        break;
+                    }
+                }
             }
+        }
+    }
 
-            // Extract the error message after "host ... :"
-            let m = (a[2] || '')
-                .replace(/\x04/g, ' ')
-                .replace(/\s+/g, ' ')
-                .trim()
-                .match(/\shost\s[^:]+:\s*(.*)$/);
+    // Exim-style bounce format
+    if (result.recipient && (!result.response || !result.response.message) && /The following address\(?es\)? failed:/i.test(text)) {
+        /*
+         * Match pattern like (Exim MTA):
+         * The following address(es) failed:
+         *
+         *   info@example.com
+         *     Domain example.org has exceeded the max defers and failures per hour (5/5 (100%)) allowed. Message discarded.
+         *
+         * The recipient is indented, and the error message follows with deeper indentation.
+         */
+        const blocks = text.split(/\r?\n\r?\n/);
+        for (const block of blocks) {
+            // Check if this block contains our recipient email
+            if (block.includes(result.recipient)) {
+                // Split block into lines and find the recipient line
+                const lines = block.split(/\r?\n/);
+                let foundRecipient = false;
+                let messageLines = [];
+
+                for (const line of lines) {
+                    if (!foundRecipient) {
+                        // Look for line containing recipient email
+                        if (line.includes(result.recipient)) {
+                            foundRecipient = true;
+                        }
+                    } else {
+                        // After recipient line, collect indented lines as error message
+                        // Error lines typically start with more indentation than the recipient
+                        if (/^\s{2,}/.test(line) && line.trim()) {
+                            messageLines.push(line.trim());
+                        } else if (line.trim() === '') {
+                            // Empty line might separate multiple errors, stop here
+                            break;
+                        } else {
+                            // Non-indented non-empty line means end of this recipient's block
+                            break;
+                        }
+                    }
+                }
 
-            if (m && m[1]) {
-                result.response = result.response || {};
-                result.response.message = m[1];
+                if (messageLines.length > 0) {
+                    const message = messageLines.join(' ').replace(/\s+/g, ' ').trim();
+                    if (message) {
+                        result.response = result.response || {};
+                        result.response.message = message;
+                        result.action = result.action || 'failed';
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+    // KDDI / Japanese carrier style bounce
+    if (!result.recipient) {
+        /*
+         * Match pattern like:
+         * Could not be delivered to: <kijitora@example.com>
+         */
+        let m = text.match(/Could not be delivered to:\s*<?([^\s<>\n]+@[^\s<>\n]+)>?/i);
+        if (m) {
+            result.recipient = m[1].trim();
+            result.action = result.action || 'failed';
+        }
+    }
+
+    // X6 / Generic MTA style with "permanent errors"
+    if (!result.recipient) {
+        /*
+         * Match pattern like:
+         * The following recipients returned permanent errors: kijitora@example.com
+         */
+        let m = text.match(/returned permanent errors?:\s*<?([^\s<>,\n]+@[^\s<>,\n]+)>?/i);
+        if (m) {
+            result.recipient = m[1].trim();
+            result.action = result.action || 'failed';
+        }
+    }
+
+    // Extract error message from Verizon MMS / mobile carrier style
+    if (!result.response || !result.response.message) {
+        /*
+         * Match pattern like:
+         * Message could not be delivered to mobile.
+         * Error: No valid recipients for this MM
+         */
+        let m = text.match(/(?:Message could not be delivered|Error:[^\n]*(?:Invalid|No valid|not taken)[^\n]*)/i);
+        if (m) {
+            result.action = result.action || 'failed';
+            result.response = result.response || {};
+            result.response.message = result.response.message || m[0].replace(/\s+/g, ' ').trim();
+        }
+    }
+
+    // Apache James / Verizon text style with RCPT TO
+    if (!result.recipient) {
+        /*
+         * Match pattern like:
+         * RCPT TO: 000000000000@example.com
+         */
+        let m = text.match(/RCPT TO:\s*<?([^\s<>\n]+@[^\s<>\n]+)>?/i);
+        if (m) {
+            result.recipient = m[1].trim();
+        }
+    }
+
+    // Generic error code extraction (550, 551, 552, etc.)
+    if (!result.response || !result.response.message) {
+        /*
+         * Match pattern like:
+         * 550 - Requested action not taken: no such user here
+         * 550 5.1.1 user unknown
+         */
+        let m = text.match(/\b(5[0-5]\d)\s*[-:]\s*([^\n]{10,100})/);
+        if (m) {
+            result.action = result.action || 'failed';
+            result.response = result.response || {};
+            result.response.message = result.response.message || m[1] + ' ' + m[2].trim();
+
+            // Try to extract enhanced status code
+            if (!result.response.status) {
+                let statusMatch = m[2].match(/(\d+\.\d+\.\d+)/);
+                if (statusMatch) {
+                    result.response.status = statusMatch[1];
+                }
             }
-        });
+        }
     }
 
     // Try to find embedded message headers in the bounce body

package/lib/email-client/base-client.js

@@ -2385,8 +2385,15 @@ class BaseClient {
      * @returns {boolean} True if message appears to be an auto-reply
      */
     isAutoreply(messageData) {
-        // Check subject patterns
-        if (/^(auto:|Out of Office|OOF:|OOO:)/i.test(messageData.subject) && messageData.inReplyTo) {
+        // Check subject patterns - these are strong autoreply indicators
+        // Note: "Automatic reply:" and "Auto reply:" (with space) are common variants
+        // "Out of the Office" is also valid (with "the")
+        if (/^(auto(matic)?\s*(reply|response)|Out of(?: the)? Office|OOF:|OOO:)/i.test(messageData.subject)) {
+            return true;
+        }
+
+        // Weaker subject patterns require inReplyTo as confirmation
+        if (/^auto:/i.test(messageData.subject) && messageData.inReplyTo) {
             return true;
         }
 
@@ -2399,11 +2406,17 @@ class BaseClient {
             return true;
         }
 
-        // Check Auto-Submitted header
+        // Check Auto-Submitted header (RFC 3834)
         if (messageData.headers['auto-submitted'] && messageData.headers['auto-submitted'].some(e => /auto[_-]?replied/.test(e))) {
             return true;
         }
 
+        // Check X-Auto-Response-Suppress header (Microsoft Exchange)
+        // Values like "All", "OOF", "AutoReply" indicate this is an autoreply
+        if (messageData.headers['x-auto-response-suppress'] && messageData.headers['x-auto-response-suppress'].length) {
+            return true;
+        }
+
         // Check various vendor-specific headers
         for (let headerKey of ['x-autoresponder', 'x-autorespond', 'x-autoreply']) {
             if (messageData.headers[headerKey] && messageData.headers[headerKey].length) {
@@ -3102,12 +3115,13 @@ class BaseClient {
         let address = (messageData.from && messageData.from.address) || '';
 
         // Common bounce sender names
-        if (/Mail Delivery System|Mail Delivery Subsystem|Internet Mail Delivery/i.test(name)) {
+        if (/Mail Delivery System|Mail Delivery Subsystem|Internet Mail Delivery|Mailer[- ]?Daemon|NDR Administrator/i.test(name)) {
             return true;
         }
 
-        // Common bounce addresses
-        if (/mailer-daemon@|postmaster@/i.test(address)) {
+        // Common bounce addresses (including mailer-daemon without @)
+        // Note: Some MTAs use "mailerdaemon" without hyphen (e.g., ZoneMTA)
+        if (/mailer-?daemon@|postmaster@|^mailer-?daemon$/i.test(address)) {
             return true;
         }
 
@@ -3118,16 +3132,40 @@ class BaseClient {
 
         // Check for delivery-status attachment with undeliverable subject
         let hasDeliveryStatus = false;
+        let hasOriginalMessage = false;
         for (let attachment of messageData.attachments || []) {
             if (attachment.contentType === 'message/delivery-status') {
                 hasDeliveryStatus = true;
             }
+            if (attachment.contentType === 'message/rfc822') {
+                hasOriginalMessage = true;
+            }
         }
 
         if (hasDeliveryStatus && /Undeliver(able|ed)/i.test(messageData.subject)) {
             return true;
         }
 
+        // Has delivery-status attachment (strong indicator)
+        if (hasDeliveryStatus) {
+            return true;
+        }
+
+        // Has original message attachment with bounce-like subject
+        if (hasOriginalMessage && /Undeliver|Failed|Returned|Failure|Error/i.test(messageData.subject)) {
+            return true;
+        }
+
+        // Additional subject patterns for various bounce formats
+        // Includes Japanese carrier patterns and generic NDR subjects
+        if (
+            /^Undeliverable\s+Message$|Mail delivery failed|Delivery Status Notification|Returned mail|Failure Notice|error sending your mail/i.test(
+                messageData.subject
+            )
+        ) {
+            return true;
+        }
+
         return false;
     }
 

package/lib/email-client/imap/mailbox.js

@@ -3577,27 +3577,52 @@ class Mailbox {
         let address = (messageInfo.from && messageInfo.from.address) || '';
 
         // Check common bounce sender names
-        if (/Mail Delivery System|Mail Delivery Subsystem|Internet Mail Delivery/i.test(name)) {
+        if (/Mail Delivery System|Mail Delivery Subsystem|Internet Mail Delivery|Mailer[- ]?Daemon|NDR Administrator/i.test(name)) {
             return true;
         }
 
-        // Check common bounce sender addresses
-        if (/mailer-daemon@|postmaster@/i.test(address)) {
+        // Check common bounce sender addresses (including mailer-daemon without @)
+        // Note: Some MTAs use "mailerdaemon" without hyphen (e.g., ZoneMTA)
+        if (/mailer-?daemon@|postmaster@|^mailer-?daemon$/i.test(address)) {
             return true;
         }
 
         // Check for delivery-status attachment + subject pattern
         let hasDeliveryStatus = false;
+        let hasOriginalMessage = false;
         for (let attachment of messageInfo.attachments || []) {
             if (attachment.contentType === 'message/delivery-status') {
                 hasDeliveryStatus = true;
             }
+            if (attachment.contentType === 'message/rfc822') {
+                hasOriginalMessage = true;
+            }
         }
 
         if (hasDeliveryStatus && /Undeliver(able|ed)/i.test(messageInfo.subject)) {
             return true;
         }
 
+        // Has delivery-status attachment (strong indicator)
+        if (hasDeliveryStatus) {
+            return true;
+        }
+
+        // Has original message attachment with bounce-like subject
+        if (hasOriginalMessage && /Undeliver|Failed|Returned|Failure|Error/i.test(messageInfo.subject)) {
+            return true;
+        }
+
+        // Additional subject patterns for various bounce formats
+        // Includes Japanese carrier patterns and generic NDR subjects
+        if (
+            /^Undeliverable\s+Message$|Mail delivery failed|Delivery Status Notification|Returned mail|Failure Notice|error sending your mail/i.test(
+                messageInfo.subject
+            )
+        ) {
+            return true;
+        }
+
         return false;
     }
 
@@ -3620,15 +3645,29 @@ class Mailbox {
             }
 
             // Check for embedded message (complaint might contain original)
-            if (['message/rfc822', 'message/rfc822-headers'].includes(attachment.contentType)) {
+            // Include text/rfc822-headers variant used by some senders
+            if (['message/rfc822', 'message/rfc822-headers', 'text/rfc822-headers', 'text/rfc822-header'].includes(attachment.contentType)) {
                 hasEmbeddedMessage = true;
             }
         }
 
         let fromAddress = (messageInfo.from && messageInfo.from.address) || '';
 
-        // Hotmail-specific complaint pattern
-        if (hasEmbeddedMessage && fromAddress === 'staff@hotmail.com' && /complaint/i.test(messageInfo.subject)) {
+        // Hotmail/Microsoft complaint pattern (may not have parsed attachments)
+        if (fromAddress === 'staff@hotmail.com' && /complaint/i.test(messageInfo.subject)) {
+            return true;
+        }
+
+        // Generic feedback loop sender patterns
+        if (/^(feedbackloop|fbl|complaints|abuse)@/i.test(fromAddress)) {
+            // Common FBL sender addresses indicate likely complaint
+            if (hasEmbeddedMessage || /abuse|complaint|feedback|report/i.test(messageInfo.subject)) {
+                return true;
+            }
+        }
+
+        // ARF-style subject patterns with embedded message
+        if (hasEmbeddedMessage && /abuse report|feedback report|spam report/i.test(messageInfo.subject)) {
             return true;
         }
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "emailengine-app",
-    "version": "2.60.1",
+    "version": "2.61.0",
     "private": false,
     "productTitle": "EmailEngine",
     "description": "Email Sync Engine",
@@ -68,7 +68,7 @@
         "@zone-eu/wild-config": "1.7.3",
         "ace-builds": "1.43.5",
         "base32.js": "0.1.0",
-        "bullmq": "5.66.1",
+        "bullmq": "5.66.2",
         "compare-versions": "6.1.1",
         "dotenv": "17.2.3",
         "encoding-japanese": "2.2.0",
@@ -82,7 +82,7 @@
         "html-to-text": "9.0.5",
         "ical.js": "1.5.0",
         "iconv-lite": "0.7.1",
-        "imapflow": "1.2.1",
+        "imapflow": "1.2.3",
         "ioredfour": "1.3.0-ioredis-07",
         "ioredis": "5.8.2",
         "ipaddr.js": "2.3.0",
@@ -106,7 +106,7 @@
         "pubface": "1.0.17",
         "punycode.js": "2.3.1",
         "qrcode": "1.5.4",
-        "smtp-server": "3.17.1",
+        "smtp-server": "3.18.0",
         "socks": "2.8.7",
         "speakeasy": "2.0.0",
         "startbootstrap-sb-admin-2": "3.3.7",
@@ -153,7 +153,6 @@
             "node_modules/@postalsys/bounce-classifier/model/**/*",
             "node_modules/jsdom/lib/jsdom/browser/default-stylesheet.css",
             "LICENSE_EMAILENGINE.txt",
-            "help.txt",
             "version-info.json",
             "sbom.json"
         ],