mailauth 4.13.3 → 5.0.0

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "4.13.3"
+    ".": "5.0.0"
 }

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [5.0.0](https://github.com/postalsys/mailauth/compare/v4.13.3...v5.0.0) (2026-08-06)
+
+
+### ⚠ BREAKING CHANGES
+
+* Node.js 20 is no longer supported, the minimum is now 22.19.0 (the engine floor of undici 8).
+* **dmarc:** adkim=s and aspf=s now actually fail when only the organizational domains match. Previously strict alignment fell through to the relaxed comparison, so these records behaved as adkim=r/aspf=r and such messages passed. Senders that publish strict alignment but sign or send from a different host under the same organizational domain will flip from pass to fail. dmarc.status.header.from now reports the From domain rather than the organizational domain, dmarc.status.header.d reports the domain the record was found at, and dkim.results[].status.aligned is false for org-level-only matches when the domain publishes adkim=s.
+
+### Features
+
+* add seal-only mode to the seal CLI command ([#119](https://github.com/postalsys/mailauth/issues/119)) ([afdfc3d](https://github.com/postalsys/mailauth/commit/afdfc3d1cb7b61aecbf60eda96f2c0be87b0c9cf))
+
+
+### Bug Fixes
+
+* **arc:** report public key failures instead of a bare arc=fail ([3464be7](https://github.com/postalsys/mailauth/commit/3464be70dd2449038e3c0381acbe4565d28370ba))
+* **cli:** validate seal-only options and dedupe the seal command paths ([17dd59c](https://github.com/postalsys/mailauth/commit/17dd59ca472efc477fe041de48d2c2d8a730f3e7))
+* close residual parser and DMARC discovery edge cases ([f1c28e1](https://github.com/postalsys/mailauth/commit/f1c28e10f331bea1f23ff2d861e00c7700f3b97f))
+* **dmarc:** normalize tag values and report the correct identifiers ([e5dc758](https://github.com/postalsys/mailauth/commit/e5dc75827ff190912515572546bea0745c3629ff))
+* enforce DMARC strict identifier alignment (adkim=s/aspf=s) ([0c4bab7](https://github.com/postalsys/mailauth/commit/0c4bab7f747c70121f72b76b53ad704712f3a56d))
+* harden tag and header parsers against crafted property keys ([7eb9ea2](https://github.com/postalsys/mailauth/commit/7eb9ea24ed19032b63e9f9993971b77b8d77109e))
+* require Node.js >= 22.19.0 ([1c689c5](https://github.com/postalsys/mailauth/commit/1c689c5444821e5e188cef35c5aa3de3b2d8cfbe))
+* **tools:** do not treat a legacy getAlignment options object as strict ([2007ab4](https://github.com/postalsys/mailauth/commit/2007ab41cccc41b531f3e5ec65899264b6e3441d))
+
 ## [4.13.3](https://github.com/postalsys/mailauth/compare/v4.13.2...v4.13.3) (2026-05-14)
 
 

package/README.md

@@ -15,7 +15,7 @@
 - **BIMI** resolving and **VMC** validation
 - **MTA-STS** helper functions
 
-mailauth is a pure JavaScript implementation, requiring no external applications or compilation. It runs on any server or device with Node.js version 20.18.1 or later.
+mailauth is a pure JavaScript implementation, requiring no external applications or compilation. It runs on any server or device with Node.js version 22.19.0 or later.
 
 > [!NOTE]
 > mailauth is used by [EmailEngine](https://emailengine.app/) for validating email authentication settings. See the [Email Authentication Testing documentation](https://learn.emailengine.app/docs/advanced/email-authentication-testing) for details.

package/bin/mailauth.js

@@ -230,6 +230,51 @@ const argv = yargs(hideBin(process.argv))
                     alias: 'o',
                     type: 'boolean',
                     description: 'If set, outputs only the ARC seal headers without the message body.'
+                })
+                .option('auth-results', {
+                    type: 'string',
+                    description:
+                        'Authentication-Results value to embed in the ARC-Authentication-Results header (the part after "i=N;"). When set, the message is sealed using this value as is and no authentication checks are performed.'
+                })
+                .option('auth-results-file', {
+                    type: 'string',
+                    description: 'Path to a file containing the Authentication-Results value. Same as --auth-results, but read from a file.'
+                })
+                .option('cv', {
+                    type: 'string',
+                    choices: ['none', 'pass', 'fail'],
+                    description:
+                        'Chain validation status for the ARC-Seal header (cv= tag). Only used together with --auth-results or --auth-results-file. Defaults to "none".'
+                })
+                .option('instance', {
+                    type: 'number',
+                    description:
+                        'ARC instance number (i= tag). Only used together with --auth-results or --auth-results-file. Defaults to the next instance number based on the existing ARC chain, or 1.'
+                })
+                .conflicts('auth-results', 'auth-results-file')
+                .check(argv => {
+                    for (let key of ['auth-results', 'auth-results-file', 'cv', 'instance']) {
+                        if (Array.isArray(argv[key])) {
+                            throw new Error(`--${key} can only be provided once`);
+                        }
+                    }
+                    // a missing value would silently flip the command back into full
+                    // authentication mode, the opposite of what the caller asked for
+                    if ('auth-results' in argv && (typeof argv.authResults !== 'string' || !argv.authResults.trim())) {
+                        throw new Error('--auth-results must not be empty');
+                    }
+                    if ('auth-results-file' in argv && (typeof argv.authResultsFile !== 'string' || !argv.authResultsFile.trim())) {
+                        throw new Error('--auth-results-file must not be empty');
+                    }
+                    // .implies() cannot express "requires one of", so enforce it here
+                    if (!argv.authResults && !argv.authResultsFile) {
+                        for (let key of ['cv', 'instance']) {
+                            if (key in argv) {
+                                throw new Error(`--${key} can only be used together with --auth-results or --auth-results-file`);
+                            }
+                        }
+                    }
+                    return true;
                 });
             yargs.positional('email', {
                 describe: 'Path to the email message file in EML format. If not specified, the content is read from standard input.'

package/cli.md

@@ -177,6 +177,20 @@ mailauth seal [options] [email]
 - `--header-fields "field1:field2"`, `-h "field1:field2"`: Colon-separated list of header fields to include in the seal (`h=` tag).
 - `--headers-only`, `-o`: Outputs only the ARC seal headers without the entire message.
 
+**Seal-Only Options:**
+
+By default, `seal` authenticates the message (SPF, DKIM, DMARC, ARC) and embeds the computed results in the `ARC-Authentication-Results` header. If the message was already authenticated elsewhere (for example at an edge MTA) and modified afterwards, you can instead provide the original `Authentication-Results` value yourself. When one of the following options is set, no authentication checks or DNS lookups are performed:
+
+- `--auth-results "authserv-id; spf=pass ..."`: `Authentication-Results` value to embed in the `ARC-Authentication-Results` header (the part after `i=N;`). Used as is.
+- `--auth-results-file /path/to/value.txt`: Same as `--auth-results`, but the value is read from a file. Useful for long or multi-line values. Cannot be combined with `--auth-results`.
+- `--cv status`: Chain validation status for the `ARC-Seal` header (`cv=` tag): `none`, `pass`, or `fail`. Defaults to `none`.
+- `--instance number`: ARC instance number (`i=` tag). Defaults to the next instance number based on the existing ARC chain of the message, or `1`.
+
+```bash
+mailauth seal message.eml -d example.com -s s1 -k private.key \
+  --cv pass --auth-results-file auth-results.txt --headers-only
+```
+
 **Authentication Options (from `report` command):**
 
 - `--client-ip x.x.x.x`, `-i x.x.x.x`: IP address of the remote client that sent the email.

package/docs/dmarc.md

@@ -41,10 +41,10 @@ const { dmarc } = await authenticate(message, {
 
 ### status.header Object
 
-| Field  | Type     | Description                                |
-| ------ | -------- | ------------------------------------------ |
-| `from` | `string` | Organizational domain from the From header |
-| `d`    | `string` | Domain where DMARC record was found        |
+| Field  | Type     | Description                         |
+| ------ | -------- | ----------------------------------- |
+| `from` | `string` | Domain of the From header address   |
+| `d`    | `string` | Domain where DMARC record was found |
 
 ## alignment Object
 
@@ -55,18 +55,20 @@ const { dmarc } = await authenticate(message, {
 
 ### alignment.spf Object
 
-| Field    | Type            | Description                                                 |
-| -------- | --------------- | ----------------------------------------------------------- |
-| `result` | `string\|false` | Aligned domain if SPF passed and aligned, otherwise `false` |
-| `strict` | `boolean`       | Whether strict alignment is required (`aspf=s`)             |
+| Field    | Type                | Description                                                     |
+| -------- | ------------------- | --------------------------------------------------------------- |
+| `result` | `string\|undefined` | Aligned domain if SPF passed and aligned, otherwise `undefined` |
+| `strict` | `boolean`           | Whether strict alignment is required (`aspf=s`)                 |
 
 ### alignment.dkim Object
 
-| Field        | Type            | Description                                                  |
-| ------------ | --------------- | ------------------------------------------------------------ |
-| `result`     | `string\|false` | Aligned domain if DKIM passed and aligned, otherwise `false` |
-| `strict`     | `boolean`       | Whether strict alignment is required (`adkim=s`)             |
-| `underSized` | `number`        | Number of unsigned body bytes (if `l=` tag limited body)     |
+| Field        | Type                | Description                                                      |
+| ------------ | ------------------- | ---------------------------------------------------------------- |
+| `result`     | `string\|undefined` | Aligned domain if DKIM passed and aligned, otherwise `undefined` |
+| `strict`     | `boolean`           | Whether strict alignment is required (`adkim=s`)                 |
+| `underSized` | `number`            | Number of unsigned body bytes (if `l=` tag limited body)         |
+
+`underSized` is reported for a signature that aligns at the organizational domain even when `adkim=s` rejected it, so that it stays a reliable content-integrity warning regardless of the alignment mode the domain publishes.
 
 ## Result Values
 
@@ -103,21 +105,19 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
 {
     "status": {
         "result": "pass",
+        "comment": "p=REJECT",
         "header": {
             "from": "example.com",
             "d": "example.com"
-        },
-        "comment": "p=REJECT arc=none"
+        }
     },
     "domain": "example.com",
     "policy": "reject",
     "p": "reject",
     "sp": "reject",
-    "pct": 100,
     "rr": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
     "alignment": {
         "spf": {
-            "result": false,
             "strict": false
         },
         "dkim": {
@@ -125,7 +125,7 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
             "strict": false
         }
     },
-    "info": "dmarc=pass (p=REJECT arc=none) header.from=example.com"
+    "info": "dmarc=pass (p=REJECT) header.from=example.com header.d=example.com"
 }
 ```
 
@@ -135,29 +135,26 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
 {
     "status": {
         "result": "fail",
+        "comment": "p=REJECT",
         "header": {
             "from": "example.com",
             "d": "example.com"
-        },
-        "comment": "p=REJECT"
+        }
     },
     "domain": "example.com",
     "policy": "reject",
     "p": "reject",
     "sp": "reject",
-    "pct": 100,
     "rr": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
     "alignment": {
         "spf": {
-            "result": false,
             "strict": false
         },
         "dkim": {
-            "result": false,
             "strict": false
         }
     },
-    "info": "dmarc=fail (p=REJECT) header.from=example.com"
+    "info": "dmarc=fail (p=REJECT) header.from=example.com header.d=example.com"
 }
 ```
 
@@ -171,7 +168,7 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
             "from": "no-dmarc.example.com"
         }
     },
-    "domain": "no-dmarc.example.com",
+    "domain": "example.com",
     "info": "dmarc=none header.from=no-dmarc.example.com"
 }
 ```
@@ -182,29 +179,27 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
 {
     "status": {
         "result": "pass",
+        "comment": "p=NONE sp=QUARANTINE",
         "header": {
-            "from": "example.com",
-            "d": "sub.example.com"
-        },
-        "comment": "p=NONE sp=QUARANTINE"
+            "from": "sub.example.com",
+            "d": "example.com"
+        }
     },
     "domain": "example.com",
     "policy": "quarantine",
     "p": "none",
     "sp": "quarantine",
-    "pct": 100,
     "rr": "v=DMARC1; p=none; sp=quarantine; rua=mailto:dmarc@example.com",
     "alignment": {
         "spf": {
-            "result": "example.com",
+            "result": "sub.example.com",
             "strict": false
         },
         "dkim": {
-            "result": false,
             "strict": false
         }
     },
-    "info": "dmarc=pass (p=NONE sp=QUARANTINE) header.from=example.com"
+    "info": "dmarc=pass (p=NONE sp=QUARANTINE) header.from=sub.example.com header.d=example.com"
 }
 ```
 

package/index.d.ts

@@ -179,8 +179,15 @@ export interface DKIMResult {
      * Verification status
      */
     status: AuthStatus & {
-        aligned?: boolean;
-        underSized?: boolean;
+        /**
+         * Signing domain if it aligns with the From domain, false otherwise
+         */
+        aligned?: string | false;
+
+        /**
+         * Number of body bytes left unsigned by an l= tag
+         */
+        underSized?: number;
     };
 
     /**
@@ -392,13 +399,25 @@ export interface DMARCResult {
      */
     alignment: {
         spf: {
-            result: string | false;
+            /**
+             * Aligned SPF domain, or undefined if no domain aligned
+             */
+            result?: string;
             strict: boolean;
         };
         dkim: {
-            result: string | false;
+            /**
+             * Aligned signing domain, or undefined if no domain aligned
+             */
+            result?: string;
             strict: boolean;
-            underSized?: boolean;
+
+            /**
+             * Number of body bytes left unsigned by an l= tag. Reported for a signature that
+             * aligns at the organizational domain even if adkim=s rejected it, so that it stays
+             * a reliable content-integrity warning regardless of the alignment mode.
+             */
+            underSized?: number;
         };
     };
 
@@ -968,8 +987,8 @@ export interface DMARCOptions {
     dkimDomains?: Array<{
         id?: string;
         domain: string;
-        aligned?: boolean;
-        underSized?: boolean;
+        aligned?: string | false;
+        underSized?: number;
     }>;
 
     /**

package/lib/arc/index.js

@@ -57,6 +57,8 @@ const verifyAS = async (chain, opts) => {
         publicKey = res?.publicKey;
     } catch (err) {
         err.queryDomain = queryDomain;
+        // the error code is what the ARC result reports as a comment
+        throw err;
     }
 
     let pass = crypto.verify(
@@ -419,7 +421,7 @@ const arc = async (data, opts) => {
                 break;
 
             case 'ESHORTKEY':
-                status.policy['dkim-rules'] = `weak-key`;
+                status.policy = { 'dkim-rules': 'weak-key' };
                 if (err.queryDomain) {
                     status.comment = `weak key for ${err.queryDomain}`;
                 }
@@ -434,7 +436,8 @@ const arc = async (data, opts) => {
             if (result.authenticationResults.dkim && result.authenticationResults.dkim.length) {
                 for (let entry of result.authenticationResults.dkim) {
                     comment.push(`dkim=${entry.result}`);
-                    if (entry?.header?.i) {
+                    // a crafted dotted key (header.i.x=1) parses into an object, not a string
+                    if (typeof entry?.header?.i === 'string') {
                         comment.push(`dkdomain=${entry.header.i.replace(/^@/, '')}`);
                     }
                 }
@@ -442,8 +445,8 @@ const arc = async (data, opts) => {
 
             if (result.authenticationResults.dmarc) {
                 comment.push(`dmarc=${result.authenticationResults.dmarc.result}`);
-                if (result.authenticationResults.dmarc?.header?.from) {
-                    comment.push(`fromdomain=${result.authenticationResults.dmarc?.header?.from}`);
+                if (typeof result.authenticationResults.dmarc?.header?.from === 'string') {
+                    comment.push(`fromdomain=${result.authenticationResults.dmarc.header.from}`);
                 }
             }
 

package/lib/commands/seal.js

@@ -1,10 +1,40 @@
 'use strict';
 
 const { authenticate } = require('../mailauth');
+const { sealMessage } = require('../arc');
 const fs = require('node:fs');
 const { GathererStream } = require('../gatherer-stream');
 const { resolve } = require('node:dns').promises;
 
+const writeMessageBody = async gatherer =>
+    new Promise((resolve, reject) => {
+        let msgStream = gatherer.replay();
+
+        msgStream.pipe(process.stdout, { end: false });
+        msgStream.on('end', () => {
+            resolve();
+        });
+
+        msgStream.on('error', err => {
+            reject(err);
+        });
+    });
+
+const printSignatureInfo = opts => {
+    if (opts.signingDomain) {
+        console.error(`Signing domain:             ${opts.signingDomain}`);
+    }
+    if (opts.selector) {
+        console.error(`Key selector:               ${opts.selector}`);
+    }
+    if (opts.algorithm) {
+        console.error(`Hashing algorithm:          ${opts.algorithm}`);
+    }
+    if (opts.signTime) {
+        console.error(`Signing time:               ${opts.signTime.toISOString()}`);
+    }
+};
+
 const cmd = async argv => {
     let source = argv.email;
     let useStdin = false;
@@ -30,6 +60,7 @@ const cmd = async argv => {
     stream.on('error', err => gatherer.emit('error', err));
 
     let privateKey = await fs.promises.readFile(argv.privateKey, 'utf-8');
+
     let signatureOpts = {
         signingDomain: argv.domain,
         selector: argv.selector,
@@ -39,19 +70,46 @@ const cmd = async argv => {
         signTime: argv.time ? new Date(argv.time * 1000) : new Date()
     };
 
-    if (argv.verbose) {
-        if (signatureOpts.signingDomain) {
-            console.error(`Signing domain:             ${signatureOpts.signingDomain}`);
+    if (argv.authResults || argv.authResultsFile) {
+        // Seal-only mode: embed the caller-provided Authentication-Results value without authenticating the message
+        let authResults = argv.authResultsFile ? (await fs.promises.readFile(argv.authResultsFile, 'utf-8')).trim() : argv.authResults;
+
+        let sealOpts = Object.assign({}, signatureOpts, {
+            authResults,
+            cv: argv.cv || 'none'
+        });
+
+        if (argv.instance) {
+            sealOpts.i = argv.instance;
         }
-        if (signatureOpts.selector) {
-            console.error(`Key selector:               ${signatureOpts.selector}`);
+
+        if (argv.verbose) {
+            console.error('Seal-only mode: sealing with provided authentication results, skipping authentication');
+            printSignatureInfo(sealOpts);
+            console.error(`Chain validation status:    ${sealOpts.cv}`);
+            if (sealOpts.i) {
+                console.error(`ARC instance:               ${sealOpts.i}`);
+            }
+            console.error('--------');
         }
-        if (signatureOpts.algorithm) {
-            console.error(`Hashing algorithm:          ${signatureOpts.algorithm}`);
+
+        let sealHeaders = await sealMessage(gatherer, sealOpts);
+
+        // createSeal writes the instance it actually used back into the seal options
+        if (sealOpts.i > 1 && !argv.cv) {
+            console.error(`warning: sealed with i=${sealOpts.i} and cv=none; a chain with i>1 only validates when cv=pass (use --cv pass)`);
         }
-        if (signatureOpts.signTime) {
-            console.error(`Signing time:               ${signatureOpts.signTime.toISOString()}`);
+
+        process.stdout.write(sealHeaders);
+        if (!argv.headersOnly) {
+            // print full message as well
+            await writeMessageBody(gatherer);
         }
+        return;
+    }
+
+    if (argv.verbose) {
+        printSignatureInfo(signatureOpts);
         if (signatureOpts.headerList) {
             console.error(`Header fields to seal:      ${signatureOpts.headerList}`);
         }
@@ -113,18 +171,7 @@ const cmd = async argv => {
     process.stdout.write(result.headers);
     if (!argv.headersOnly) {
         // print full message as well
-        await new Promise((resolve, reject) => {
-            let msgStream = gatherer.replay();
-
-            msgStream.pipe(process.stdout, { end: false });
-            msgStream.on('end', () => {
-                resolve();
-            });
-
-            msgStream.on('error', err => {
-                reject(err);
-            });
-        });
+        await writeMessageBody(gatherer);
     }
 };
 

package/lib/dmarc/get-dmarc-record.js

@@ -4,24 +4,26 @@ const dns = require('node:dns').promises;
 const tldts = require('tldts');
 const { TLDTS_OPTS } = require('../tools');
 
+// Tags whose values are ABNF literals in RFC 7489 6.4 / RFC 9989 4.7 and are therefore
+// case insensitive (RFC 5234 2.3). Values of other tags keep their case: "v" is defined
+// with explicit hex literals and is case sensitive, "rua"/"ruf" are URIs.
+const CASE_INSENSITIVE_TAGS = new Set(['p', 'sp', 'np', 'adkim', 'aspf', 'fo', 'rf', 't', 'psd']);
+
+// Returns every DMARC record published for a domain. The caller distinguishes an empty set,
+// which continues policy discovery at the organizational domain, from a multi record set,
+// which terminates it (RFC 7489 6.6.3 step 5).
+// The version tag must be the first tag and its value "DMARC1" must match precisely
+// (RFC 9989 4.7 "v"), while the ABNF allows *WSP around "=" and a case insensitive
+// tag name, hence [vV] instead of an /i flag that would also relax the value
+const DMARC_VERSION_RE = /^[vV][ \t]*=[ \t]*DMARC1[ \t]*(?:;|$)/;
+
 const resolveTxt = async (domain, resolver) => {
     try {
         let txt = await resolver(`_dmarc.${domain}`, 'TXT');
-        if (!txt || !txt.length) {
-            return false;
-        }
-
-        txt = txt.map(row => row.join('').trim()).filter(row => /^v=DMARC1\b/i.test(row));
-
-        if (txt.length !== 1) {
-            //no records or multiple records yield in no policy
-            return false;
-        }
-
-        return txt[0];
+        return (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
     } catch (err) {
         if (err.code === 'ENOTFOUND' || err.code === 'ENODATA') {
-            return false;
+            return [];
         }
         throw err;
     }
@@ -30,22 +32,27 @@ const resolveTxt = async (domain, resolver) => {
 const getDmarcRecord = async (domain, resolver) => {
     resolver = resolver || dns.resolve;
 
-    let txt = await resolveTxt(domain, resolver);
+    let records = await resolveTxt(domain, resolver);
     let isOrgRecord = false;
 
-    if (!txt) {
+    if (!records.length) {
         let orgDomain = tldts.getDomain(domain, TLDTS_OPTS);
-        if (orgDomain !== domain) {
+        // tldts returns null for IPs, single labels and other non-domains, and querying
+        // "_dmarc.null" would coerce that into a hostname
+        if (orgDomain && orgDomain !== domain) {
             // try org domain as well
-            txt = await resolveTxt(orgDomain, resolver);
+            records = await resolveTxt(orgDomain, resolver);
             isOrgRecord = true;
         }
     }
 
-    if (!txt) {
+    if (records.length !== 1) {
+        // no record, or a multi record set that terminates policy discovery
         return false;
     }
 
+    let txt = records[0];
+
     let parsed = Object.fromEntries(
         txt
             .split(';')
@@ -58,10 +65,13 @@ const getDmarcRecord = async (domain, resolver) => {
                 } else if (splitPos === 0) {
                     return [false, e];
                 }
+                // whitespace is allowed around "=" (*WSP in the ABNF), so the value must be trimmed
                 let key = e.substr(0, splitPos).toLowerCase().trim();
-                let val = e.substr(splitPos + 1);
+                let val = e.substr(splitPos + 1).trim();
                 if (['pct', 'ri'].includes(key)) {
                     val = parseInt(val, 10) || 0;
+                } else if (CASE_INSENSITIVE_TAGS.has(key)) {
+                    val = val.toLowerCase();
                 }
                 return [key, val];
             })

package/lib/dmarc/verify.js

@@ -48,7 +48,9 @@ const verifyDmarc = async opts => {
         comment: false,
         // ptype properties
         header: {
-            from: orgDomain || domain
+            // RFC 8601 2.7.2: header.from is the domain of the RFC5322.From address,
+            // not the organizational domain the policy may have been inherited from
+            from: domain
         }
     };
 
@@ -68,8 +70,8 @@ const verifyDmarc = async opts => {
         return formatResponse({ status, domain: orgDomain || domain });
     }
 
-    status.header = status.header || {};
-    status.header.d = domain.split('_dmarc.').pop();
+    // the domain the applied policy record was published at
+    status.header.d = dmarcRecord.isOrgRecord ? orgDomain : domain;
 
     status.comment = []
         .concat(dmarcRecord.p ? `p=${dmarcRecord.p.toUpperCase()}` : [])
@@ -80,8 +82,16 @@ const verifyDmarc = async opts => {
     // use "sp" if this is a subdomain of an org domain and "sp" is set, otherwise use "p"
     const policy = dmarcRecord.isOrgRecord && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
 
-    const dkimAlignment = getAlignment(domain, dkimDomains, { strict: dmarcRecord.adkim === 's' });
-    const spfAlignment = getAlignment(domain, spfDomains, { strict: dmarcRecord.aspf === 's' });
+    const adkimStrict = dmarcRecord.adkim === 's';
+    const aspfStrict = dmarcRecord.aspf === 's';
+
+    const dkimAlignment = getAlignment(domain, dkimDomains, adkimStrict);
+    const spfAlignment = getAlignment(domain, spfDomains, aspfStrict);
+
+    // "underSized" warns that a passing DKIM signature covers only part of the body (l= tag).
+    // It describes the signature rather than the alignment mode, so it is still reported when
+    // strict alignment rejected a signature that aligns at the org level.
+    const underSized = (adkimStrict && !dkimAlignment ? getAlignment(domain, dkimDomains, false) : dkimAlignment)?.underSized;
 
     if (dkimAlignment || spfAlignment) {
         // pass
@@ -101,8 +111,8 @@ const verifyDmarc = async opts => {
         rr: dmarcRecord.rr,
 
         alignment: {
-            spf: { result: spfAlignment?.domain, strict: dmarcRecord.aspf === 's' },
-            dkim: { result: dkimAlignment?.domain, strict: dmarcRecord.adkim === 's', underSized: dkimAlignment?.underSized }
+            spf: { result: spfAlignment?.domain, strict: aspfStrict },
+            dkim: { result: dkimAlignment?.domain, strict: adkimStrict, underSized }
         }
     });
 };

package/lib/mailauth.js

@@ -8,6 +8,7 @@ const { arc, createSeal, sealMessage, getARChain, verifyASChain } = require('./a
 const { bimi, validateVMC: validateBimiVmc } = require('./bimi');
 const { validateSvg: validateBimiSvg } = require('./bimi/validate-svg');
 const { parseReceived } = require('./parse-received');
+const { getAlignment } = require('./tools');
 const libmime = require('libmime');
 const os = require('node:os');
 const { isIP } = require('net');
@@ -133,6 +134,14 @@ const authenticate = async (input, opts) => {
         if (dmarcResult.info) {
             arHeader.push(`${libmime.foldLines(dmarcResult.info, 160)}`);
         }
+
+        if (dmarcResult.alignment?.dkim?.strict) {
+            // the DKIM verifier only knows relaxed alignment, it runs before the DMARC record
+            let fromDomain = dmarcResult.status.header.from;
+            for (let row of dkimResult.results || []) {
+                row.status.aligned = (row.status.aligned && getAlignment(fromDomain, [row.signingDomain], true)?.domain) || false;
+            }
+        }
     }
 
     let bimiResult;

package/lib/parse-dkim-headers.js

@@ -1,5 +1,13 @@
 'use strict';
 
+const { DANGEROUS_KEYS } = require('./safe-keys');
+
+// Keys the headerParser result pre-seeds: "header" holds the header name and "value" the
+// authserv-id picked from the first key-only part. A crafted part must not overwrite them,
+// readers expect strings there, not parsed entry objects. This is a schema fact of this
+// parser (valueParser has its own reservation: "header" is a legitimate ptype there).
+const RESERVED_RESULT_KEYS = new Set(['header', 'value']);
+
 // NB! fails to properly parse nested comments (should be rare enough though)
 
 const valueParser = str => {
@@ -97,8 +105,17 @@ const valueParser = str => {
         parts.slice(1).forEach(part => {
             if (part.key || part.value) {
                 let path = part.key.split('.');
+
+                // A propspec is "ptype.property" (RFC 8601 2.2), so at most two segments, and
+                // "value" already holds the method result. Anything else would either overwrite
+                // that or nest an object where every reader of this shape expects a string.
+                if (path.length > 2 || path.some(p => p === 'value' || DANGEROUS_KEYS.has(p))) {
+                    return;
+                }
+
                 let curRes = result;
                 let final = path.pop();
+
                 for (let p of path) {
                     if (typeof curRes[p] !== 'object' || !curRes[p]) {
                         curRes[p] = {};
@@ -266,6 +283,11 @@ const headerParser = buf => {
         }
 
         parts.forEach(part => {
+            if (!part.key || RESERVED_RESULT_KEYS.has(part.key) || DANGEROUS_KEYS.has(part.key)) {
+                // nothing would be assigned, so do not parse the part either
+                return;
+            }
+
             let entry = {
                 value: part.value
             };
@@ -279,15 +301,13 @@ const headerParser = buf => {
                 entry.comment = part.comment;
             }
 
-            if (part.key && !['__proto__', 'constructor'].includes(part.key)) {
-                if (['arc-authentication-results', 'authentication-results'].includes(headerKey) && part.key === 'dkim') {
-                    if (!result[part.key]) {
-                        result[part.key] = [];
-                    }
-                    result[part.key].push(entry);
-                } else {
-                    result[part.key] = entry;
+            if (['arc-authentication-results', 'authentication-results'].includes(headerKey) && part.key === 'dkim') {
+                if (!result[part.key]) {
+                    result[part.key] = [];
                 }
+                result[part.key].push(entry);
+            } else {
+                result[part.key] = entry;
             }
         });
 

package/lib/parse-received.js

@@ -1,5 +1,7 @@
 'use strict';
 
+const { DANGEROUS_KEYS } = require('./safe-keys');
+
 const parseReceived = buf => {
     let header = (buf || '').toString();
 
@@ -156,6 +158,10 @@ const parseReceived = buf => {
                 result.tls = { value: '', ...(val.comment && { comment: val.comment }) };
                 val.comment = '';
             }
+            if (DANGEROUS_KEYS.has(key)) {
+                // skip the assignment only: the transport security of the hop is worth keeping
+                continue;
+            }
             result[key] = { value: val.value, ...(val.comment && { comment: val.comment }) };
         } else if (!result.tls && /tls|cipher=|Google Transport Security/i.test(val.comment)) {
             result.tls = { value: val.value, ...(val.comment && { comment: val.comment }) };

package/lib/safe-keys.js

@@ -0,0 +1,10 @@
+'use strict';
+
+// Property names that must never be used as parsed keys. Assigning "__proto__" replaces the
+// prototype of the parsed object instead of adding a property to it, and assigning any other
+// inherited Object.prototype member shadows that method, so later string coercion of the
+// object (or a hasOwnProperty call on it) throws instead of returning a value.
+// "prototype" is the only name here that is not already an own property of Object.prototype.
+const DANGEROUS_KEYS = new Set(['prototype', ...Object.getOwnPropertyNames(Object.prototype)]);
+
+module.exports = { DANGEROUS_KEYS };

package/lib/tools.js

@@ -191,7 +191,7 @@ const formatSignatureHeaderLine = (type, values, folded) => {
     const header =
         `${headerKey}: ` +
         Object.keys(values)
-            .filter(key => values[key] !== false && typeof values[key] !== 'undefined' && values.key !== null && keyOrdering.includes(key))
+            .filter(key => values[key] !== false && typeof values[key] !== 'undefined' && values[key] !== null && keyOrdering.includes(key))
             .sort((a, b) => keyOrdering.indexOf(a) - keyOrdering.indexOf(b))
             .map(key => {
                 let val = values[key] || '';
@@ -471,10 +471,17 @@ const formatDomain = domain => {
     } catch (err) {
         // ignore punycode errors
     }
-    return domain;
+    // the root label is not part of the name, so "example.com." and "example.com" are the same domain
+    return domain.replace(/\.+$/, '');
 };
 
 const getAlignment = (fromDomain, domainList, strict) => {
+    // This argument used to be an options object. Every object is truthy, so a leftover
+    // { strict: false } call would otherwise mean hard strict, the opposite of what it asks for.
+    if (strict && typeof strict === 'object') {
+        strict = strict.strict;
+    }
+
     domainList = []
         .concat(domainList || [])
         .map(entry => {
@@ -486,20 +493,28 @@ const getAlignment = (fromDomain, domainList, strict) => {
         .sort((a, b) => (a.underSized || 0) - (b.underSized || 0));
 
     if (strict) {
-        fromDomain = formatDomain(fromDomain);
+        // strict alignment: the domains must be identical (RFC 9989 §3.2.10.2)
+        let from = formatDomain(fromDomain);
+        if (!from) {
+            // a bare root label normalizes to an empty string, which must not align with anything
+            return false;
+        }
         for (let entry of domainList) {
-            let domain = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
-            if (formatDomain(domain) === fromDomain) {
+            if (formatDomain(entry.domain) === from) {
                 return entry;
             }
         }
+        return false;
     }
 
-    // match org domains
-    fromDomain = formatDomain(tldts.getDomain(fromDomain, TLDTS_OPTS) || fromDomain);
+    // relaxed alignment: the domains must share an Organizational Domain (RFC 9989 §3.2.10.1)
+    let fromOrg = formatDomain(tldts.getDomain(fromDomain, TLDTS_OPTS) || fromDomain);
+    if (!fromOrg) {
+        return false;
+    }
     for (let entry of domainList) {
-        let domain = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
-        if (domain === fromDomain) {
+        let entryOrg = formatDomain(tldts.getDomain(entry.domain, TLDTS_OPTS) || entry.domain);
+        if (entryOrg === fromOrg) {
             return entry;
         }
     }
@@ -589,7 +604,9 @@ function parseTagValueRecord(record, options = {}) {
 
     // Split on semicolons
     const parts = sanitized.split(';');
-    const tags = {};
+    // no prototype, so that a tag named "__proto__" is stored as a normal key instead of
+    // replacing the prototype, and so that "toString" and friends are not seen as already set
+    const tags = Object.create(null);
     const validPairs = [];
     const errors = [];
     const warnings = [];

package/package.json

@@ -1,11 +1,11 @@
 {
     "name": "mailauth",
-    "version": "4.13.3",
+    "version": "5.0.0",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",
     "scripts": {
-        "test": "eslint \"lib/**/*.js\" \"test/**/*.js\" && mocha --recursive \"./test/**/*.js\" --reporter spec",
+        "test": "eslint \"lib/**/*.js\" \"test/**/*.js\" && mocha --recursive \"./test/**/*-test.js\" --reporter spec",
         "format": "prettier --write .",
         "build-source": "rm -rf node_modules package-lock.json && npm install && npm run licenses && rm -rf node_modules package-lock.json && npm install --production && rm -rf package-lock.json",
         "build-dist": "npx pkg --compress Brotli package.json && rm -rf package-lock.json && npm install && node winconf.js",
@@ -35,30 +35,30 @@
     "homepage": "https://github.com/postalsys/mailauth",
     "devDependencies": {
         "chai": "4.4.1",
-        "eslint": "10.3.0",
+        "eslint": "10.8.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "js-yaml": "4.1.1",
-        "license-report": "6.8.2",
+        "js-yaml": "5.2.3",
+        "license-report": "6.8.5",
         "mbox-reader": "1.2.0",
-        "mocha": "11.7.5",
-        "prettier": "3.8.3",
+        "mocha": "11.8.0",
+        "prettier": "3.9.6",
         "resedit": "3.0.2"
     },
     "dependencies": {
-        "@postalsys/vmc": "1.1.4",
-        "fast-xml-parser": "5.7.3",
-        "ipaddr.js": "2.4.0",
-        "joi": "18.2.1",
-        "libmime": "5.3.8",
-        "nodemailer": "8.0.7",
+        "@postalsys/vmc": "1.1.5",
+        "fast-xml-parser": "5.10.1",
+        "ipaddr.js": "2.5.0",
+        "joi": "18.2.3",
+        "libmime": "5.4.1",
+        "nodemailer": "9.0.4",
         "punycode.js": "2.3.1",
-        "tldts": "7.0.30",
-        "undici": "7.25.0",
+        "tldts": "7.4.10",
+        "undici": "8.10.0",
         "yargs": "17.7.2"
     },
     "engines": {
-        "node": ">=20.18.1"
+        "node": ">=22.19.0"
     },
     "bin": {
         "mailauth": "bin/mailauth.js"

package/CLAUDE.md

@@ -1,66 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-mailauth is a Node.js library and CLI tool for email authentication. It implements SPF, DKIM, DMARC, ARC, BIMI, and MTA-STS protocols. Pure JavaScript, no native dependencies. Requires Node.js >= 20.18.1.
-
-## Commands
-
-- **Run all tests (lint + mocha):** `npm test`
-- **Run a single test file:** `npx mocha test/dkim/body/relaxed-test.js --reporter spec`
-- **Run tests matching a pattern:** `npx mocha --recursive "./test/**/*.js" --reporter spec --grep "pattern"`
-- **Lint only:** `npx eslint "lib/**/*.js" "test/**/*.js"`
-- **Format code:** `npm run format` (uses Prettier)
-
-## Code Style
-
-- CommonJS (`require`/`module.exports`), not ES modules
-- `'use strict'` at top of every file
-- Mocha + Chai (expect style) for tests
-- Prettier: 160 print width, 4-space indent, single quotes, no trailing commas, LF line endings
-- ESLint: unused vars prefixed with `_`, `no-console` allowed
-
-## Architecture
-
-### Entry Point
-
-`lib/mailauth.js` — exports `authenticate()` (the main all-in-one function) and individual protocol functions. The `authenticate` pipeline runs in order: DKIM verify → SPF → ARC → DMARC → BIMI, each step feeding results to the next.
-
-### Protocol Modules
-
-Each protocol lives in its own directory under `lib/`:
-
-- **`lib/dkim/`** — DKIM signing (`sign.js`, `dkim-signer.js`, `DkimSignStream`) and verification (`verify.js`, `dkim-verifier.js`). Body canonicalization in `body/` (relaxed/simple), header canonicalization in `header/` (relaxed/simple). `message-parser.js` is the streaming RFC822 parser used by both signing and verification.
-- **`lib/spf/`** — SPF verification (`spf-verify.js`), macro expansion (`macro.js`). Entry point `index.js` wraps the verifier.
-- **`lib/dmarc/`** — DMARC verification (`verify.js`) and DNS record fetching (`get-dmarc-record.js`). Takes DKIM and SPF results as input.
-- **`lib/arc/`** — ARC chain validation and seal creation. `trustlist.js` contains known ARC trust anchors.
-- **`lib/bimi/`** — BIMI record resolution and SVG validation (`validate-svg.js`). Depends on DMARC passing.
-- **`lib/mta-sts.js`** — MTA-STS policy fetching and MX validation (standalone, not part of authenticate pipeline).
-
-### Shared Utilities
-
-- **`lib/tools.js`** — DNS helpers, key parsing, header formatting, stream utilities, domain alignment checks
-- **`lib/parse-dkim-headers.js`** — Parses structured DKIM/ARC header fields
-- **`lib/parse-received.js`** — Parses Received headers
-
-### CLI
-
-`bin/mailauth.js` — yargs-based CLI with subcommands: `report`, `sign`, `seal`, `spf`, `vmc`, `bodyhash`. Command implementations in `lib/commands/`.
-
-### Tests
-
-Tests mirror the `lib/` structure under `test/`. Test fixtures in `test/fixtures/` include sample emails, DNS response caches, keys, and RFC test suite YAML files. Many tests use mock DNS resolvers that return fixture data instead of making real DNS queries.
-
-### Type Definitions
-
-`index.d.ts` and per-module `.d.ts` files provide TypeScript type definitions for consumers.
-
-### Key Design Pattern
-
-All protocol functions accept an optional `resolver` parameter (async function matching `dns.promises.resolve` signature) for DNS lookups. This enables testing with mock DNS and allows consumers to implement caching or custom resolution.
-
-## Releases
-
-Version numbers, changelogs, and releases are managed automatically by release-please via GitHub Actions. Do not manually edit `package.json` version, `CHANGELOG.md`, or release-related files.