mailauth 5.0.1 → 5.0.2

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "5.0.1"
+    ".": "5.0.2"
 }

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [5.0.2](https://github.com/postalsys/mailauth/compare/v5.0.1...v5.0.2) (2026-08-19)
+
+
+### Bug Fixes
+
+* **spf:** expand %{d} macro to the domain currently being evaluated ([#126](https://github.com/postalsys/mailauth/issues/126)) ([53c4522](https://github.com/postalsys/mailauth/commit/53c45220a1af41febb5b901c251ed4cc66de511e))
+
 ## [5.0.1](https://github.com/postalsys/mailauth/compare/v5.0.0...v5.0.1) (2026-08-07)
 
 

package/lib/spf/macro.js

@@ -12,11 +12,12 @@ const os = require('node:os');
  * @param {String} values.ip Sender IP address
  * @param {String} values.helo Client's HELO/EHLO domain
  * @param {String} [values.mta] Hostname of the MTA or MX server that processes the message
+ * @param {String} [values.domain] Domain currently being evaluated by check_host(), changes on include/redirect recursion (RFC 7208 sections 5.2, 6.1)
  */
 const macro = (input, values) => {
     input = (input || '').toString();
 
-    let { sender, ip, helo, mta } = values || {};
+    let { sender, ip, helo, mta, domain } = values || {};
 
     sender = (sender || '').toString();
     ip = (ip || '').toString();
@@ -64,11 +65,15 @@ const macro = (input, values) => {
                 break;
 
             case 'o':
-            case 'd':
             case 'p': // validated domain name is unsupported, instead we use the unvalidated sender domain
                 curval = senderDomain;
                 break;
 
+            case 'd':
+                // current <domain> of check_host(), not the sender domain (these only match at the top level)
+                curval = domain || senderDomain;
+                break;
+
             case 'i':
                 curval = ipaddr.parse(ip).toNormalizedString();
                 if (net.isIPv6(ip)) {

package/lib/spf/spf-verify.js

@@ -72,6 +72,9 @@ const spfVerify = async (domain, opts) => {
 
     let addr = ipaddr.parse(opts.ip);
 
+    // %{d} must expand to the domain currently being evaluated, which changes on include/redirect recursion
+    let macroValues = { sender: opts.sender, ip: opts.ip, helo: opts.helo, mta: opts.mta, domain };
+
     let resolver = opts.resolver || dns.resolve;
 
     let responses;
@@ -135,7 +138,7 @@ const spfVerify = async (domain, opts) => {
                 let modifier = part.substr(0, splitPos).toLowerCase();
                 let value = part.substr(splitPos + 1);
 
-                value = macro(value, opts)
+                value = macro(value, macroValues)
                     // remove trailing dot
                     .replace(/\.$/, '');
 
@@ -254,7 +257,7 @@ const spfVerify = async (domain, opts) => {
                 case 'include':
                     {
                         try {
-                            let redirect = macro(val, opts)
+                            let redirect = macro(val, macroValues)
                                 // remove trailing dot
                                 .replace(/\.$/, '');
                             let sub = await spfVerify(redirect, opts);
@@ -328,7 +331,7 @@ const spfVerify = async (domain, opts) => {
                         let { domain: a, cidr4, cidr6 } = parseCidrValue(val, domain, type);
                         let cidr = net.isIPv6(opts.ip) ? cidr6 : cidr4;
 
-                        a = macro(a, opts);
+                        a = macro(a, macroValues);
 
                         try {
                             a = punycode.toASCII(a);
@@ -354,7 +357,7 @@ const spfVerify = async (domain, opts) => {
                         let { domain: mxDomain, cidr4, cidr6 } = parseCidrValue(val, domain, type);
                         let cidr = net.isIPv6(opts.ip) ? cidr6 : cidr4;
 
-                        mxDomain = macro(mxDomain, opts);
+                        mxDomain = macro(mxDomain, macroValues);
 
                         try {
                             mxDomain = punycode.toASCII(mxDomain);
@@ -397,7 +400,7 @@ const spfVerify = async (domain, opts) => {
 
                 case 'exists':
                     {
-                        let existDomain = macro(val, opts);
+                        let existDomain = macro(val, macroValues);
                         try {
                             existDomain = punycode.toASCII(existDomain);
                         } catch (err) {
@@ -420,12 +423,8 @@ const spfVerify = async (domain, opts) => {
                             throw err;
                         }
 
-                        let ptrDomain;
-                        if (val) {
-                            ptrDomain = macro(val, opts);
-                        } else {
-                            ptrDomain = macro('%{d}', opts);
-                        }
+                        // bare "ptr" defaults to %{d}, the currently evaluated domain
+                        let ptrDomain = val ? macro(val, macroValues) : domain;
                         ptrDomain = formatDomain(ptrDomain);
 
                         // Step 1. Resolve PTR hostnames

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "5.0.1",
+    "version": "5.0.2",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",