mailauth 5.0.2 → 6.0.0

package/lib/dkim/header/relaxed.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { formatSignatureHeaderLine, formatRelaxedLine, getCurTime } = require('../../../lib/tools');
+const { formatSignatureHeaderLine, formatRelaxedLine, stripSignatureValue, getCurTime } = require('../../../lib/tools');
 
 // generate headers for signing
 const relaxedHeaders = (type, signingHeaderLines, options) => {
@@ -34,9 +34,11 @@ const relaxedHeaders = (type, signingHeaderLines, options) => {
             opts.i = instance;
         }
 
-        if (signTime) {
-            opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
-        }
+        // The same opts object formats the line that gets signed here and, once the
+        // signature exists, the line that is emitted. Leaving t= out of it lets
+        // formatSignatureHeaderLine read the clock again for the second one, and a second
+        // boundary falling between the two reads signs one timestamp and publishes another
+        opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
 
         if (expires) {
             opts.x = Math.floor(getCurTime(expires).getTime() / 1000);
@@ -55,15 +57,7 @@ const relaxedHeaders = (type, signingHeaderLines, options) => {
         );
     }
 
-    chunks.push(
-        Buffer.from(
-            formatRelaxedLine(signatureHeaderLine)
-                .toString('binary')
-                // remove value from b= key
-                .replace(/([;:\s]+b=)[^;]+/, '$1'),
-            'binary'
-        )
-    );
+    chunks.push(stripSignatureValue(formatRelaxedLine(signatureHeaderLine)));
 
     return { canonicalizedHeader: Buffer.concat(chunks), signatureHeaderLine, dkimHeaderOpts: opts };
 };

package/lib/dkim/header/simple.js

@@ -1,7 +1,7 @@
 'use strict';
 
 const { Buffer } = require('node:buffer');
-const { formatSignatureHeaderLine, getCurTime } = require('../../../lib/tools');
+const { formatSignatureHeaderLine, stripSignatureValue, getCurTime } = require('../../../lib/tools');
 
 const formatSimpleLine = (line, suffix) => Buffer.from(line.toString('binary') + (suffix ? suffix : ''), 'binary');
 
@@ -36,9 +36,11 @@ const simpleHeaders = (type, signingHeaderLines, options) => {
             opts.i = instance;
         }
 
-        if (signTime) {
-            opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
-        }
+        // The same opts object formats the line that gets signed here and, once the
+        // signature exists, the line that is emitted. Leaving t= out of it lets
+        // formatSignatureHeaderLine read the clock again for the second one, and a second
+        // boundary falling between the two reads signs one timestamp and publishes another
+        opts.t = Math.floor(getCurTime(signTime).getTime() / 1000);
 
         if (expires) {
             opts.x = Math.floor(getCurTime(expires).getTime() / 1000);
@@ -57,15 +59,7 @@ const simpleHeaders = (type, signingHeaderLines, options) => {
         );
     }
 
-    chunks.push(
-        Buffer.from(
-            formatSimpleLine(signatureHeaderLine)
-                .toString('binary')
-                // remove value from b= key
-                .replace(/([;:\s]+b=)[^;]+/, '$1'),
-            'binary'
-        )
-    );
+    chunks.push(stripSignatureValue(formatSimpleLine(signatureHeaderLine)));
 
     return { canonicalizedHeader: Buffer.concat(chunks), signatureHeaderLine, dkimHeaderOpts: opts };
 };

package/lib/dkim/message-parser.js

@@ -37,6 +37,17 @@ class MessageParser extends Writable {
         // Override in child class
     }
 
+    // Parses everything collected so far as the header block and hands it over. The body
+    // hash and the signatures are only ever built after this has run
+    async emitHeaders(chunk) {
+        this.state = 'body';
+        if (chunk) {
+            this.headerChunks.push(chunk);
+        }
+        this.headers = parseHeaders(Buffer.concat(this.headerChunks));
+        await this.messageHeaders(this.headers);
+    }
+
     async processChunk(chunk) {
         if (!chunk || !chunk.length) {
             return;
@@ -57,17 +68,12 @@ class MessageParser extends Writable {
 
                 if (b0 === 0x0a && (b1 === 0x0a || (b1 === 0x0d && b2 === 0x0a))) {
                     // found header ending
-                    this.state = 'body';
                     if (i === chunk.length - 1) {
                         //end of chunk
-                        this.headerChunks.push(chunk);
-                        this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-                        await this.messageHeaders(this.headers);
+                        await this.emitHeaders(chunk);
                         return;
                     }
-                    this.headerChunks.push(chunk.slice(0, i + 1));
-                    this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-                    await this.messageHeaders(this.headers);
+                    await this.emitHeaders(chunk.slice(0, i + 1));
                     chunk = chunk.slice(i + 1);
                     break;
                 }
@@ -132,13 +138,16 @@ class MessageParser extends Writable {
     }
 
     async finish() {
+        if (!this.headers) {
+            // no body, so no empty line ended the header block. Hand the headers out
+            // before the final chunk, which is where signatures are checked or created.
+            // An input with no bytes at all goes through here too, so that the rest of
+            // the pipeline always has a header set to look at
+            await this.emitHeaders();
+        }
+
         // generate final hash and emit it
         await this.finalChunk();
-
-        if (!this.headers && this.headerChunks.length) {
-            this.headers = parseHeaders(Buffer.concat(this.headerChunks));
-            await this.messageHeaders(this.headers);
-        }
     }
 
     _final(callback) {

package/lib/dmarc/get-dmarc-record.js

@@ -1,58 +1,38 @@
 'use strict';
 
 const dns = require('node:dns').promises;
-const tldts = require('tldts');
-const { TLDTS_OPTS } = require('../tools');
+const net = require('node:net');
+const { formatDomain } = require('../tools');
 
 // Tags whose values are ABNF literals in RFC 7489 6.4 / RFC 9989 4.7 and are therefore
 // case insensitive (RFC 5234 2.3). Values of other tags keep their case: "v" is defined
 // with explicit hex literals and is case sensitive, "rua"/"ruf" are URIs.
 const CASE_INSENSITIVE_TAGS = new Set(['p', 'sp', 'np', 'adkim', 'aspf', 'fo', 'rf', 't', 'psd']);
 
-// Returns every DMARC record published for a domain. The caller distinguishes an empty set,
-// which continues policy discovery at the organizational domain, from a multi record set,
-// which terminates it (RFC 7489 6.6.3 step 5).
 // The version tag must be the first tag and its value "DMARC1" must match precisely
 // (RFC 9989 4.7 "v"), while the ABNF allows *WSP around "=" and a case insensitive
 // tag name, hence [vV] instead of an /i flag that would also relax the value
 const DMARC_VERSION_RE = /^[vV][ \t]*=[ \t]*DMARC1[ \t]*(?:;|$)/;
 
-const resolveTxt = async (domain, resolver) => {
-    try {
-        let txt = await resolver(`_dmarc.${domain}`, 'TXT');
-        return (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
-    } catch (err) {
-        if (err.code === 'ENOTFOUND' || err.code === 'ENODATA') {
-            return [];
-        }
-        throw err;
-    }
-};
+// Resolver errors that mean the name has no record, as opposed to a transient failure.
+// EBADNAME is a name that can not exist in the DNS at all.
+const NO_RECORD_CODES = new Set(['ENOTFOUND', 'ENODATA', 'EBADNAME']);
 
-const getDmarcRecord = async (domain, resolver) => {
-    resolver = resolver || dns.resolve;
+// A Tree Walk shortens an author domain of eight or more labels straight to seven (RFC 9989 4.10 step 4)
+const WALK_MAX_LABELS = 7;
 
-    let records = await resolveTxt(domain, resolver);
-    let isOrgRecord = false;
-
-    if (!records.length) {
-        let orgDomain = tldts.getDomain(domain, TLDTS_OPTS);
-        // tldts returns null for IPs, single labels and other non-domains, and querying
-        // "_dmarc.null" would coerce that into a hostname
-        if (orgDomain && orgDomain !== domain) {
-            // try org domain as well
-            records = await resolveTxt(orgDomain, resolver);
-            isOrgRecord = true;
-        }
-    }
-
-    if (records.length !== 1) {
-        // no record, or a multi record set that terminates policy discovery
-        return false;
-    }
+// A domain literal or an IP address is not a DNS name and can not publish a DMARC record
+const isAddress = domain => domain.startsWith('[') || net.isIP(domain) !== 0;
 
-    let txt = records[0];
+// Whether "_dmarc.<name>" can exist in the DNS: no empty labels, labels of at most 63 octets
+// and a name of at most 253 octets (RFC 1035 2.3.4). Anything else would only produce a
+// resolver error that looks like a transient failure.
+const isQueryable = name => {
+    let fqdn = `_dmarc.${name}`;
+    return fqdn.length <= 253 && fqdn.split('.').every(label => label.length && label.length <= 63);
+};
 
+const parseDmarcRecord = txt => {
     let parsed = Object.fromEntries(
         txt
             .split(';')
@@ -78,9 +58,150 @@ const getDmarcRecord = async (domain, resolver) => {
     );
 
     parsed.rr = txt;
-    parsed.isOrgRecord = isOrgRecord;
 
     return parsed;
 };
 
+// Returns the DMARC Policy Record published at "_dmarc.<name>", or false. A set of several
+// records counts as no record, it is discarded (RFC 9989 4.10 steps 2 and 6).
+const fetchRecord = async (name, resolver) => {
+    if (!isQueryable(name)) {
+        return false;
+    }
+
+    let records;
+    try {
+        let txt = await resolver(`_dmarc.${name}`, 'TXT');
+        records = (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
+    } catch (err) {
+        if (NO_RECORD_CODES.has(err.code)) {
+            return false;
+        }
+        throw err;
+    }
+
+    return records.length === 1 ? parseDmarcRecord(records[0]) : false;
+};
+
+// Tree Walks for one message share most of their names, so each name is queried only once
+const createRecordLookup = resolver => {
+    resolver = resolver || dns.resolve;
+    let cache = new Map();
+    return name => {
+        if (!cache.has(name)) {
+            cache.set(name, fetchRecord(name, resolver));
+        }
+        return cache.get(name);
+    };
+};
+
+// DNS Tree Walk (RFC 9989 4.10). Returns the records found, longest name first. The walk
+// stops at a record with a psd=y or psd=n tag, or when no labels are left, so it makes
+// at most eight queries. A DNS error ends the walk and is returned next to the records
+// found before it, because a record found at the start domain is usable without the rest.
+const treeWalk = async (domain, lookup) => {
+    let found = [];
+    let labels = domain.split('.');
+
+    while (labels.length) {
+        let name = labels.join('.');
+        let record;
+        try {
+            record = await lookup(name);
+        } catch (err) {
+            return { found, error: err };
+        }
+
+        if (record) {
+            found.push({ domain: name, record });
+            if (record.psd === 'y' || record.psd === 'n') {
+                break;
+            }
+        }
+
+        labels = labels.length > WALK_MAX_LABELS ? labels.slice(-WALK_MAX_LABELS) : labels.slice(1);
+    }
+
+    return { found };
+};
+
+// Organizational Domain selection for a completed Tree Walk (RFC 9989 4.10.2)
+const selectOrgDomain = (domain, found) => {
+    for (let { domain: recordDomain, record } of found) {
+        if (record.psd === 'n') {
+            return recordDomain;
+        }
+        if (record.psd === 'y' && recordDomain !== domain) {
+            // the domain one label below the PSD
+            let labelCount = recordDomain.split('.').length + 1;
+            return domain.split('.').slice(-labelCount).join('.');
+        }
+    }
+
+    // the record with the fewest labels, or the start domain itself when nothing was found
+    return found.length ? found[found.length - 1].domain : domain;
+};
+
+// Returns the Organizational Domain of a normalized domain name. Throws on DNS errors.
+const getOrgDomain = async (domain, lookup) => {
+    if (isAddress(domain)) {
+        return domain;
+    }
+    let { found, error } = await treeWalk(domain, lookup);
+    if (error) {
+        throw error;
+    }
+    return selectOrgDomain(domain, found);
+};
+
+// DMARC Policy Discovery (RFC 9989 4.10.1) for a normalized author domain. Returns
+// { record, recordDomain, orgDomain, error }, where "record" is false when no policy applies.
+// When the Tree Walk fails after a record was found at the author domain, "orgDomain" is null
+// and "error" says why. Throws on DNS errors that leave the policy unknown.
+const discoverPolicy = async (domain, lookup) => {
+    if (isAddress(domain)) {
+        return { record: false, recordDomain: null, orgDomain: domain };
+    }
+
+    let { found, error } = await treeWalk(domain, lookup);
+
+    if (found[0]?.domain === domain) {
+        // the author domain's own record applies regardless of what is above it
+        return { record: found[0].record, recordDomain: domain, orgDomain: error ? null : selectOrgDomain(domain, found), error };
+    }
+
+    if (error) {
+        throw error;
+    }
+
+    let orgDomain = selectOrgDomain(domain, found);
+
+    // otherwise the record of the Organizational Domain, and failing that the record of the PSD.
+    // A walk only stops at a psd tag, so a psd=y record can only be the last one found.
+    let last = found[found.length - 1];
+    let entry = found.find(e => e.domain === orgDomain) || (last?.record.psd === 'y' ? last : null);
+
+    return { record: entry ? entry.record : false, recordDomain: entry ? entry.domain : null, orgDomain };
+};
+
+// Fetches the DMARC Policy Record that applies to a domain. Returns the parsed record or false.
+const getDmarcRecord = async (domain, resolver) => {
+    domain = formatDomain(domain || '');
+
+    let { record, recordDomain, orgDomain } = await discoverPolicy(domain, createRecordLookup(resolver));
+    if (!record) {
+        return false;
+    }
+
+    return Object.assign(record, {
+        // the record is inherited from the Organizational Domain or the PSD
+        isOrgRecord: recordDomain !== domain,
+        recordDomain,
+        orgDomain
+    });
+};
+
 module.exports = getDmarcRecord;
+module.exports.createRecordLookup = createRecordLookup;
+module.exports.discoverPolicy = discoverPolicy;
+module.exports.getOrgDomain = getOrgDomain;

package/lib/dmarc/index.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const verifyDmarc = require('./verify');
+const { evaluateDmarc } = verifyDmarc;
 
 const dmarc = async opts => verifyDmarc(opts);
 
-module.exports = { dmarc };
+module.exports = { dmarc, evaluateDmarc };

package/lib/dmarc/verify.js

@@ -1,22 +1,22 @@
 'use strict';
 
-const dns = require('node:dns').promises;
 const punycode = require('punycode.js');
-const tldts = require('tldts');
-const { formatAuthHeaderRow, getAlignment, TLDTS_OPTS } = require('../tools');
-const getDmarcRecord = require('./get-dmarc-record');
+const { formatAuthHeaderRow, formatDomain } = require('../tools');
+const { createRecordLookup, discoverPolicy, getOrgDomain } = require('./get-dmarc-record');
 
-const verifyDmarc = async opts => {
-    let { headerFrom, spfDomains, dkimDomains, resolver, arcResult } = opts;
+// Every Tree Walk is capped at eight queries, but the number of walks is not (RFC 9989 4.10.2),
+// so a message can only make this many identifiers walk for relaxed alignment. The rest do not align.
+const MAX_ALIGNMENT_WALKS = 10;
 
-    resolver = resolver || dns.resolve;
+const evaluateDmarc = async opts => {
+    let { headerFrom, spfDomains, dkimDomains, resolver, arcResult } = opts;
 
     if (Array.isArray(headerFrom)) {
         if (headerFrom.length === 1) {
             headerFrom = headerFrom[0];
         } else {
             // invalid number of FROM addresses found
-            return false;
+            return { response: false };
         }
     }
 
@@ -31,6 +31,9 @@ const verifyDmarc = async opts => {
         // ignore punycode conversion errors
     }
 
+    // the name to query and compare, "example.com." and "example.com" are the same domain
+    const authorDomain = formatDomain(domain);
+
     let formatResponse = response => {
         response.info = formatAuthHeaderRow('dmarc', response.status);
 
@@ -41,8 +44,6 @@ const verifyDmarc = async opts => {
         return response;
     };
 
-    let orgDomain = tldts.getDomain(domain, TLDTS_OPTS);
-
     let status = {
         result: 'neutral',
         comment: false,
@@ -54,24 +55,28 @@ const verifyDmarc = async opts => {
         }
     };
 
-    let dmarcRecord;
+    const lookup = createRecordLookup(resolver);
+
+    let policyDiscovery;
     try {
-        dmarcRecord = await getDmarcRecord(domain, resolver);
+        policyDiscovery = await discoverPolicy(authorDomain, lookup);
     } catch (err) {
         // temperror?
         status.result = 'temperror';
-        return formatResponse({ status, domain: orgDomain || domain, error: err.message });
+        return { response: formatResponse({ status, domain: authorDomain, error: err.message }) };
     }
 
+    let { record: dmarcRecord, recordDomain, orgDomain } = policyDiscovery;
+
     if (!dmarcRecord) {
         // nothing to do here
         // none
         status.result = 'none';
-        return formatResponse({ status, domain: orgDomain || domain });
+        return { response: formatResponse({ status, domain: orgDomain }) };
     }
 
     // the domain the applied policy record was published at
-    status.header.d = dmarcRecord.isOrgRecord ? orgDomain : domain;
+    status.header.d = recordDomain;
 
     status.comment = []
         .concat(dmarcRecord.p ? `p=${dmarcRecord.p.toUpperCase()}` : [])
@@ -79,31 +84,84 @@ const verifyDmarc = async opts => {
         .concat(arcResult?.status?.result ? `arc=${arcResult?.status?.result}` : [])
         .join(' ');
 
-    // use "sp" if this is a subdomain of an org domain and "sp" is set, otherwise use "p"
-    const policy = dmarcRecord.isOrgRecord && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
+    // use "sp" if the record was inherited by a subdomain and "sp" is set, otherwise use "p"
+    const policy = recordDomain !== authorDomain && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
 
     const adkimStrict = dmarcRecord.adkim === 's';
     const aspfStrict = dmarcRecord.aspf === 's';
 
-    const dkimAlignment = getAlignment(domain, dkimDomains, adkimStrict);
-    const spfAlignment = getAlignment(domain, spfDomains, aspfStrict);
+    // Relaxed alignment compares Organizational Domains found by Tree Walks (RFC 9989 4.10.2).
+    // An identifier's Organizational Domain is always the identifier itself or one of its
+    // parents, so only identifiers at or below the author's Organizational Domain need a walk.
+    let orgDomains = new Map();
+    // throws when a Tree Walk the answer depends on failed
+    const alignsRelaxed = async entryDomain => {
+        if (entryDomain === authorDomain) {
+            return true;
+        }
+        if (!orgDomain) {
+            // the author's own Tree Walk failed, so there is nothing to compare against
+            throw policyDiscovery.error;
+        }
+        if (entryDomain !== orgDomain && !entryDomain.endsWith(`.${orgDomain}`)) {
+            return false;
+        }
+        if (!orgDomains.has(entryDomain)) {
+            if (orgDomains.size >= MAX_ALIGNMENT_WALKS) {
+                return false;
+            }
+            orgDomains.set(entryDomain, getOrgDomain(entryDomain, lookup));
+        }
+        return (await orgDomains.get(entryDomain)) === orgDomain;
+    };
+
+    // Returns every entry that aligns, most preferred first, and the first walk error seen.
+    // Signatures with an l= tag come last, so that a signature covering the whole body is
+    // reported when several align.
+    const findAligned = async (entries, strict) => {
+        let list = []
+            .concat(entries || [])
+            .map(entry => (typeof entry === 'string' ? { domain: entry } : entry))
+            .filter(entry => entry && typeof entry.domain === 'string')
+            .sort((a, b) => (a.underSized || 0) - (b.underSized || 0));
+
+        let aligned = [];
+        let error = null;
+        for (let entry of list) {
+            let entryDomain = formatDomain(entry.domain);
+            if (!authorDomain || !entryDomain) {
+                // a bare root label normalizes to an empty string, which must not align with anything
+                continue;
+            }
+            try {
+                if (strict ? entryDomain === authorDomain : await alignsRelaxed(entryDomain)) {
+                    aligned.push(entry);
+                }
+            } catch (err) {
+                error = error || err;
+            }
+        }
+
+        return { aligned, error };
+    };
+
+    // SPF first, so a flood of DKIM signatures can not use up the walks it needs
+    const spf = await findAligned(spfDomains, aspfStrict);
+    // every signature is checked, so that each one's own alignment can be reported
+    const dkim = await findAligned(dkimDomains, adkimStrict);
+    const spfAlignment = spf.aligned[0];
+    const dkimAlignment = dkim.aligned[0];
+    const walkError = spf.error || dkim.error;
 
     // "underSized" warns that a passing DKIM signature covers only part of the body (l= tag).
     // It describes the signature rather than the alignment mode, so it is still reported when
-    // strict alignment rejected a signature that aligns at the org level.
-    const underSized = (adkimStrict && !dkimAlignment ? getAlignment(domain, dkimDomains, false) : dkimAlignment)?.underSized;
-
-    if (dkimAlignment || spfAlignment) {
-        // pass
-        status.result = 'pass';
-    } else {
-        // fail
-        status.result = 'fail';
-    }
+    // strict alignment rejected a signature that aligns at the org level. A walk that fails
+    // for this warning alone does not affect the result.
+    const underSized = adkimStrict && !dkimAlignment ? (await findAligned(dkimDomains, false)).aligned[0]?.underSized : dkimAlignment?.underSized;
 
-    return formatResponse({
+    let response = {
         status,
-        domain: orgDomain || domain,
+        domain: orgDomain || authorDomain,
         policy,
         p: dmarcRecord.p,
         sp: dmarcRecord.sp || dmarcRecord.p,
@@ -114,7 +172,25 @@ const verifyDmarc = async opts => {
             spf: { result: spfAlignment?.domain, strict: aspfStrict },
             dkim: { result: dkimAlignment?.domain, strict: adkimStrict, underSized }
         }
-    });
+    };
+
+    if (dkimAlignment || spfAlignment) {
+        // pass
+        status.result = 'pass';
+    } else if (walkError) {
+        // an identifier might have aligned if its Tree Walk had not failed
+        status.result = 'temperror';
+        response.error = walkError.message;
+    } else {
+        // fail
+        status.result = 'fail';
+    }
+
+    return { response: formatResponse(response), dkimAligned: new Set(dkim.aligned.map(entry => formatDomain(entry.domain))) };
 };
 
+const verifyDmarc = async opts => (await evaluateDmarc(opts)).response;
+
 module.exports = verifyDmarc;
+// also returns the signing domains that aligned, for the per signature flags of authenticate()
+module.exports.evaluateDmarc = evaluateDmarc;

package/lib/mailauth.js

@@ -3,12 +3,12 @@
 const { dkimSign, DkimSignStream } = require('./dkim/sign');
 const { dkimVerify } = require('./dkim/verify');
 const { spf } = require('./spf');
-const { dmarc } = require('./dmarc');
+const { dmarc, evaluateDmarc } = require('./dmarc');
 const { arc, createSeal, sealMessage, getARChain, verifyASChain } = require('./arc');
 const { bimi, validateVMC: validateBimiVmc } = require('./bimi');
 const { validateSvg: validateBimiSvg } = require('./bimi/validate-svg');
 const { parseReceived } = require('./parse-received');
-const { getAlignment } = require('./tools');
+const { formatDomain, getAlignment } = require('./tools');
 const libmime = require('libmime');
 const os = require('node:os');
 const { isIP } = require('net');
@@ -117,7 +117,8 @@ const authenticate = async (input, opts) => {
 
     let dmarcResult;
     if (!opts.disableDmarc && dkimResult?.headerFrom) {
-        dmarcResult = await dmarc({
+        let dkimAligned;
+        ({ response: dmarcResult, dkimAligned } = await evaluateDmarc({
             headerFrom: dkimResult.headerFrom,
             spfDomains: [].concat((spfResult && spfResult.status.result === 'pass' && spfResult.domain) || []),
             dkimDomains: (dkimResult.results || [])
@@ -130,16 +131,22 @@ const authenticate = async (input, opts) => {
                 })),
             arcResult,
             resolver: opts.resolver
-        });
+        }));
         if (dmarcResult.info) {
             arHeader.push(`${libmime.foldLines(dmarcResult.info, 160)}`);
         }
 
-        if (dmarcResult.alignment?.dkim?.strict) {
-            // the DKIM verifier only knows relaxed alignment, it runs before the DMARC record
+        if (dkimAligned) {
+            // The DKIM verifier runs before the DMARC record and the Tree Walks are known, so its
+            // per signature flag only guesses relaxed alignment from the Public Suffix List.
+            // Passing signatures take the DMARC verdict, failing ones the record's alignment mode.
             let fromDomain = dmarcResult.status.header.from;
             for (let row of dkimResult.results || []) {
-                row.status.aligned = (row.status.aligned && getAlignment(fromDomain, [row.signingDomain], true)?.domain) || false;
+                if (row.status.result === 'pass') {
+                    row.status.aligned = dkimAligned.has(formatDomain(row.signingDomain)) ? row.signingDomain : false;
+                } else if (dmarcResult.alignment.dkim.strict) {
+                    row.status.aligned = (row.status.aligned && getAlignment(fromDomain, [row.signingDomain], true)?.domain) || false;
+                }
             }
         }
     }
@@ -184,6 +191,12 @@ const authenticate = async (input, opts) => {
             seal
         });
 
+        if (sealResult?.errors?.length) {
+            // sealing failed, usually an unusable key. The message goes out unsealed, so
+            // say why somewhere the caller can find it rather than dropping it silently
+            arcResult.sealErrors = sealResult.errors;
+        }
+
         sealResult?.headers?.reverse().forEach(header => headers.unshift(header));
     }