mailauth 5.0.3 → 6.0.0

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-    ".": "5.0.3"
+    ".": "6.0.0"
 }

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## [6.0.0](https://github.com/postalsys/mailauth/compare/v5.0.3...v6.0.0) (2026-09-26)
+
+
+### ⚠ BREAKING CHANGES
+
+* **dmarc:** DMARC verdicts can change. A subdomain whose parent publishes no record is now its own Organizational Domain, so a signature or SPF domain of the parent no longer aligns with it. Subdomains of names the Public Suffix List lists as suffixes but that publish a DMARC record (for example blogspot.com) now inherit that policy. The result's domain is the Tree Walk Organizational Domain, and is the author domain when no record is found.
+
+### Features
+
+* **dmarc:** find policies and organizational domains with the RFC 9989 DNS Tree Walk ([8ab1da2](https://github.com/postalsys/mailauth/commit/8ab1da24aa5f1be7939393bd79a9834802aa911d))
+
 ## [5.0.3](https://github.com/postalsys/mailauth/compare/v5.0.2...v5.0.3) (2026-09-03)
 
 

package/README.md

@@ -433,7 +433,7 @@ See [DMARC Result Reference](docs/dmarc.md) for details on the result object str
 
 ##### `getDmarcRecord(domain [, resolver])`
 
-Fetches and parses the DMARC DNS record for a domain or subdomain. Returns `false` if no record exists.
+Fetches and parses the DMARC record that applies to a domain, found with the DNS Tree Walk of RFC 9989 section 4.10. That is the domain's own record, or else the record of its Organizational Domain, or else a record published with `psd=y` above it. Returns `false` if no record applies.
 
 ###### Syntax
 
@@ -469,10 +469,14 @@ console.log(dmarcRecord);
     "sp": "none",
     "aspf": "r",
     "rr": "v=DMARC1; p=none; pct=100; rua=mailto:re+joqy8fpatm3@dmarc.postmarkapp.com; sp=none; aspf=r;",
-    "isOrgRecord": false
+    "isOrgRecord": false,
+    "recordDomain": "ethereal.email",
+    "orgDomain": "ethereal.email"
 }
 ```
 
+`isOrgRecord` is `true` when the record was inherited from the Organizational Domain or a PSD, and `recordDomain` is where it was published. `orgDomain` is `null` when the record was found at the domain itself but the rest of the Tree Walk failed.
+
 ### BIMI
 
 Brand Indicators for Message Identification (BIMI) support is based on [draft-blank-ietf-bimi-02](https://tools.ietf.org/html/draft-blank-ietf-bimi-02). BIMI information is resolved during the authentication step, provided the message passes DMARC validation with a policy other than "none".

package/docs/dmarc.md

@@ -6,6 +6,8 @@ This document describes the result object returned by DMARC verification.
 
 DMARC (Domain-based Message Authentication, Reporting, and Conformance) is verified during the authentication process. The DMARC result depends on both SPF and DKIM verification results.
 
+Policy discovery and Organizational Domains follow the DNS Tree Walk of RFC 9989 section 4.10, not the Public Suffix List. The policy is taken from the record of the author domain, or else from the record of its Organizational Domain, or else from a record published with `psd=y` above it. Relaxed alignment compares the Organizational Domains of the author domain and of each authenticated identifier, which can take further walks. A walk makes at most eight queries, lookups are shared within a message, only identifiers at or below the author's Organizational Domain are walked, and at most ten identifiers per message are walked.
+
 ```javascript
 const { authenticate } = require('mailauth');
 
@@ -21,7 +23,7 @@ const { dmarc } = await authenticate(message, {
 | Field       | Type     | Presence     | Description                                                |
 | ----------- | -------- | ------------ | ---------------------------------------------------------- |
 | `status`    | `object` | Always       | Verification status object (see below)                     |
-| `domain`    | `string` | Always       | Organizational domain used for DMARC lookup                |
+| `domain`    | `string` | Always       | Organizational Domain of the author domain (Tree Walk)     |
 | `policy`    | `string` | Record found | Effective policy (`"reject"`, `"quarantine"`, or `"none"`) |
 | `p`         | `string` | Record found | Policy from `p=` tag                                       |
 | `sp`        | `string` | Record found | Subdomain policy from `sp=` tag (defaults to `p` value)    |
@@ -29,7 +31,9 @@ const { dmarc } = await authenticate(message, {
 | `rr`        | `string` | Record found | Raw DMARC DNS TXT record                                   |
 | `alignment` | `object` | Record found | SPF and DKIM alignment details (see below)                 |
 | `error`     | `string` | On temperror | Error message                                              |
-| `info`      | `string` | Always       | Formatted Authentication-Results header value              |
+
+On a `temperror` that happens after a record was found, because a Tree Walk needed for relaxed alignment failed and no other identifier aligned, `policy`, `p`, `sp`, `rr` and `alignment` are still set.
+| `info` | `string` | Always | Formatted Authentication-Results header value |
 
 ## status Object
 
@@ -41,10 +45,10 @@ const { dmarc } = await authenticate(message, {
 
 ### status.header Object
 
-| Field  | Type     | Description                         |
-| ------ | -------- | ----------------------------------- |
-| `from` | `string` | Domain of the From header address   |
-| `d`    | `string` | Domain where DMARC record was found |
+| Field  | Type     | Description                                                                             |
+| ------ | -------- | --------------------------------------------------------------------------------------- |
+| `from` | `string` | Domain of the From header address                                                       |
+| `d`    | `string` | Domain where the applied DMARC record was found (author, Organizational Domain, or PSD) |
 
 ## alignment Object
 
@@ -72,12 +76,12 @@ const { dmarc } = await authenticate(message, {
 
 ## Result Values
 
-| Result      | Description                                           |
-| ----------- | ----------------------------------------------------- |
-| `pass`      | Message passed DMARC (SPF or DKIM aligned and passed) |
-| `fail`      | Message failed DMARC (neither SPF nor DKIM aligned)   |
-| `none`      | No DMARC record found                                 |
-| `temperror` | Temporary error during DNS lookup                     |
+| Result      | Description                                                    |
+| ----------- | -------------------------------------------------------------- |
+| `pass`      | Message passed DMARC (SPF or DKIM aligned and passed)          |
+| `fail`      | Message failed DMARC (neither SPF nor DKIM aligned)            |
+| `none`      | No DMARC record found                                          |
+| `temperror` | Temporary error during a DNS lookup that the result depends on |
 
 ## Policy Values
 
@@ -168,7 +172,7 @@ For example: `"p=REJECT sp=REJECT arc=pass"`
             "from": "no-dmarc.example.com"
         }
     },
-    "domain": "example.com",
+    "domain": "no-dmarc.example.com",
     "info": "dmarc=none header.from=no-dmarc.example.com"
 }
 ```

package/index.d.ts

@@ -180,7 +180,9 @@ export interface DKIMResult {
      */
     status: AuthStatus & {
         /**
-         * Signing domain if it aligns with the From domain, false otherwise
+         * Signing domain if it aligns with the From domain, false otherwise. For a passing
+         * signature this follows the DMARC verdict once DMARC found a record, before that it
+         * only guesses relaxed alignment from the Public Suffix List.
          */
         aligned?: string | false;
 
@@ -366,7 +368,7 @@ export interface ARCResult {
  */
 export interface DMARCResult {
     /**
-     * Organization domain
+     * Organizational Domain of the author domain, found with the DNS Tree Walk (RFC 9989 4.10)
      */
     domain: string;
 

package/lib/dmarc/get-dmarc-record.js

@@ -1,58 +1,38 @@
 'use strict';
 
 const dns = require('node:dns').promises;
-const tldts = require('tldts');
-const { TLDTS_OPTS } = require('../tools');
+const net = require('node:net');
+const { formatDomain } = require('../tools');
 
 // Tags whose values are ABNF literals in RFC 7489 6.4 / RFC 9989 4.7 and are therefore
 // case insensitive (RFC 5234 2.3). Values of other tags keep their case: "v" is defined
 // with explicit hex literals and is case sensitive, "rua"/"ruf" are URIs.
 const CASE_INSENSITIVE_TAGS = new Set(['p', 'sp', 'np', 'adkim', 'aspf', 'fo', 'rf', 't', 'psd']);
 
-// Returns every DMARC record published for a domain. The caller distinguishes an empty set,
-// which continues policy discovery at the organizational domain, from a multi record set,
-// which terminates it (RFC 7489 6.6.3 step 5).
 // The version tag must be the first tag and its value "DMARC1" must match precisely
 // (RFC 9989 4.7 "v"), while the ABNF allows *WSP around "=" and a case insensitive
 // tag name, hence [vV] instead of an /i flag that would also relax the value
 const DMARC_VERSION_RE = /^[vV][ \t]*=[ \t]*DMARC1[ \t]*(?:;|$)/;
 
-const resolveTxt = async (domain, resolver) => {
-    try {
-        let txt = await resolver(`_dmarc.${domain}`, 'TXT');
-        return (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
-    } catch (err) {
-        if (err.code === 'ENOTFOUND' || err.code === 'ENODATA') {
-            return [];
-        }
-        throw err;
-    }
-};
+// Resolver errors that mean the name has no record, as opposed to a transient failure.
+// EBADNAME is a name that can not exist in the DNS at all.
+const NO_RECORD_CODES = new Set(['ENOTFOUND', 'ENODATA', 'EBADNAME']);
 
-const getDmarcRecord = async (domain, resolver) => {
-    resolver = resolver || dns.resolve;
+// A Tree Walk shortens an author domain of eight or more labels straight to seven (RFC 9989 4.10 step 4)
+const WALK_MAX_LABELS = 7;
 
-    let records = await resolveTxt(domain, resolver);
-    let isOrgRecord = false;
-
-    if (!records.length) {
-        let orgDomain = tldts.getDomain(domain, TLDTS_OPTS);
-        // tldts returns null for IPs, single labels and other non-domains, and querying
-        // "_dmarc.null" would coerce that into a hostname
-        if (orgDomain && orgDomain !== domain) {
-            // try org domain as well
-            records = await resolveTxt(orgDomain, resolver);
-            isOrgRecord = true;
-        }
-    }
-
-    if (records.length !== 1) {
-        // no record, or a multi record set that terminates policy discovery
-        return false;
-    }
+// A domain literal or an IP address is not a DNS name and can not publish a DMARC record
+const isAddress = domain => domain.startsWith('[') || net.isIP(domain) !== 0;
 
-    let txt = records[0];
+// Whether "_dmarc.<name>" can exist in the DNS: no empty labels, labels of at most 63 octets
+// and a name of at most 253 octets (RFC 1035 2.3.4). Anything else would only produce a
+// resolver error that looks like a transient failure.
+const isQueryable = name => {
+    let fqdn = `_dmarc.${name}`;
+    return fqdn.length <= 253 && fqdn.split('.').every(label => label.length && label.length <= 63);
+};
 
+const parseDmarcRecord = txt => {
     let parsed = Object.fromEntries(
         txt
             .split(';')
@@ -78,9 +58,150 @@ const getDmarcRecord = async (domain, resolver) => {
     );
 
     parsed.rr = txt;
-    parsed.isOrgRecord = isOrgRecord;
 
     return parsed;
 };
 
+// Returns the DMARC Policy Record published at "_dmarc.<name>", or false. A set of several
+// records counts as no record, it is discarded (RFC 9989 4.10 steps 2 and 6).
+const fetchRecord = async (name, resolver) => {
+    if (!isQueryable(name)) {
+        return false;
+    }
+
+    let records;
+    try {
+        let txt = await resolver(`_dmarc.${name}`, 'TXT');
+        records = (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
+    } catch (err) {
+        if (NO_RECORD_CODES.has(err.code)) {
+            return false;
+        }
+        throw err;
+    }
+
+    return records.length === 1 ? parseDmarcRecord(records[0]) : false;
+};
+
+// Tree Walks for one message share most of their names, so each name is queried only once
+const createRecordLookup = resolver => {
+    resolver = resolver || dns.resolve;
+    let cache = new Map();
+    return name => {
+        if (!cache.has(name)) {
+            cache.set(name, fetchRecord(name, resolver));
+        }
+        return cache.get(name);
+    };
+};
+
+// DNS Tree Walk (RFC 9989 4.10). Returns the records found, longest name first. The walk
+// stops at a record with a psd=y or psd=n tag, or when no labels are left, so it makes
+// at most eight queries. A DNS error ends the walk and is returned next to the records
+// found before it, because a record found at the start domain is usable without the rest.
+const treeWalk = async (domain, lookup) => {
+    let found = [];
+    let labels = domain.split('.');
+
+    while (labels.length) {
+        let name = labels.join('.');
+        let record;
+        try {
+            record = await lookup(name);
+        } catch (err) {
+            return { found, error: err };
+        }
+
+        if (record) {
+            found.push({ domain: name, record });
+            if (record.psd === 'y' || record.psd === 'n') {
+                break;
+            }
+        }
+
+        labels = labels.length > WALK_MAX_LABELS ? labels.slice(-WALK_MAX_LABELS) : labels.slice(1);
+    }
+
+    return { found };
+};
+
+// Organizational Domain selection for a completed Tree Walk (RFC 9989 4.10.2)
+const selectOrgDomain = (domain, found) => {
+    for (let { domain: recordDomain, record } of found) {
+        if (record.psd === 'n') {
+            return recordDomain;
+        }
+        if (record.psd === 'y' && recordDomain !== domain) {
+            // the domain one label below the PSD
+            let labelCount = recordDomain.split('.').length + 1;
+            return domain.split('.').slice(-labelCount).join('.');
+        }
+    }
+
+    // the record with the fewest labels, or the start domain itself when nothing was found
+    return found.length ? found[found.length - 1].domain : domain;
+};
+
+// Returns the Organizational Domain of a normalized domain name. Throws on DNS errors.
+const getOrgDomain = async (domain, lookup) => {
+    if (isAddress(domain)) {
+        return domain;
+    }
+    let { found, error } = await treeWalk(domain, lookup);
+    if (error) {
+        throw error;
+    }
+    return selectOrgDomain(domain, found);
+};
+
+// DMARC Policy Discovery (RFC 9989 4.10.1) for a normalized author domain. Returns
+// { record, recordDomain, orgDomain, error }, where "record" is false when no policy applies.
+// When the Tree Walk fails after a record was found at the author domain, "orgDomain" is null
+// and "error" says why. Throws on DNS errors that leave the policy unknown.
+const discoverPolicy = async (domain, lookup) => {
+    if (isAddress(domain)) {
+        return { record: false, recordDomain: null, orgDomain: domain };
+    }
+
+    let { found, error } = await treeWalk(domain, lookup);
+
+    if (found[0]?.domain === domain) {
+        // the author domain's own record applies regardless of what is above it
+        return { record: found[0].record, recordDomain: domain, orgDomain: error ? null : selectOrgDomain(domain, found), error };
+    }
+
+    if (error) {
+        throw error;
+    }
+
+    let orgDomain = selectOrgDomain(domain, found);
+
+    // otherwise the record of the Organizational Domain, and failing that the record of the PSD.
+    // A walk only stops at a psd tag, so a psd=y record can only be the last one found.
+    let last = found[found.length - 1];
+    let entry = found.find(e => e.domain === orgDomain) || (last?.record.psd === 'y' ? last : null);
+
+    return { record: entry ? entry.record : false, recordDomain: entry ? entry.domain : null, orgDomain };
+};
+
+// Fetches the DMARC Policy Record that applies to a domain. Returns the parsed record or false.
+const getDmarcRecord = async (domain, resolver) => {
+    domain = formatDomain(domain || '');
+
+    let { record, recordDomain, orgDomain } = await discoverPolicy(domain, createRecordLookup(resolver));
+    if (!record) {
+        return false;
+    }
+
+    return Object.assign(record, {
+        // the record is inherited from the Organizational Domain or the PSD
+        isOrgRecord: recordDomain !== domain,
+        recordDomain,
+        orgDomain
+    });
+};
+
 module.exports = getDmarcRecord;
+module.exports.createRecordLookup = createRecordLookup;
+module.exports.discoverPolicy = discoverPolicy;
+module.exports.getOrgDomain = getOrgDomain;

package/lib/dmarc/index.js

@@ -1,7 +1,8 @@
 'use strict';
 
 const verifyDmarc = require('./verify');
+const { evaluateDmarc } = verifyDmarc;
 
 const dmarc = async opts => verifyDmarc(opts);
 
-module.exports = { dmarc };
+module.exports = { dmarc, evaluateDmarc };

package/lib/dmarc/verify.js

@@ -1,22 +1,22 @@
 'use strict';
 
-const dns = require('node:dns').promises;
 const punycode = require('punycode.js');
-const tldts = require('tldts');
-const { formatAuthHeaderRow, getAlignment, TLDTS_OPTS } = require('../tools');
-const getDmarcRecord = require('./get-dmarc-record');
+const { formatAuthHeaderRow, formatDomain } = require('../tools');
+const { createRecordLookup, discoverPolicy, getOrgDomain } = require('./get-dmarc-record');
 
-const verifyDmarc = async opts => {
-    let { headerFrom, spfDomains, dkimDomains, resolver, arcResult } = opts;
+// Every Tree Walk is capped at eight queries, but the number of walks is not (RFC 9989 4.10.2),
+// so a message can only make this many identifiers walk for relaxed alignment. The rest do not align.
+const MAX_ALIGNMENT_WALKS = 10;
 
-    resolver = resolver || dns.resolve;
+const evaluateDmarc = async opts => {
+    let { headerFrom, spfDomains, dkimDomains, resolver, arcResult } = opts;
 
     if (Array.isArray(headerFrom)) {
         if (headerFrom.length === 1) {
             headerFrom = headerFrom[0];
         } else {
             // invalid number of FROM addresses found
-            return false;
+            return { response: false };
         }
     }
 
@@ -31,6 +31,9 @@ const verifyDmarc = async opts => {
         // ignore punycode conversion errors
     }
 
+    // the name to query and compare, "example.com." and "example.com" are the same domain
+    const authorDomain = formatDomain(domain);
+
     let formatResponse = response => {
         response.info = formatAuthHeaderRow('dmarc', response.status);
 
@@ -41,8 +44,6 @@ const verifyDmarc = async opts => {
         return response;
     };
 
-    let orgDomain = tldts.getDomain(domain, TLDTS_OPTS);
-
     let status = {
         result: 'neutral',
         comment: false,
@@ -54,24 +55,28 @@ const verifyDmarc = async opts => {
         }
     };
 
-    let dmarcRecord;
+    const lookup = createRecordLookup(resolver);
+
+    let policyDiscovery;
     try {
-        dmarcRecord = await getDmarcRecord(domain, resolver);
+        policyDiscovery = await discoverPolicy(authorDomain, lookup);
     } catch (err) {
         // temperror?
         status.result = 'temperror';
-        return formatResponse({ status, domain: orgDomain || domain, error: err.message });
+        return { response: formatResponse({ status, domain: authorDomain, error: err.message }) };
     }
 
+    let { record: dmarcRecord, recordDomain, orgDomain } = policyDiscovery;
+
     if (!dmarcRecord) {
         // nothing to do here
         // none
         status.result = 'none';
-        return formatResponse({ status, domain: orgDomain || domain });
+        return { response: formatResponse({ status, domain: orgDomain }) };
     }
 
     // the domain the applied policy record was published at
-    status.header.d = dmarcRecord.isOrgRecord ? orgDomain : domain;
+    status.header.d = recordDomain;
 
     status.comment = []
         .concat(dmarcRecord.p ? `p=${dmarcRecord.p.toUpperCase()}` : [])
@@ -79,31 +84,84 @@ const verifyDmarc = async opts => {
         .concat(arcResult?.status?.result ? `arc=${arcResult?.status?.result}` : [])
         .join(' ');
 
-    // use "sp" if this is a subdomain of an org domain and "sp" is set, otherwise use "p"
-    const policy = dmarcRecord.isOrgRecord && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
+    // use "sp" if the record was inherited by a subdomain and "sp" is set, otherwise use "p"
+    const policy = recordDomain !== authorDomain && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
 
     const adkimStrict = dmarcRecord.adkim === 's';
     const aspfStrict = dmarcRecord.aspf === 's';
 
-    const dkimAlignment = getAlignment(domain, dkimDomains, adkimStrict);
-    const spfAlignment = getAlignment(domain, spfDomains, aspfStrict);
+    // Relaxed alignment compares Organizational Domains found by Tree Walks (RFC 9989 4.10.2).
+    // An identifier's Organizational Domain is always the identifier itself or one of its
+    // parents, so only identifiers at or below the author's Organizational Domain need a walk.
+    let orgDomains = new Map();
+    // throws when a Tree Walk the answer depends on failed
+    const alignsRelaxed = async entryDomain => {
+        if (entryDomain === authorDomain) {
+            return true;
+        }
+        if (!orgDomain) {
+            // the author's own Tree Walk failed, so there is nothing to compare against
+            throw policyDiscovery.error;
+        }
+        if (entryDomain !== orgDomain && !entryDomain.endsWith(`.${orgDomain}`)) {
+            return false;
+        }
+        if (!orgDomains.has(entryDomain)) {
+            if (orgDomains.size >= MAX_ALIGNMENT_WALKS) {
+                return false;
+            }
+            orgDomains.set(entryDomain, getOrgDomain(entryDomain, lookup));
+        }
+        return (await orgDomains.get(entryDomain)) === orgDomain;
+    };
+
+    // Returns every entry that aligns, most preferred first, and the first walk error seen.
+    // Signatures with an l= tag come last, so that a signature covering the whole body is
+    // reported when several align.
+    const findAligned = async (entries, strict) => {
+        let list = []
+            .concat(entries || [])
+            .map(entry => (typeof entry === 'string' ? { domain: entry } : entry))
+            .filter(entry => entry && typeof entry.domain === 'string')
+            .sort((a, b) => (a.underSized || 0) - (b.underSized || 0));
+
+        let aligned = [];
+        let error = null;
+        for (let entry of list) {
+            let entryDomain = formatDomain(entry.domain);
+            if (!authorDomain || !entryDomain) {
+                // a bare root label normalizes to an empty string, which must not align with anything
+                continue;
+            }
+            try {
+                if (strict ? entryDomain === authorDomain : await alignsRelaxed(entryDomain)) {
+                    aligned.push(entry);
+                }
+            } catch (err) {
+                error = error || err;
+            }
+        }
+
+        return { aligned, error };
+    };
+
+    // SPF first, so a flood of DKIM signatures can not use up the walks it needs
+    const spf = await findAligned(spfDomains, aspfStrict);
+    // every signature is checked, so that each one's own alignment can be reported
+    const dkim = await findAligned(dkimDomains, adkimStrict);
+    const spfAlignment = spf.aligned[0];
+    const dkimAlignment = dkim.aligned[0];
+    const walkError = spf.error || dkim.error;
 
     // "underSized" warns that a passing DKIM signature covers only part of the body (l= tag).
     // It describes the signature rather than the alignment mode, so it is still reported when
-    // strict alignment rejected a signature that aligns at the org level.
-    const underSized = (adkimStrict && !dkimAlignment ? getAlignment(domain, dkimDomains, false) : dkimAlignment)?.underSized;
-
-    if (dkimAlignment || spfAlignment) {
-        // pass
-        status.result = 'pass';
-    } else {
-        // fail
-        status.result = 'fail';
-    }
+    // strict alignment rejected a signature that aligns at the org level. A walk that fails
+    // for this warning alone does not affect the result.
+    const underSized = adkimStrict && !dkimAlignment ? (await findAligned(dkimDomains, false)).aligned[0]?.underSized : dkimAlignment?.underSized;
 
-    return formatResponse({
+    let response = {
         status,
-        domain: orgDomain || domain,
+        domain: orgDomain || authorDomain,
         policy,
         p: dmarcRecord.p,
         sp: dmarcRecord.sp || dmarcRecord.p,
@@ -114,7 +172,25 @@ const verifyDmarc = async opts => {
             spf: { result: spfAlignment?.domain, strict: aspfStrict },
             dkim: { result: dkimAlignment?.domain, strict: adkimStrict, underSized }
         }
-    });
+    };
+
+    if (dkimAlignment || spfAlignment) {
+        // pass
+        status.result = 'pass';
+    } else if (walkError) {
+        // an identifier might have aligned if its Tree Walk had not failed
+        status.result = 'temperror';
+        response.error = walkError.message;
+    } else {
+        // fail
+        status.result = 'fail';
+    }
+
+    return { response: formatResponse(response), dkimAligned: new Set(dkim.aligned.map(entry => formatDomain(entry.domain))) };
 };
 
+const verifyDmarc = async opts => (await evaluateDmarc(opts)).response;
+
 module.exports = verifyDmarc;
+// also returns the signing domains that aligned, for the per signature flags of authenticate()
+module.exports.evaluateDmarc = evaluateDmarc;

package/lib/mailauth.js

@@ -3,12 +3,12 @@
 const { dkimSign, DkimSignStream } = require('./dkim/sign');
 const { dkimVerify } = require('./dkim/verify');
 const { spf } = require('./spf');
-const { dmarc } = require('./dmarc');
+const { dmarc, evaluateDmarc } = require('./dmarc');
 const { arc, createSeal, sealMessage, getARChain, verifyASChain } = require('./arc');
 const { bimi, validateVMC: validateBimiVmc } = require('./bimi');
 const { validateSvg: validateBimiSvg } = require('./bimi/validate-svg');
 const { parseReceived } = require('./parse-received');
-const { getAlignment } = require('./tools');
+const { formatDomain, getAlignment } = require('./tools');
 const libmime = require('libmime');
 const os = require('node:os');
 const { isIP } = require('net');
@@ -117,7 +117,8 @@ const authenticate = async (input, opts) => {
 
     let dmarcResult;
     if (!opts.disableDmarc && dkimResult?.headerFrom) {
-        dmarcResult = await dmarc({
+        let dkimAligned;
+        ({ response: dmarcResult, dkimAligned } = await evaluateDmarc({
             headerFrom: dkimResult.headerFrom,
             spfDomains: [].concat((spfResult && spfResult.status.result === 'pass' && spfResult.domain) || []),
             dkimDomains: (dkimResult.results || [])
@@ -130,16 +131,22 @@ const authenticate = async (input, opts) => {
                 })),
             arcResult,
             resolver: opts.resolver
-        });
+        }));
         if (dmarcResult.info) {
             arHeader.push(`${libmime.foldLines(dmarcResult.info, 160)}`);
         }
 
-        if (dmarcResult.alignment?.dkim?.strict) {
-            // the DKIM verifier only knows relaxed alignment, it runs before the DMARC record
+        if (dkimAligned) {
+            // The DKIM verifier runs before the DMARC record and the Tree Walks are known, so its
+            // per signature flag only guesses relaxed alignment from the Public Suffix List.
+            // Passing signatures take the DMARC verdict, failing ones the record's alignment mode.
             let fromDomain = dmarcResult.status.header.from;
             for (let row of dkimResult.results || []) {
-                row.status.aligned = (row.status.aligned && getAlignment(fromDomain, [row.signingDomain], true)?.domain) || false;
+                if (row.status.result === 'pass') {
+                    row.status.aligned = dkimAligned.has(formatDomain(row.signingDomain)) ? row.signingDomain : false;
+                } else if (dmarcResult.alignment.dkim.strict) {
+                    row.status.aligned = (row.status.aligned && getAlignment(fromDomain, [row.signingDomain], true)?.domain) || false;
+                }
             }
         }
     }

package/lib/tools.js

@@ -91,8 +91,8 @@ const FIELD_START = /^[\x21-\x39\x3b-\x7e]+[ \t\r\n]*:/;
 // Whether a row opens a header of its own. Anything else is appended to the row above,
 // which is wider than the CRLF-then-WSP fold of RFC 5322 section 2.2.3 and deliberately
 // so: a line that is not a well formed field is read differently by different parsers,
-// and mailauth's own libmime, like most MUAs, appends any line it calls whitespace to the
-// value above it. Asking what a field looks like instead of what whitespace looks like
+// some mail readers append whitespace-looking lines to the value above them. Asking what
+// a field looks like instead of what whitespace looks like
 // covers every spelling of it, including the multi-byte ones a leading byte test misses,
 // such as UTF-8 NBSP (C2 A0) and the ideographic space (E3 80 80). Appending a line can
 // only add bytes to a signed value, so it can only ever turn a pass into a fail; reading

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "mailauth",
-    "version": "5.0.3",
+    "version": "6.0.0",
     "description": "Email authentication library for Node.js",
     "main": "lib/mailauth.js",
     "types": "index.d.ts",
@@ -35,27 +35,27 @@
     "homepage": "https://github.com/postalsys/mailauth",
     "devDependencies": {
         "chai": "4.4.1",
-        "eslint": "10.8.0",
+        "eslint": "10.11.0",
         "eslint-config-nodemailer": "1.2.0",
         "eslint-config-prettier": "10.1.8",
-        "js-yaml": "5.2.3",
+        "js-yaml": "5.4.2",
         "license-report": "6.8.5",
         "mbox-reader": "1.2.0",
-        "mocha": "11.8.0",
-        "prettier": "3.9.6",
-        "resedit": "3.0.2"
+        "mocha": "12.0.2",
+        "prettier": "3.9.9",
+        "resedit": "3.1.0"
     },
     "dependencies": {
         "@postalsys/vmc": "1.1.5",
         "commander": "15.0.0",
-        "fast-xml-parser": "5.10.1",
+        "fast-xml-parser": "5.11.1",
         "ipaddr.js": "2.5.0",
-        "joi": "18.2.3",
-        "libmime": "5.4.1",
-        "nodemailer": "9.0.4",
+        "joi": "18.2.9",
+        "libmime": "5.4.4",
+        "nodemailer": "10.0.10",
         "punycode.js": "2.3.1",
-        "tldts": "7.4.10",
-        "undici": "8.10.0"
+        "tldts": "7.4.15",
+        "undici": "8.11.2"
     },
     "engines": {
         "node": ">=22.19.0"