mailauth 6.0.0 → 7.1.0

package/lib/dmarc/get-dmarc-record.js

@@ -24,38 +24,125 @@ const WALK_MAX_LABELS = 7;
 // A domain literal or an IP address is not a DNS name and can not publish a DMARC record
 const isAddress = domain => domain.startsWith('[') || net.isIP(domain) !== 0;
 
-// Whether "_dmarc.<name>" can exist in the DNS: no empty labels, labels of at most 63 octets
-// and a name of at most 253 octets (RFC 1035 2.3.4). Anything else would only produce a
-// resolver error that looks like a transient failure.
-const isQueryable = name => {
-    let fqdn = `_dmarc.${name}`;
-    return fqdn.length <= 253 && fqdn.split('.').every(label => label.length && label.length <= 63);
+// Whether a name can exist in the DNS: no empty labels, labels of at most 63 octets and a
+// name of at most 253 octets (RFC 1035 2.3.4). Anything else would only produce a resolver
+// error that looks like a transient failure.
+const isValidName = name => name.length <= 253 && name.split('.').every(label => label.length && label.length <= 63);
+
+const POLICY_VALUES = new Set(['none', 'quarantine', 'reject']);
+
+// A reporting URI (RFC 9989 4.8 dmarc-uri): an RFC 3986 URI, so a scheme, a ":" and a possibly
+// empty rest made of URI characters, where commas and "!" must be percent-encoded. "mailto:" is
+// therefore valid and a bare address is not. An obsolete "!size" suffix does not change that.
+const REPORTING_URI = /^[a-z][a-z0-9+.-]*:(?:[a-z0-9\-._~:/?#[\]@$&'()*+;=]|%[0-9a-f]{2})*$/i;
+const OBS_REPORT_SIZE = /![0-9]+[kmgt]?$/i;
+
+// "rua" lists at least one syntactically valid reporting URI (RFC 9989 4.10.1)
+const hasReportingUri = record =>
+    typeof record.rua === 'string' && record.rua.split(',').some(uri => REPORTING_URI.test(uri.trim().replace(OBS_REPORT_SIZE, '')));
+
+// Returns the policy tags a record is applied with (RFC 9989 4.10.1). A record without a
+// valid "p", or with an invalid "sp" or "np", acts as p=none when it asks for aggregate
+// reports, and gets no DMARC processing at all (null) otherwise.
+const getPolicyTags = record => {
+    const isValid = value => value === undefined || POLICY_VALUES.has(value);
+    if (POLICY_VALUES.has(record.p) && isValid(record.sp) && isValid(record.np)) {
+        return { p: record.p, sp: record.sp, np: record.np };
+    }
+    return hasReportingUri(record) ? { p: 'none' } : null;
 };
 
-const parseDmarcRecord = txt => {
-    let parsed = Object.fromEntries(
-        txt
-            .split(';')
-            .map(e => e.trim())
-            .filter(e => e)
-            .map(e => {
-                let splitPos = e.indexOf('=');
-                if (splitPos < 0) {
-                    return [e.toLowerCase().trim(), false];
-                } else if (splitPos === 0) {
-                    return [false, e];
-                }
-                // whitespace is allowed around "=" (*WSP in the ABNF), so the value must be trimmed
-                let key = e.substr(0, splitPos).toLowerCase().trim();
-                let val = e.substr(splitPos + 1).trim();
-                if (['pct', 'ri'].includes(key)) {
-                    val = parseInt(val, 10) || 0;
-                } else if (CASE_INSENSITIVE_TAGS.has(key)) {
-                    val = val.toLowerCase();
-                }
-                return [key, val];
-            })
-    );
+// Domain existence test (RFC 9989 A.4): any RR makes a name exist, only NXDOMAIN means it
+// does not. A query for A tells the two apart, NODATA is an existing name without A records.
+// A query for A follows a CNAME and gets the target's NXDOMAIN when the target is gone (RFC 6604 3),
+// so after an NXDOMAIN the name's own CNAME, which is not followed, is looked up as well.
+const domainExists = async (domain, resolver) => {
+    if (!isValidName(domain)) {
+        return false;
+    }
+    resolver = resolver || dns.resolve;
+    try {
+        await resolver(domain, 'A');
+        return true;
+    } catch (err) {
+        if (err.code === 'ENODATA') {
+            return true;
+        }
+        if (err.code === 'EBADNAME') {
+            return false;
+        }
+        if (err.code !== 'ENOTFOUND') {
+            throw err;
+        }
+    }
+    try {
+        return ((await resolver(domain, 'CNAME')) || []).length > 0;
+    } catch (err) {
+        if (NO_RECORD_CODES.has(err.code)) {
+            // no CNAME, so the NXDOMAIN for A was the name's own
+            return false;
+        }
+        throw err;
+    }
+};
+
+// Tag names registered for DMARC (RFC 9989 9.3), including the historic ones
+const KNOWN_TAGS = new Set(['v', 'p', 'sp', 'np', 'adkim', 'aspf', 'fo', 'rua', 'ruf', 'rf', 'ri', 'pct', 't', 'psd']);
+
+// Parses a DMARC Policy Record. DMARC uses the DKIM tag-list syntax (RFC 9989 4.7), where tag names
+// are case sensitive and a duplicated tag makes the whole tag-list invalid (RFC 6376 3.2).
+// By default tag names are case-folded and the last of duplicated tags wins, which is reported in
+// "warnings". With "strict" the RFC rules apply and a record with a duplicated tag is invalid (null).
+const parseDmarcRecord = (txt, opts) => {
+    const { strict, warnings } = opts || {};
+
+    let seen = new Set();
+    let duplicate = false;
+
+    let entries = txt
+        .split(';')
+        .map(e => e.trim())
+        .filter(e => e)
+        .map((e, i) => {
+            let splitPos = e.indexOf('=');
+            if (splitPos < 0) {
+                // not a tag, a syntax error that is ignored
+                return [e.toLowerCase().trim(), false];
+            } else if (splitPos === 0) {
+                return [false, e];
+            }
+            // whitespace is allowed around "=" (*WSP in the ABNF), so the value must be trimmed
+            let name = e.substr(0, splitPos).trim();
+            let key = name.toLowerCase();
+            if (strict && i > 0) {
+                // the version tag is matched case-insensitively by its own ABNF rule, other names are not
+                key = name;
+            } else if (key !== name && KNOWN_TAGS.has(key) && i > 0) {
+                warnings?.add('tag-case');
+            }
+
+            if (seen.has(key)) {
+                duplicate = true;
+            }
+            seen.add(key);
+
+            let val = e.substr(splitPos + 1).trim();
+            if (['pct', 'ri'].includes(key)) {
+                val = parseInt(val, 10) || 0;
+            } else if (CASE_INSENSITIVE_TAGS.has(key)) {
+                val = val.toLowerCase();
+            }
+            return [key, val];
+        });
+
+    if (duplicate) {
+        if (strict) {
+            return null;
+        }
+        warnings?.add('duplicate-tag');
+    }
+
+    let parsed = Object.fromEntries(entries);
 
     parsed.rr = txt;
 
@@ -64,15 +151,16 @@ const parseDmarcRecord = txt => {
 
 // Returns the DMARC Policy Record published at "_dmarc.<name>", or false. A set of several
 // records counts as no record, it is discarded (RFC 9989 4.10 steps 2 and 6).
-const fetchRecord = async (name, resolver) => {
-    if (!isQueryable(name)) {
+const fetchRecord = async (name, resolver, opts) => {
+    if (!isValidName(`_dmarc.${name}`)) {
         return false;
     }
 
     let records;
     try {
         let txt = await resolver(`_dmarc.${name}`, 'TXT');
-        records = (txt || []).map(row => row.join('').trim()).filter(row => DMARC_VERSION_RE.test(row));
+        // a custom resolver might return plain strings instead of lists of character-strings
+        records = (txt || []).map(row => (Array.isArray(row) ? row.join('') : String(row)).trim()).filter(row => DMARC_VERSION_RE.test(row));
     } catch (err) {
         if (NO_RECORD_CODES.has(err.code)) {
             return false;
@@ -80,16 +168,19 @@ const fetchRecord = async (name, resolver) => {
         throw err;
     }
 
-    return records.length === 1 ? parseDmarcRecord(records[0]) : false;
+    // a record that is not a valid tag-list is discarded like one that is not a DMARC record
+    return (records.length === 1 && parseDmarcRecord(records[0], opts)) || false;
 };
 
-// Tree Walks for one message share most of their names, so each name is queried only once
-const createRecordLookup = resolver => {
+// Tree Walks for one message share most of their names, so each name is queried only once.
+// opts.strict parses records by the RFC 6376 tag-list rules, opts.warnings is a Set that collects
+// what the default parsing accepted and strict parsing would not.
+const createRecordLookup = (resolver, opts) => {
     resolver = resolver || dns.resolve;
     let cache = new Map();
     return name => {
         if (!cache.has(name)) {
-            cache.set(name, fetchRecord(name, resolver));
+            cache.set(name, fetchRecord(name, resolver, opts));
         }
         return cache.get(name);
     };
@@ -154,20 +245,33 @@ const getOrgDomain = async (domain, lookup) => {
     return selectOrgDomain(domain, found);
 };
 
+// The record that holds the policy of an Organizational Domain: its own record, or else the record
+// of the PSD above it. Returns false when there is neither.
+const findOrgRecord = (orgDomain, found) => {
+    let last = found[found.length - 1];
+    let entry = found.find(e => e.domain === orgDomain) || (last?.record.psd === 'y' ? last : null);
+    return entry || false;
+};
+
 // DMARC Policy Discovery (RFC 9989 4.10.1) for a normalized author domain. Returns
-// { record, recordDomain, orgDomain, error }, where "record" is false when no policy applies.
-// When the Tree Walk fails after a record was found at the author domain, "orgDomain" is null
-// and "error" says why. Throws on DNS errors that leave the policy unknown.
+// { record, recordDomain, orgDomain, orgRecord, error }, where "record" is false when no policy
+// applies and "orgRecord" is the record that holds the Organizational Domain's policy (see findOrgRecord).
+// When the Tree Walk fails after a record was found at the author domain, "orgDomain" and
+// "orgRecord" are null and "error" says why. Throws on DNS errors that leave the policy unknown.
 const discoverPolicy = async (domain, lookup) => {
     if (isAddress(domain)) {
-        return { record: false, recordDomain: null, orgDomain: domain };
+        return { record: false, recordDomain: null, orgDomain: domain, orgRecord: false };
     }
 
     let { found, error } = await treeWalk(domain, lookup);
 
     if (found[0]?.domain === domain) {
         // the author domain's own record applies regardless of what is above it
-        return { record: found[0].record, recordDomain: domain, orgDomain: error ? null : selectOrgDomain(domain, found), error };
+        if (error) {
+            return { record: found[0].record, recordDomain: domain, orgDomain: null, orgRecord: null, error };
+        }
+        let orgDomain = selectOrgDomain(domain, found);
+        return { record: found[0].record, recordDomain: domain, orgDomain, orgRecord: findOrgRecord(orgDomain, found).record || false };
     }
 
     if (error) {
@@ -178,17 +282,17 @@ const discoverPolicy = async (domain, lookup) => {
 
     // otherwise the record of the Organizational Domain, and failing that the record of the PSD.
     // A walk only stops at a psd tag, so a psd=y record can only be the last one found.
-    let last = found[found.length - 1];
-    let entry = found.find(e => e.domain === orgDomain) || (last?.record.psd === 'y' ? last : null);
+    let entry = findOrgRecord(orgDomain, found);
 
-    return { record: entry ? entry.record : false, recordDomain: entry ? entry.domain : null, orgDomain };
+    return { record: entry ? entry.record : false, recordDomain: entry ? entry.domain : null, orgDomain, orgRecord: entry ? entry.record : false };
 };
 
 // Fetches the DMARC Policy Record that applies to a domain. Returns the parsed record or false.
-const getDmarcRecord = async (domain, resolver) => {
+// opts.strict parses records by the RFC 6376 tag-list rules (see parseDmarcRecord).
+const getDmarcRecord = async (domain, resolver, opts) => {
     domain = formatDomain(domain || '');
 
-    let { record, recordDomain, orgDomain } = await discoverPolicy(domain, createRecordLookup(resolver));
+    let { record, recordDomain, orgDomain } = await discoverPolicy(domain, createRecordLookup(resolver, { strict: !!opts?.strict }));
     if (!record) {
         return false;
     }
@@ -205,3 +309,6 @@ module.exports = getDmarcRecord;
 module.exports.createRecordLookup = createRecordLookup;
 module.exports.discoverPolicy = discoverPolicy;
 module.exports.getOrgDomain = getOrgDomain;
+module.exports.getPolicyTags = getPolicyTags;
+module.exports.domainExists = domainExists;
+module.exports.parseDmarcRecord = parseDmarcRecord;

package/lib/dmarc/index.d.ts

@@ -6,6 +6,33 @@ import { DMARCOptions, DMARCResult } from '../../index';
  * Verifies DMARC policy for a message
  *
  * @param opts - DMARC verification options
- * @returns DMARC verification result
+ * @returns DMARC verification result, or false when the From header has no domain or more than one domain
  */
-export function dmarc(opts: DMARCOptions): Promise<DMARCResult | false>;
+export function dmarc(opts: DMARCOptions & { strict?: boolean }): Promise<DMARCResult | false>;
+
+/**
+ * Verifies DMARC policy for a message, with details that dmarc() does not return
+ *
+ * @param opts - DMARC verification options
+ */
+export function evaluateDmarc(opts: DMARCOptions & { strict?: boolean }): Promise<{
+    /**
+     * The dmarc() result
+     */
+    response: DMARCResult | false;
+
+    /**
+     * Signing domains (normalized) of the DKIM signatures that aligned
+     */
+    dkimAligned?: Set<string>;
+
+    /**
+     * Why DMARC validation was not possible (RFC 9989 5.3.1), set when response is false
+     */
+    reason?: 'no-author-domain' | 'multiple-author-domains' | 'invalid-author-domain' | 'multiple-from-fields';
+
+    /**
+     * The Author Domains found, set when response is false
+     */
+    authorDomains?: string[];
+}>;

package/lib/dmarc/verify.js

@@ -1,46 +1,61 @@
 'use strict';
 
-const punycode = require('punycode.js');
+const dns = require('node:dns').promises;
 const { formatAuthHeaderRow, formatDomain } = require('../tools');
-const { createRecordLookup, discoverPolicy, getOrgDomain } = require('./get-dmarc-record');
+const { createRecordLookup, discoverPolicy, getOrgDomain, getPolicyTags, domainExists } = require('./get-dmarc-record');
+const { getAuthorDomain } = require('./author-domain');
 
 // Every Tree Walk is capped at eight queries, but the number of walks is not (RFC 9989 4.10.2),
-// so a message can only make this many identifiers walk for relaxed alignment. The rest do not align.
+// so a message can only make this many identifiers walk for relaxed alignment. An identifier
+// past the limit is not known to align or not, so it is treated like one whose walk failed.
 const MAX_ALIGNMENT_WALKS = 10;
 
-const evaluateDmarc = async opts => {
-    let { headerFrom, spfDomains, dkimDomains, resolver, arcResult } = opts;
-
-    if (Array.isArray(headerFrom)) {
-        if (headerFrom.length === 1) {
-            headerFrom = headerFrom[0];
-        } else {
-            // invalid number of FROM addresses found
-            return { response: false };
-        }
-    }
+// t=y asks for the policy one level below the published one (RFC 9989 4.7 "t")
+const TEST_MODE_POLICY = { reject: 'quarantine', quarantine: 'none', none: 'none' };
 
-    let atPos = headerFrom.indexOf('@');
-    let domain = atPos >= 0 ? headerFrom.substr(atPos + 1) : headerFrom;
+const POLICY_STRENGTH = { none: 0, quarantine: 1, reject: 2 };
 
-    domain = domain.toLowerCase().trim();
+// Two domains can only have the same Organizational Domain if they have a common parent. With
+// no common label at all no Tree Walk result could make them align.
+const shareParent = (a, b) => a.split('.').pop() === b.split('.').pop();
 
-    try {
-        domain = punycode.toASCII(domain);
-    } catch (err) {
-        // ignore punycode conversion errors
+const setHidden = (obj, key, value) => Object.defineProperty(obj, key, { value, enumerable: false, configurable: true, writable: true });
+
+const evaluateDmarc = async opts => {
+    let { headerFrom, fromFields, spfDomains, dkimDomains, resolver, arcResult, strict } = opts;
+
+    strict = !!strict;
+    resolver = resolver || dns.resolve;
+
+    // RFC 9989 5.3.1: several mailboxes are fine if they share one domain, but with zero or more
+    // than one Author Domain DMARC validation is not possible. The response stays false, as it
+    // always was for these messages, and "reason" says why.
+    const author = getAuthorDomain(headerFrom, fromFields);
+    if (!author.authorDomain) {
+        return { response: false, reason: author.reason, authorDomains: author.domains };
     }
 
-    // the name to query and compare, "example.com." and "example.com" are the same domain
-    const authorDomain = formatDomain(domain);
+    // "domain" is reported in header.from. "authorDomain" is the name to query and compare,
+    // where "example.com." and "example.com" are the same domain.
+    const { domain, authorDomain } = author;
+
+    // what the default mode accepted that strict mode would not
+    const warnings = new Set();
 
     let formatResponse = response => {
-        response.info = formatAuthHeaderRow('dmarc', response.status);
+        if (warnings.size) {
+            response.warnings = Array.from(warnings);
+        }
+
+        response.info = formatAuthHeaderRow('dmarc', response.status, { strict });
 
         if (typeof response.status.comment === 'boolean') {
             delete response.status.comment;
         }
 
+        // for BIMI (draft-brand-indicators-for-message-identification 7.1), not part of the result
+        setHidden(response, 'authorMailboxes', author.mailboxes);
+
         return response;
     };
 
@@ -55,7 +70,8 @@ const evaluateDmarc = async opts => {
         }
     };
 
-    const lookup = createRecordLookup(resolver);
+    // the strict parsing rejects what the default parsing would note, so it adds no warnings
+    const lookup = createRecordLookup(resolver, { strict, warnings });
 
     let policyDiscovery;
     try {
@@ -66,7 +82,7 @@ const evaluateDmarc = async opts => {
         return { response: formatResponse({ status, domain: authorDomain, error: err.message }) };
     }
 
-    let { record: dmarcRecord, recordDomain, orgDomain } = policyDiscovery;
+    let { record: dmarcRecord, recordDomain, orgDomain, orgRecord } = policyDiscovery;
 
     if (!dmarcRecord) {
         // nothing to do here
@@ -75,18 +91,57 @@ const evaluateDmarc = async opts => {
         return { response: formatResponse({ status, domain: orgDomain }) };
     }
 
-    // the domain the applied policy record was published at
-    status.header.d = recordDomain;
+    const policyTags = getPolicyTags(dmarcRecord);
+    if (!policyTags) {
+        // no valid policy and nowhere to report to, the record gets no DMARC processing (RFC 9989 4.10.1)
+        status.result = 'none';
+        return { response: formatResponse({ status, domain: orgDomain || authorDomain }) };
+    }
+
+    if (!strict) {
+        // The domain the applied policy record was published at, the DMARC Policy Domain. This
+        // property is not registered for dmarc (RFC 9989 9.1), so strict mode leaves it out and
+        // the domain is only reported in "policyDomain".
+        status.header.d = recordDomain;
+    }
+
+    let policy = policyTags.p;
+    // set when the existence query that decides between "sp" and "np" failed
+    let existenceError = null;
+    if (recordDomain !== authorDomain) {
+        // A record inherited by a subdomain applies "np" if the subdomain does not exist and "sp"
+        // if it does, both falling back to "p" (RFC 9989 4.10.1). Existence only matters with "np".
+        policy = policyTags.sp || policyTags.p;
+        if (policyTags.np) {
+            try {
+                if (!(await domainExists(authorDomain, resolver))) {
+                    policy = policyTags.np;
+                }
+            } catch (err) {
+                if (policyTags.np !== policy) {
+                    // The policy is one of the two, but which one is not known. This only matters
+                    // for a message that does not pass. Until then the weaker one is assumed, so
+                    // that nothing (such as BIMI) treats the domain as more enforcing than it is.
+                    existenceError = err;
+                    if (POLICY_STRENGTH[policyTags.np] < POLICY_STRENGTH[policy]) {
+                        policy = policyTags.np;
+                    }
+                }
+            }
+        }
+    }
+
+    const testMode = dmarcRecord.t === 'y';
+    if (testMode) {
+        policy = TEST_MODE_POLICY[policy];
+    }
 
     status.comment = []
-        .concat(dmarcRecord.p ? `p=${dmarcRecord.p.toUpperCase()}` : [])
-        .concat(dmarcRecord.sp ? `sp=${dmarcRecord.sp.toUpperCase()}` : [])
+        .concat(`p=${policyTags.p.toUpperCase()}`)
+        .concat(policyTags.sp ? `sp=${policyTags.sp.toUpperCase()}` : [])
         .concat(arcResult?.status?.result ? `arc=${arcResult?.status?.result}` : [])
         .join(' ');
 
-    // use "sp" if the record was inherited by a subdomain and "sp" is set, otherwise use "p"
-    const policy = recordDomain !== authorDomain && dmarcRecord.sp ? dmarcRecord.sp : dmarcRecord.p;
-
     const adkimStrict = dmarcRecord.adkim === 's';
     const aspfStrict = dmarcRecord.aspf === 's';
 
@@ -94,13 +149,17 @@ const evaluateDmarc = async opts => {
     // An identifier's Organizational Domain is always the identifier itself or one of its
     // parents, so only identifiers at or below the author's Organizational Domain need a walk.
     let orgDomains = new Map();
-    // throws when a Tree Walk the answer depends on failed
+    // throws when a Tree Walk the answer depends on failed, or was not made because of the limit
     const alignsRelaxed = async entryDomain => {
         if (entryDomain === authorDomain) {
             return true;
         }
         if (!orgDomain) {
-            // the author's own Tree Walk failed, so there is nothing to compare against
+            // The author's own Tree Walk failed, so there is nothing to compare against,
+            // unless the two domains have no parent in common and can never align
+            if (!shareParent(entryDomain, authorDomain)) {
+                return false;
+            }
             throw policyDiscovery.error;
         }
         if (entryDomain !== orgDomain && !entryDomain.endsWith(`.${orgDomain}`)) {
@@ -108,7 +167,9 @@ const evaluateDmarc = async opts => {
         }
         if (!orgDomains.has(entryDomain)) {
             if (orgDomains.size >= MAX_ALIGNMENT_WALKS) {
-                return false;
+                let err = new Error(`Alignment of ${entryDomain} not checked, limit of ${MAX_ALIGNMENT_WALKS} Tree Walks per message reached`);
+                err.code = 'EWALKLIMIT';
+                throw err;
             }
             orgDomains.set(entryDomain, getOrgDomain(entryDomain, lookup));
         }
@@ -118,7 +179,7 @@ const evaluateDmarc = async opts => {
     // Returns every entry that aligns, most preferred first, and the first walk error seen.
     // Signatures with an l= tag come last, so that a signature covering the whole body is
     // reported when several align.
-    const findAligned = async (entries, strict) => {
+    const findAligned = async (entries, strictAlignment) => {
         let list = []
             .concat(entries || [])
             .map(entry => (typeof entry === 'string' ? { domain: entry } : entry))
@@ -134,7 +195,7 @@ const evaluateDmarc = async opts => {
                 continue;
             }
             try {
-                if (strict ? entryDomain === authorDomain : await alignsRelaxed(entryDomain)) {
+                if (strictAlignment ? entryDomain === authorDomain : await alignsRelaxed(entryDomain)) {
                     aligned.push(entry);
                 }
             } catch (err) {
@@ -162,10 +223,14 @@ const evaluateDmarc = async opts => {
     let response = {
         status,
         domain: orgDomain || authorDomain,
+        // the DMARC Policy Domain (RFC 9989 3.2.5), where the applied record was published.
+        // This is the domain RFC 9990 aggregate reports list as the published policy's domain.
+        policyDomain: recordDomain,
         policy,
-        p: dmarcRecord.p,
-        sp: dmarcRecord.sp || dmarcRecord.p,
-        pct: dmarcRecord.pct,
+        p: policyTags.p,
+        sp: policyTags.sp || policyTags.p,
+        np: policyTags.np,
+        testMode,
         rr: dmarcRecord.rr,
 
         alignment: {
@@ -177,15 +242,26 @@ const evaluateDmarc = async opts => {
     if (dkimAlignment || spfAlignment) {
         // pass
         status.result = 'pass';
-    } else if (walkError) {
-        // an identifier might have aligned if its Tree Walk had not failed
+    } else if (walkError || existenceError) {
+        // an identifier might have aligned if its Tree Walk had not failed, or the
+        // policy to apply is not known because the author domain's existence is not
         status.result = 'temperror';
-        response.error = walkError.message;
+        response.error = (walkError || existenceError).message;
     } else {
         // fail
         status.result = 'fail';
     }
 
+    if (status.result !== 'temperror' && !existenceError) {
+        // RFC 9989 9.1: the evaluated policy after the policy options have been processed
+        status.policy = { dmarc: policy };
+    }
+
+    // for BIMI (draft-brand-indicators-for-message-identification 7.1), not part of the result:
+    // the applied record and the record holding the Organizational Domain's policy (null if unknown)
+    setHidden(response, 'record', dmarcRecord);
+    setHidden(response, 'orgRecord', orgRecord);
+
     return { response: formatResponse(response), dkimAligned: new Set(dkim.aligned.map(entry => formatDomain(entry.domain))) };
 };