nodemailer 10.2.1 → 10.3.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # CHANGELOG
 
+## [10.3.0](https://github.com/nodemailer/nodemailer/compare/v10.2.1...v10.3.0) (2026-10-29)
+
+
+### Features
+
+* add the otp option for the OTP-Token header ([7789e15](https://github.com/nodemailer/nodemailer/commit/7789e1501e4f555e9754a15664aa30f1415902b9))
+
+
+### Bug Fixes
+
+* encode a Content-ID header as a message id ([#1904](https://github.com/nodemailer/nodemailer/issues/1904)) ([47f2b25](https://github.com/nodemailer/nodemailer/commit/47f2b252fccc8ec6a1a5700e12c1087ae3633e17))
+
 ## [10.2.1](https://github.com/nodemailer/nodemailer/compare/v10.2.0...v10.2.1) (2026-10-22)
 
 

package/dist/cjs/dkim/sign.js

@@ -68,7 +68,7 @@ function sign(headers, hashAlgo, bodyHash, options) {
         'Content-Description:Resent-Date:Resent-From:Resent-Sender:' +
         'Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:' +
         'List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:' +
-        'List-Owner:List-Archive';
+        'List-Owner:List-Archive:OTP-Token';
     const fieldNames = options.headerFieldNames || defaultFieldNames;
     const canonicalizedHeaderData = relaxedHeaders(headers, fieldNames, options.skipFields);
     const dkimHeader = generateDKIMHeader(options.domainName, options.keySelector, canonicalizedHeaderData.fieldNames, hashAlgo, bodyHash);

package/dist/cjs/errors.d.ts

@@ -21,6 +21,7 @@ export declare const ERROR_CODES: {
     readonly EPROTOCOL: "Invalid SMTP server response";
     readonly EENVELOPE: "Invalid mail envelope (sender or recipients)";
     readonly EMESSAGE: "Message delivery error";
+    readonly EOTP: "Invalid one-time passcode data (otp option)";
     readonly ESTREAM: "Stream processing error";
     readonly EAUTH: "Authentication failed";
     readonly ENOAUTH: "Authentication credentials not provided";
@@ -48,6 +49,7 @@ export declare const EREQUIRETLS = "EREQUIRETLS";
 export declare const EPROTOCOL = "EPROTOCOL";
 export declare const EENVELOPE = "EENVELOPE";
 export declare const EMESSAGE = "EMESSAGE";
+export declare const EOTP = "EOTP";
 export declare const ESTREAM = "ESTREAM";
 export declare const EAUTH = "EAUTH";
 export declare const ENOAUTH = "ENOAUTH";

package/dist/cjs/errors.js

@@ -10,7 +10,7 @@
  *   err.code = errors.ECONNECTION;
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
+exports.ERR_ACCESS_DENIED = exports.isPermanentResponseCode = exports.isTransientError = exports.EFETCH = exports.EURLACCESS = exports.EFILEACCESS = exports.EPROXY = exports.ECONFIG = exports.ESES = exports.ESENDMAIL = exports.EMAXRECIPIENTS = exports.EMAXLIMIT = exports.EOAUTH2 = exports.ENOAUTH = exports.EAUTH = exports.ESTREAM = exports.EOTP = exports.EMESSAGE = exports.EENVELOPE = exports.EPROTOCOL = exports.EREQUIRETLS = exports.ETLS = exports.EDNS = exports.ESOCKET = exports.ETIMEDOUT = exports.ECONNECTION = exports.ERROR_CODES = void 0;
 /**
  * Error code descriptions for documentation and debugging
  */
@@ -27,6 +27,7 @@ exports.ERROR_CODES = {
     EPROTOCOL: 'Invalid SMTP server response',
     EENVELOPE: 'Invalid mail envelope (sender or recipients)',
     EMESSAGE: 'Message delivery error',
+    EOTP: 'Invalid one-time passcode data (otp option)',
     ESTREAM: 'Stream processing error',
     // Authentication errors
     EAUTH: 'Authentication failed',
@@ -55,6 +56,7 @@ exports.EREQUIRETLS = 'EREQUIRETLS';
 exports.EPROTOCOL = 'EPROTOCOL';
 exports.EENVELOPE = 'EENVELOPE';
 exports.EMESSAGE = 'EMESSAGE';
+exports.EOTP = 'EOTP';
 exports.ESTREAM = 'ESTREAM';
 exports.EAUTH = 'EAUTH';
 exports.ENOAUTH = 'ENOAUTH';

package/dist/cjs/mail-composer/index.d.ts

@@ -72,6 +72,16 @@ export type MailComposerListHeaderEntry = string | {
 export interface MailComposerListHeaders {
     [key: string]: MailComposerListHeaderEntry | (MailComposerListHeaderEntry | MailComposerListHeaderEntry[])[];
 }
+/**
+ * The otp value: a one-time passcode and the origin it is bound to, sent as the OTP-Token
+ * header (draft-goto-otp-token)
+ */
+export interface MailComposerOtp {
+    /** The passcode, printable ascii */
+    code: string;
+    /** Origin the code is bound to, https or a loopback http origin. A full url is reduced to its origin */
+    origin: string;
+}
 /**
  * Encoding for the non-ascii header values: quoted-printable ('Q', the default) or base64
  * ('B'). Only the first letter is read, so the short forms work as well
@@ -114,6 +124,8 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
+    /** One-time passcode for the OTP-Token header, read by the mailer */
+    otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;
     /** Content-Transfer-Encoding to force for the text/* nodes that do not set their own */

package/dist/cjs/mailer/index.d.ts

@@ -4,7 +4,7 @@ import DKIM, { type DKIMOptions } from '../dkim/index.js';
 import MailMessage, { type MailDefaults, type SendMailOptions } from './mail-message.js';
 import net from 'node:net';
 import type { ConnectionOptions } from 'node:tls';
-import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerTextEncoding } from '../mail-composer/index.js';
+import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerOtp, MailComposerTextEncoding } from '../mail-composer/index.js';
 import type { Callback, NodemailerError, ResultCallback } from '../errors.js';
 import type { ParsedUrl } from '../shared/url.js';
 import type { MimeNodeAddress, MimeNodeEnvelope, MimeNodeEnvelopeInput, MimeNodeHeaders, MimeNodeOptions } from '../mime-node/index.js';
@@ -227,11 +227,12 @@ declare namespace Mail {
     type Headers = MimeNodeHeaders;
     type ListHeader = MailComposerListHeaderEntry;
     type ListHeaders = MailComposerListHeaders;
+    type Otp = MailComposerOtp;
     type Envelope = MimeNodeEnvelopeInput;
     type Connection = SocketOptions;
     type TextEncoding = MailComposerTextEncoding;
     type PluginFunction<T = SentMessageInfo> = MailPluginFunction<T>;
 }
 /** The same aliases as module level exports, for `import * as Mail` and `import Mail = require()` */
-export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
+export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
 export default Mail;

package/dist/cjs/mailer/index.js

@@ -183,6 +183,7 @@ class Mail extends node_events_1.EventEmitter {
                 mail.setMailerHeader();
                 mail.setPriorityHeaders();
                 mail.setListHeaders();
+                mail.setOtpHeader();
                 recipientCount = mail.message.getEnvelope().to.length;
             }
             catch (err) {

package/dist/cjs/mailer/mail-message.d.ts

@@ -103,4 +103,11 @@ export default class MailMessage<T = SentMessageInfo> {
     setMailerHeader(): void;
     setPriorityHeaders(): void;
     setListHeaders(): void;
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader(): void;
 }

package/dist/cjs/mailer/mail-message.js

@@ -39,6 +39,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const shared = __importStar(require("../shared/index.js"));
 const index_js_1 = __importDefault(require("../mime-node/index.js"));
 const mimeFuncs = __importStar(require("../mime-funcs/index.js"));
+const errors = __importStar(require("../errors.js"));
 // Only an own key counts as already set. `key in obj` also matches every member of
 // Object.prototype, which silently drops a transporter default legitimately named
 // toString or constructor.
@@ -300,6 +301,26 @@ class MailMessage {
             });
         });
     }
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader() {
+        const otp = this.data.otp;
+        if (!this.message || !otp) {
+            return;
+        }
+        // a structured field String can only hold printable ascii. The code is a secret the recipient
+        // compares against the one in the message body, so it is rejected rather than cleaned up
+        if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+            throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+        }
+        // a structured field String escapes the same two characters as a quoted-string. setHeader
+        // replaces any OTP-Token from the custom headers, the field may appear only once
+        this.message.setHeader('OTP-Token', mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin)));
+    }
     /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
@@ -360,5 +381,38 @@ class MailMessage {
     }
 }
 exports.default = MailMessage;
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}
 module.exports = exports.default;
 Object.defineProperty(module.exports, 'default', { value: exports.default, enumerable: false, writable: true, configurable: true });

package/dist/cjs/mime-node/index.js

@@ -1302,7 +1302,7 @@ class MimeNode {
             .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
-            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
+            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^OTP(?=-Token$)|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
             // special case
             .replace(/^Content-Features$/i, 'Content-features');
         return key;
@@ -1374,7 +1374,7 @@ class MimeNode {
             // values enclosed in <>
             case 'Message-ID':
             case 'In-Reply-To':
-            case 'Content-Id':
+            case 'Content-ID':
                 // a msg-id is structured, so an encoded word inside the angle brackets would
                 // be read as literal text. drop the characters that can not appear in a header
                 // at all, but leave HT alone, it separates the ids of a multi id value
@@ -1389,6 +1389,14 @@ class MimeNode {
                     value = value + '>';
                 }
                 return value;
+            // a structured field (RFC 9651) that can not be mime encoded, an encoded word would
+            // turn its quoted strings into text that no structured field parser reads. Only
+            // the characters that can not appear in a header at all are removed
+            case 'OTP-Token':
+                return (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
             // space separated list of values enclosed in <>
             case 'References': {
                 const ids = [];

package/dist/cjs/nodemailer.d.ts

@@ -111,7 +111,7 @@ export type { Mail, MailDefaults, SentMessageInfo, Transport, TransportOptions }
 export type { SendMailOptions, Transporter } from './mailer/index.js';
 export type { NodemailerError, ErrorCode } from './errors.js';
 export type { MailMessage, MailMessageData, PluginFunction, VerifyCallback } from './mailer/index.js';
-export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders } from './mail-composer/index.js';
+export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp } from './mail-composer/index.js';
 export type { MimeNodeAddress as Address, MimeNodeHeaders as Headers } from './mime-node/index.js';
 export type { SMTPConnectionOptions, SMTPConnectionAuth, SMTPEnvelope, SMTPEnvelopeDsn } from './smtp-connection/index.js';
 export type { DKIMOptions } from './dkim/index.js';

package/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.2.1";
+export declare const version = "10.3.0";
 export declare const homepage = "https://nodemailer.com/";

package/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = 'nodemailer';
-exports.version = '10.2.1';
+exports.version = '10.3.0';
 exports.homepage = 'https://nodemailer.com/';

package/dist/cjs/well-known/services.js

@@ -208,6 +208,13 @@ exports.services = {
         "host": "smtp.europe.secureserver.net",
         "port": 25
     },
+    "Groundmail": {
+        "description": "Groundmail",
+        "host": "smtp.groundmail.dev",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "hot.ee": {
         "description": "Hot.ee (Estonian email provider)",
         "host": "mail.hot.ee"

package/dist/esm/dkim/sign.js

@@ -30,7 +30,7 @@ function sign(headers, hashAlgo, bodyHash, options) {
         'Content-Description:Resent-Date:Resent-From:Resent-Sender:' +
         'Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:' +
         'List-Id:List-Help:List-Unsubscribe:List-Subscribe:List-Post:' +
-        'List-Owner:List-Archive';
+        'List-Owner:List-Archive:OTP-Token';
     const fieldNames = options.headerFieldNames || defaultFieldNames;
     const canonicalizedHeaderData = relaxedHeaders(headers, fieldNames, options.skipFields);
     const dkimHeader = generateDKIMHeader(options.domainName, options.keySelector, canonicalizedHeaderData.fieldNames, hashAlgo, bodyHash);

package/dist/esm/errors.d.ts

@@ -21,6 +21,7 @@ export declare const ERROR_CODES: {
     readonly EPROTOCOL: "Invalid SMTP server response";
     readonly EENVELOPE: "Invalid mail envelope (sender or recipients)";
     readonly EMESSAGE: "Message delivery error";
+    readonly EOTP: "Invalid one-time passcode data (otp option)";
     readonly ESTREAM: "Stream processing error";
     readonly EAUTH: "Authentication failed";
     readonly ENOAUTH: "Authentication credentials not provided";
@@ -48,6 +49,7 @@ export declare const EREQUIRETLS = "EREQUIRETLS";
 export declare const EPROTOCOL = "EPROTOCOL";
 export declare const EENVELOPE = "EENVELOPE";
 export declare const EMESSAGE = "EMESSAGE";
+export declare const EOTP = "EOTP";
 export declare const ESTREAM = "ESTREAM";
 export declare const EAUTH = "EAUTH";
 export declare const ENOAUTH = "ENOAUTH";

package/dist/esm/errors.js

@@ -24,6 +24,7 @@ export const ERROR_CODES = {
     EPROTOCOL: 'Invalid SMTP server response',
     EENVELOPE: 'Invalid mail envelope (sender or recipients)',
     EMESSAGE: 'Message delivery error',
+    EOTP: 'Invalid one-time passcode data (otp option)',
     ESTREAM: 'Stream processing error',
     // Authentication errors
     EAUTH: 'Authentication failed',
@@ -52,6 +53,7 @@ export const EREQUIRETLS = 'EREQUIRETLS';
 export const EPROTOCOL = 'EPROTOCOL';
 export const EENVELOPE = 'EENVELOPE';
 export const EMESSAGE = 'EMESSAGE';
+export const EOTP = 'EOTP';
 export const ESTREAM = 'ESTREAM';
 export const EAUTH = 'EAUTH';
 export const ENOAUTH = 'ENOAUTH';

package/dist/esm/mail-composer/index.d.ts

@@ -72,6 +72,16 @@ export type MailComposerListHeaderEntry = string | {
 export interface MailComposerListHeaders {
     [key: string]: MailComposerListHeaderEntry | (MailComposerListHeaderEntry | MailComposerListHeaderEntry[])[];
 }
+/**
+ * The otp value: a one-time passcode and the origin it is bound to, sent as the OTP-Token
+ * header (draft-goto-otp-token)
+ */
+export interface MailComposerOtp {
+    /** The passcode, printable ascii */
+    code: string;
+    /** Origin the code is bound to, https or a loopback http origin. A full url is reduced to its origin */
+    origin: string;
+}
 /**
  * Encoding for the non-ascii header values: quoted-printable ('Q', the default) or base64
  * ('B'). Only the first letter is read, so the short forms work as well
@@ -114,6 +124,8 @@ export interface MailComposerOptions {
     headers?: MimeNodeHeaders | undefined;
     /** List-* headers, read by the mailer */
     list?: MailComposerListHeaders | undefined;
+    /** One-time passcode for the OTP-Token header, read by the mailer */
+    otp?: MailComposerOtp | undefined;
     /** SMTP envelope to use instead of the one generated from the headers */
     envelope?: MimeNodeEnvelopeInput | undefined;
     /** Content-Transfer-Encoding to force for the text/* nodes that do not set their own */

package/dist/esm/mailer/index.d.ts

@@ -4,7 +4,7 @@ import DKIM, { type DKIMOptions } from '../dkim/index.js';
 import MailMessage, { type MailDefaults, type SendMailOptions } from './mail-message.js';
 import net from 'node:net';
 import type { ConnectionOptions } from 'node:tls';
-import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerTextEncoding } from '../mail-composer/index.js';
+import type { MailComposerAlternative, MailComposerAttachment, MailComposerIcalEvent, MailComposerListHeaderEntry, MailComposerListHeaders, MailComposerOtp, MailComposerTextEncoding } from '../mail-composer/index.js';
 import type { Callback, NodemailerError, ResultCallback } from '../errors.js';
 import type { ParsedUrl } from '../shared/url.js';
 import type { MimeNodeAddress, MimeNodeEnvelope, MimeNodeEnvelopeInput, MimeNodeHeaders, MimeNodeOptions } from '../mime-node/index.js';
@@ -227,11 +227,12 @@ declare namespace Mail {
     type Headers = MimeNodeHeaders;
     type ListHeader = MailComposerListHeaderEntry;
     type ListHeaders = MailComposerListHeaders;
+    type Otp = MailComposerOtp;
     type Envelope = MimeNodeEnvelopeInput;
     type Connection = SocketOptions;
     type TextEncoding = MailComposerTextEncoding;
     type PluginFunction<T = SentMessageInfo> = MailPluginFunction<T>;
 }
 /** The same aliases as module level exports, for `import * as Mail` and `import Mail = require()` */
-export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
+export type { SendMailOptions as Options, MimeNodeAddress as Address, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerAlternative as AmpAttachment, MailComposerIcalEvent as IcalAttachment, MimeNodeHeaders as Headers, MailComposerListHeaderEntry as ListHeader, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp, MimeNodeEnvelopeInput as Envelope, SocketOptions as Connection, MailComposerTextEncoding as TextEncoding };
 export default Mail;

package/dist/esm/mailer/index.js

@@ -145,6 +145,7 @@ class Mail extends EventEmitter {
                 mail.setMailerHeader();
                 mail.setPriorityHeaders();
                 mail.setListHeaders();
+                mail.setOtpHeader();
                 recipientCount = mail.message.getEnvelope().to.length;
             }
             catch (err) {

package/dist/esm/mailer/mail-message.d.ts

@@ -103,4 +103,11 @@ export default class MailMessage<T = SentMessageInfo> {
     setMailerHeader(): void;
     setPriorityHeaders(): void;
     setListHeaders(): void;
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader(): void;
 }

package/dist/esm/mailer/mail-message.js

@@ -1,6 +1,7 @@
 import * as shared from '../shared/index.js';
 import MimeNode from '../mime-node/index.js';
 import * as mimeFuncs from '../mime-funcs/index.js';
+import * as errors from '../errors.js';
 // Only an own key counts as already set. `key in obj` also matches every member of
 // Object.prototype, which silently drops a transporter default legitimately named
 // toString or constructor.
@@ -262,6 +263,26 @@ export default class MailMessage {
             });
         });
     }
+    /**
+     * Sets the OTP-Token header from the otp option. The header is defined by
+     * draft-goto-otp-token-01, an Internet-Draft that expires on 25 March 2027. By then check
+     * for a newer revision of the draft or a published RFC, the header name and its
+     * parameters are still open questions in the draft.
+     */
+    setOtpHeader() {
+        const otp = this.data.otp;
+        if (!this.message || !otp) {
+            return;
+        }
+        // a structured field String can only hold printable ascii. The code is a secret the recipient
+        // compares against the one in the message body, so it is rejected rather than cleaned up
+        if (typeof otp.code !== 'string' || !/^[\x20-\x7e]+$/.test(otp.code)) {
+            throw otpError('The otp code must be a non-empty string of printable ASCII characters');
+        }
+        // a structured field String escapes the same two characters as a quoted-string. setHeader
+        // replaces any OTP-Token from the custom headers, the field may appear only once
+        this.message.setHeader('OTP-Token', mimeFuncs.quoteString(otp.code) + '; origin=' + mimeFuncs.quoteString(getOtpOrigin(otp.origin)));
+    }
     /** @internal */
     _getListHeaders(listData) {
         // make sure an url looks like <protocol:url>
@@ -321,3 +342,36 @@ export default class MailMessage {
         return '<http://' + url + '>';
     }
 }
+/**
+ * Returns the canonical ascii serialization of the origin the code is bound to. The draft
+ * requires a potentially trustworthy origin, so only https is accepted, plus http on a
+ * loopback host for local development
+ */
+function getOtpOrigin(origin) {
+    let url;
+    try {
+        url = new URL(String(origin));
+    }
+    catch {
+        // handled below
+    }
+    // the WHATWG parser lets characters such as a quote or a brace into a host, which the
+    // origin grammar the draft requires (RFC 6454) does not allow, so a receiver would discard
+    // the header. Only a DNS name, an IPv4 address or a bracketed IPv6 address is accepted.
+    // Userinfo is refused as well, an origin never has it and it turns a value built as
+    // 'https://example.com' + input into the origin of whatever host follows an "@"
+    if (!url || url.username || url.password || !/^([a-z0-9_-]+\.)*[a-z0-9_-]+$|^\[[0-9a-f:.]+\]$/.test(url.hostname)) {
+        throw otpError('The otp origin must be an absolute https URL');
+    }
+    const isLoopback = /^(localhost|.+\.localhost|127(\.\d+){3}|\[::1\])$/.test(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && isLoopback)) {
+        throw otpError('The otp origin must be an https URL, or an http URL on a loopback host');
+    }
+    // the URL parser already lowercases the host, converts it to punycode and drops the default port
+    return url.origin;
+}
+function otpError(message) {
+    const err = new Error(message);
+    err.code = errors.EOTP;
+    return err;
+}

package/dist/esm/mime-node/index.js

@@ -1264,7 +1264,7 @@ class MimeNode {
             .replace(/[\s\x00-\x20\x7f:]/g, '')
             .toLowerCase()
             // use uppercase words, except MIME
-            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
+            .replace(/^X-SMTPAPI$|^(MIME|DKIM|ARC|BIMI)\b|^OTP(?=-Token$)|^[a-z]|-(SPF|FBL|ID|MD5)$|-[a-z]/gi, c => c.toUpperCase())
             // special case
             .replace(/^Content-Features$/i, 'Content-features');
         return key;
@@ -1336,7 +1336,7 @@ class MimeNode {
             // values enclosed in <>
             case 'Message-ID':
             case 'In-Reply-To':
-            case 'Content-Id':
+            case 'Content-ID':
                 // a msg-id is structured, so an encoded word inside the angle brackets would
                 // be read as literal text. drop the characters that can not appear in a header
                 // at all, but leave HT alone, it separates the ids of a multi id value
@@ -1351,6 +1351,14 @@ class MimeNode {
                     value = value + '>';
                 }
                 return value;
+            // a structured field (RFC 9651) that can not be mime encoded, an encoded word would
+            // turn its quoted strings into text that no structured field parser reads. Only
+            // the characters that can not appear in a header at all are removed
+            case 'OTP-Token':
+                return (value || '')
+                    .toString()
+                    .replace(/\r?\n|\r/g, ' ')
+                    .replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
             // space separated list of values enclosed in <>
             case 'References': {
                 const ids = [];

package/dist/esm/nodemailer.d.ts

@@ -111,7 +111,7 @@ export type { Mail, MailDefaults, SentMessageInfo, Transport, TransportOptions }
 export type { SendMailOptions, Transporter } from './mailer/index.js';
 export type { NodemailerError, ErrorCode } from './errors.js';
 export type { MailMessage, MailMessageData, PluginFunction, VerifyCallback } from './mailer/index.js';
-export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders } from './mail-composer/index.js';
+export type { MailComposerOptions, MailComposerAttachment as Attachment, MailComposerAlternative as AttachmentLike, MailComposerIcalEvent as IcalAttachment, MailComposerListHeaders as ListHeaders, MailComposerOtp as Otp } from './mail-composer/index.js';
 export type { MimeNodeAddress as Address, MimeNodeHeaders as Headers } from './mime-node/index.js';
 export type { SMTPConnectionOptions, SMTPConnectionAuth, SMTPEnvelope, SMTPEnvelopeDsn } from './smtp-connection/index.js';
 export type { DKIMOptions } from './dkim/index.js';

package/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "nodemailer";
-export declare const version = "10.2.1";
+export declare const version = "10.3.0";
 export declare const homepage = "https://nodemailer.com/";

package/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = 'nodemailer';
-export const version = '10.2.1';
+export const version = '10.3.0';
 export const homepage = 'https://nodemailer.com/';

package/dist/esm/well-known/services.js

@@ -205,6 +205,13 @@ export const services = {
         "host": "smtp.europe.secureserver.net",
         "port": 25
     },
+    "Groundmail": {
+        "description": "Groundmail",
+        "host": "smtp.groundmail.dev",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
     "hot.ee": {
         "description": "Hot.ee (Estonian email provider)",
         "host": "mail.hot.ee"

package/dist/well-known/services.json

@@ -180,6 +180,14 @@
         "port": 25
     },
 
+    "Groundmail": {
+        "description": "Groundmail",
+        "host": "smtp.groundmail.dev",
+        "port": 587,
+        "secure": false,
+        "requireTLS": true
+    },
+
     "hot.ee": {
         "description": "Hot.ee (Estonian email provider)",
         "host": "mail.hot.ee"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nodemailer",
-    "version": "10.2.1",
+    "version": "10.3.0",
     "description": "Easy as cake e-mail sending from your Node.js applications",
     "type": "module",
     "main": "./dist/cjs/nodemailer.js",
@@ -153,7 +153,7 @@
     },
     "homepage": "https://nodemailer.com/",
     "devDependencies": {
-        "@aws-sdk/client-sesv2": "3.1155.0",
+        "@aws-sdk/client-sesv2": "3.1156.0",
         "@types/node": "20.19.43",
         "bunyan": "1.8.15",
         "c8": "12.0.0",
@@ -163,11 +163,11 @@
         "libbase64": "1.4.1",
         "libmime": "5.6.3",
         "libqp": "3.0.1",
-        "mailauth": "8.0.2",
+        "mailauth": "8.0.4",
         "prettier": "3.9.10",
         "proxy": "1.0.2",
         "proxy-test-server": "1.0.0",
-        "smtp-server": "3.21.0",
+        "smtp-server": "3.21.1",
         "tsx": "4.23.15",
         "typescript": "6.0.3",
         "typescript-eslint": "8.72.0"