gate: drop bare spf=pass from anti-spoof set (keep DKIM/DMARC only — header-From-aligned)

15ecdd0da1e1bc7ec5d1cb4bfe22d04cd7040fe1 · 2026-06-25 10:20:41 -0700 · Steve

Files touched

M lib.js

Diff

commit 15ecdd0da1e1bc7ec5d1cb4bfe22d04cd7040fe1
Author: Steve <steve@designerwallcoverings.com>
Date:   Thu Jun 25 10:20:41 2026 -0700

    gate: drop bare spf=pass from anti-spoof set (keep DKIM/DMARC only — header-From-aligned)
---
 lib.js | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/lib.js b/lib.js
index 80ef6a0..cfe1e44 100644
--- a/lib.js
+++ b/lib.js
@@ -69,7 +69,10 @@ function gate(parsed) {
 
   if (cfg.requireAuthPass) {
     const ar = headerStr(parsed, 'authentication-results').toLowerCase();
-    const passed = ar.includes('dkim=pass') || ar.includes('dmarc=pass') || ar.includes('spf=pass');
+    // Only DKIM/DMARC count — both are aligned to the header From the allowlist
+    // checks. Bare SPF authenticates the envelope return-path, not From, so it's
+    // dropped as an anti-spoof signal (all allowlisted senders are DKIM/DMARC-signed).
+    const passed = ar.includes('dkim=pass') || ar.includes('dmarc=pass');
     if (!passed) return { ok: false, reason: `failed email auth (dkim/dmarc): ${ar.slice(0, 120) || 'no Authentication-Results'}` };
   }
   return { ok: true, reason: 'ok', from };

← 1a8facd poller: guard against invoking claude on an empty prompt (em · back to Claude Mail · auto-save: 2026-06-25T11:33:53 (1 files) — tmp-godaddy-login 5a18aa5 →