feat: surface most severe SPF result and hide "via" badge on spoofed mail

2026-06-01 17:46:57 +02:00
parent 4659b81538
commit 3035fb046f
6 changed files with 173 additions and 14 deletions
@@ -1134,7 +1134,9 @@ export class JMAPClient implements IJMAPClient {

    const authResultsHeader = headersRecord['Authentication-Results'];
    if (authResultsHeader) {
-      const value = Array.isArray(authResultsHeader) ? authResultsHeader[0] : authResultsHeader;
+      // Multiple Authentication-Results headers (or multiple SPF identities in
+      // one header) must all be considered so the most severe result wins.
+      const value = Array.isArray(authResultsHeader) ? authResultsHeader.join('; ') : authResultsHeader;
      email.authenticationResults = parseAuthenticationResults(value);
    }