Email Auth Alignment

Explains why authenticated mail still fails DMARC, from DNS TXT records and message header facts that YOU supply.

It performs no DNS lookups, no network I/O and no cryptographic verification of any kind. It never fetches an SPF, DKIM or DMARC record, never resolves a domain, and never checks a signature. Every fact it reasons about is passed in by the caller.

THE SILENT FAILURE. An operator configures SPF, sends a test message, sees spf=pass, and concludes email authentication is done. Then a fraction of mail goes to spam or is rejected at scale, and nothing in their setup looks wrong.

ALIGNMENT, NOT AUTHENTICATION. DMARC does not care that SPF passed. It cares whether the domain SPF authenticated -- the envelope Return-Path domain -- matches the From header domain the recipient actually sees. An ESP sending with its own bounce domain produces spf=pass and dmarc=fail simultaneously.

THE TEN-LOOKUP LIMIT. RFC 7208 caps SPF DNS lookups at 10. Every include:, a:, mx:, ptr: and redirect= counts, recursively -- so a record that works today breaks the moment a vendor adds an include inside their own record. The result is PERMERROR, often treated as fail, and nothing in the sender's own DNS changed.

SOFT POLICIES THAT DO NOTHING. p=none is a monitoring policy and protects nobody, yet appears in every 'DMARC configured' checklist. Likewise +all and ?all authorize, or shrug at, the entire internet while looking like configuration.

DKIM d= MISMATCH. A signature can verify cryptographically while its d= domain is the ESP's: authenticated, and unaligned. Same trap, different route.

Because it reasons only about facts you supply, it is testable, reproducible and safe to run anywhere -- and it says plainly when a fact it needs is missing rather than assuming a pass.

VERIFIED: 96 tests, re-measured by running the suite. Every mutation was observed FAILING before the source was restored. Independently reviewed by a verifier whose job was to find what is wrong, not to agree.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function computeAlignment( authDomain: string, fromDomain: string, mode: AlignmentMode, suffixLookup?: SuffixLookup ): AlignmentResult;
  export function parseDkimSignatureHeader(headerValue: string): DkimHeaderParseResult;
  export function parseDmarcRecord(txt: string): DmarcParseResult;
  export function conservativeSuffixLookup(domain: string): string | null;
  export function organizationalDomain( domain: string, suffixLookup: SuffixLookup = conservativeSuffixLookup ): OrganizationalDomainResult;
  export function parseSpfRecord(txt: string): SpfParseResult;
  export function analyzeAllMechanism(record: ParsedSpfRecord): SpfAllAnalysis;
  export function countSpfDnsLookups(input: SpfLookupCountInput): SpfLookupCountResult;
  export function evaluateDmarc(input: EvaluateDmarcInput): EvaluateDmarcResult;

  export type DkimHeaderParseResult = | { ok: true;
  export type DmarcParseResult = | { ok: true;
  export type SuffixLookup = (domain: string) => string | null;
  export type SpfTerm = SpfMechanismTerm | SpfModifierTerm;
  export type SpfParseResult = | { ok: true;
  export type SpfQualifier = "+" | "-" | "~" | "?";