Sender checks as a level: Relaxed, Recommended or Strict #40

Merged

jcoffey-dev merged 1 commits from feature/sender-check-levels into main

2026-09-28 21:59:56 +00:00

jcoffey-dev commented

2026-09-28 19:27:12 +00:00

Owner

Third first-wave item from the settings-reorg spec. Independent: based on main, no dependency on the other open PRs.

The Sender checks page (x:SenderAuth) now opens with one choice instead of six "Strategy" fields, plus a table of what each level does to mail that fails. The levels are based on what the SMTP code actually does with each setting:

	Relaxed (stock)	Recommended	Strict
SPF on EHLO	checked, scored	checked, scored	checked, scored
SPF on MAIL FROM	checked, scored	checked, scored	refused unless pass
DKIM	checked, scored	checked, scored	checked, scored
DMARC	checked, scored	refused if the domain says reject	refused if the domain says reject
ARC	off	checked, scored	broken chains refused
Reverse DNS	checked, scored	checked, scored	refused unless pass

Relaxed is exactly the server's stock values. An untouched server shows as Relaxed.
Why the levels are built this way: strict SPF and reverse DNS refuse anything that isn't a pass, including senders with no SPF record or no PTR. That's why only Strict uses them, with a warning.
No level uses strict DKIM: it refuses all unsigned mail, which RFC 6376 §6.1 advises against. Strict DMARC only refuses when the sender's domain publishes p=reject, so Recommended uses it.
Port 25 only: checks stay on port 25, where other servers deliver; mail from signed-in users isn't checked. Same as stock.
Hand-set values show as Set by hand below. Applying a level then says it replaces the six checks, including added conditions. DKIM signing isn't touched.
The form reloads after a level is applied.

Checked: unit tests for the level values, and that the stock values are recognized as Relaxed (429 total), plus typecheck, lint and build. In Chrome against a local server with hand-edited values: it showed Set by hand; applying Recommended saved and applied, badged it Current and reloaded the form. Read back over JMAP, it had exactly the Recommended expressions with DKIM signing unchanged, and no config warnings.

English only: about 25 new strings.

Third first-wave item from the settings-reorg spec. **Independent**: based on main, no dependency on the other open PRs. The Sender checks page (x:SenderAuth) now opens with one choice instead of six "Strategy" fields, plus a table of what each level does to mail that fails. The levels are based on what the SMTP code actually does with each setting: | | Relaxed (stock) | Recommended | Strict | |---|---|---|---| | SPF on EHLO | checked, scored | checked, scored | checked, scored | | SPF on MAIL FROM | checked, scored | checked, scored | **refused** unless pass | | DKIM | checked, scored | checked, scored | checked, scored | | DMARC | checked, scored | **refused if the domain says reject** | **refused if the domain says reject** | | ARC | off | checked, scored | **broken chains refused** | | Reverse DNS | checked, scored | checked, scored | **refused** unless pass | - **Relaxed is exactly the server's stock values.** An untouched server shows as Relaxed. - **Why the levels are built this way:** strict SPF and reverse DNS refuse *anything that isn't a pass*, including senders with no SPF record or no PTR. That's why only Strict uses them, with a warning. - **No level uses strict DKIM:** it refuses all unsigned mail, which RFC 6376 §6.1 advises against. Strict DMARC only refuses when the sender's domain publishes `p=reject`, so Recommended uses it. - **Port 25 only:** checks stay on port 25, where other servers deliver; mail from signed-in users isn't checked. Same as stock. - **Hand-set values** show as *Set by hand below*. Applying a level then says it replaces the six checks, including added conditions. DKIM signing isn't touched. - The form reloads after a level is applied. **Checked:** unit tests for the level values, and that the stock values are recognized as Relaxed (429 total), plus typecheck, lint and build. In Chrome against a local server with hand-edited values: it showed *Set by hand*; applying Recommended saved and applied, badged it Current and reloaded the form. Read back over JMAP, it had exactly the Recommended expressions with DKIM signing unchanged, and no config warnings. English only: about 25 new strings.

jcoffey-dev added 2 commits 2026-09-28 21:57:07 +00:00

Guided setup: connect a sign-in directory

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

0c64ff214b

Directories and Authentication offer a guide ("Guided or manual?" each
time) that:

- starts from Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik
  or another OpenID Connect provider, with filters and attributes set for
  that directory and example connection values;
- saves the directory, which changes nothing while no domain uses it,
  and tests a real person against it with the server's directory test:
  found or not (with aliases and groups), and whether a password signs
  in, a wrong password told apart from a broken connection. The guide
  won't go on until a person is found and, if given, the password works;
- then asks which domains sign in through it, with each domain's account
  count, and the server default as a separate switch. Choosing the
  domain you sign in on, or the default, needs an explicit "I've checked
  I can still sign in";
- switches the chosen domains over, putting them back if making it the
  default is refused.

Needs inbuxa-server's POST /api/directory/test.

Sender checks as a level: Relaxed, Recommended or Strict

ci / build (pull_request) Successful in 1m38s

Details

ci / publish (pull_request) Skipped

Details

86ae2c6672

Mail flow › Receiving › Sender checks opens with one choice instead of
six strategy fields, and a table of what each level does to mail that
fails. From the SMTP code:

- Relaxed (the stock settings): SPF, DKIM, DMARC and reverse DNS are
  checked on port 25 and scored by the spam filter; nothing is refused.
- Recommended: also refuses mail that fails DMARC for a domain that
  publishes p=reject, and checks ARC.
- Strict: also refuses senders that fail reverse DNS or SPF on MAIL
  FROM (including senders with none), and broken ARC chains. It warns
  that some real mail from small or badly set-up servers will bounce.

No level refuses unsigned mail (strict DKIM, which RFC 6376 advises
against). Checks stay on port 25, like the stock settings. Values set by
hand show as "Set by hand below", and applying a level then says it
replaces them. The form reloads after a level is applied; DKIM signing
isn't touched.

jcoffey-dev force-pushed feature/sender-check-levels from c09b49a308 to 86ae2c6672

2026-09-28 21:57:07 +00:00

Compare

jcoffey-dev merged commit c78ae0af37 into main

2026-09-28 21:59:56 +00:00

jcoffey-dev deleted branch feature/sender-check-levels

2026-09-28 21:59:56 +00:00

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: inbuxa/inbuxa-admin#40