+ {t(
+ 'senderLevels.footnote',
+ 'Checks run on port 25, where other servers deliver; mail from your own signed-in users isn’t checked. No level refuses unsigned mail: most legitimate mail would bounce.',
+ )}
+
+
+ {t(
+ 'senderLevels.replaces',
+ 'This replaces the six checks below, including any conditions you added to them. DKIM signing isn’t touched.',
+ )}
+
+ )}
+
+
+ )}
+ {error &&
{error}
}
+
+ );
+}
diff --git a/src/features/senderChecks/SenderChecksPage.tsx b/src/features/senderChecks/SenderChecksPage.tsx
new file mode 100644
index 0000000..8413e68
--- /dev/null
+++ b/src/features/senderChecks/SenderChecksPage.tsx
@@ -0,0 +1,20 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+import { useState } from 'react';
+import { DynamicForm } from '@/components/forms/DynamicForm';
+import { SenderChecksLevels } from './SenderChecksLevels';
+
+/** Sender checks: the level choice, then the full form, reloaded when a level is applied. */
+export function SenderChecksPage({ viewName }: { viewName: string }) {
+ const [version, setVersion] = useState(0);
+ return (
+
+ setVersion((v) => v + 1)} />
+
+
+ );
+}
diff --git a/src/features/senderChecks/levels.test.ts b/src/features/senderChecks/levels.test.ts
new file mode 100644
index 0000000..5f1fbcb
--- /dev/null
+++ b/src/features/senderChecks/levels.test.ts
@@ -0,0 +1,44 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+import { describe, it, expect } from 'vitest';
+import { currentLevel, levelValues } from './levels';
+
+// The server's stock values (x:SenderAuth defaults).
+const stock = {
+ arcVerify: { else: 'disable', match: {} },
+ dkimStrict: true,
+ dkimVerify: { else: 'relaxed', match: {} },
+ dmarcVerify: { else: 'disable', match: { '0': { if: 'local_port == 25', then: 'relaxed' } } },
+ reverseIpVerify: { else: 'disable', match: { '0': { if: 'local_port == 25', then: 'relaxed' } } },
+ spfEhloVerify: { else: 'disable', match: { '0': { if: 'local_port == 25', then: 'relaxed' } } },
+ spfFromVerify: { else: 'disable', match: { '0': { if: 'local_port == 25', then: 'relaxed' } } },
+};
+
+describe('levels', () => {
+ it('Relaxed is exactly the stock settings', () => {
+ expect(currentLevel(stock)).toBe('relaxed');
+ expect(levelValues('relaxed')).toEqual(stock);
+ });
+
+ it('Recommended honors DMARC reject and checks ARC on port 25', () => {
+ const v = levelValues('recommended');
+ expect(v.dmarcVerify).toEqual({ match: { '0': { if: 'local_port == 25', then: 'strict' } }, else: 'disable' });
+ expect(v.arcVerify).toEqual({ match: { '0': { if: 'local_port == 25', then: 'relaxed' } }, else: 'disable' });
+ expect(v.spfFromVerify).toEqual(stock.spfFromVerify);
+ });
+
+ it('no level rejects unsigned mail', () => {
+ for (const l of ['relaxed', 'recommended', 'strict'] as const) {
+ expect(levelValues(l).dkimVerify).toEqual({ match: {}, else: 'relaxed' });
+ }
+ });
+
+ it('recognises each level it writes, and hand-set values as none', () => {
+ for (const l of ['relaxed', 'recommended', 'strict'] as const) expect(currentLevel(levelValues(l))).toBe(l);
+ expect(currentLevel({ ...stock, spfEhloVerify: { else: 'strict', match: {} } })).toBeNull();
+ });
+});
diff --git a/src/features/senderChecks/levels.ts b/src/features/senderChecks/levels.ts
new file mode 100644
index 0000000..4786c45
--- /dev/null
+++ b/src/features/senderChecks/levels.ts
@@ -0,0 +1,100 @@
+/*
+ * SPDX-FileCopyrightText: 2026 Coffey Labs
+ *
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+/**
+ * inbuxa: Sender checks as three levels (settings-reorg, first wave). What
+ * each setting really does, from the SMTP code:
+ *
+ * - relaxed: check, record the result for the spam filter, reject nothing;
+ * - strict SPF or reverse DNS: reject anything that isn't a pass, including
+ * a sender with no SPF record or no reverse DNS at all;
+ * - strict DKIM: reject every message without a passing signature, unsigned
+ * mail included, which RFC 6376 §6.1 advises against, so no level uses it;
+ * - strict DMARC: reject only when the sender's domain publishes p=reject
+ * and the message fails, which is what that domain asked for;
+ * - strict ARC: reject a broken ARC chain (no chain passes).
+ *
+ * Checks apply on port 25, where other servers deliver; mail from signed-in
+ * users (587/465) isn't checked, as in the stock settings. DKIM keeps its
+ * stock "relaxed everywhere".
+ */
+
+export type Level = 'relaxed' | 'recommended' | 'strict';
+export const LEVELS: Level[] = ['relaxed', 'recommended', 'strict'];
+
+export type Expr = { match: Record; else: string };
+
+export const CHECKS = [
+ 'spfEhloVerify',
+ 'spfFromVerify',
+ 'dkimVerify',
+ 'dmarcVerify',
+ 'arcVerify',
+ 'reverseIpVerify',
+] as const;
+export type Check = (typeof CHECKS)[number];
+
+type Mode = 'relaxed' | 'strict' | 'disable';
+
+const onPort25 = (mode: Mode): Expr => ({ match: { '0': { if: 'local_port == 25', then: mode } }, else: 'disable' });
+const everywhere = (mode: Mode): Expr => ({ match: {}, else: mode });
+
+const MODES: Record> = {
+ relaxed: {
+ spfEhloVerify: 'relaxed',
+ spfFromVerify: 'relaxed',
+ dkimVerify: 'relaxed',
+ dmarcVerify: 'relaxed',
+ arcVerify: 'disable',
+ reverseIpVerify: 'relaxed',
+ },
+ recommended: {
+ spfEhloVerify: 'relaxed',
+ spfFromVerify: 'relaxed',
+ dkimVerify: 'relaxed',
+ dmarcVerify: 'strict',
+ arcVerify: 'relaxed',
+ reverseIpVerify: 'relaxed',
+ },
+ strict: {
+ spfEhloVerify: 'relaxed',
+ spfFromVerify: 'strict',
+ dkimVerify: 'relaxed',
+ dmarcVerify: 'strict',
+ arcVerify: 'strict',
+ reverseIpVerify: 'strict',
+ },
+};
+
+export function modeOf(level: Level, check: Check): Mode {
+ return MODES[level][check];
+}
+
+/** The six expressions a level writes, plus rejecting insecure DKIM signatures. */
+export function levelValues(level: Level): Record & { dkimStrict: boolean } {
+ const out = { dkimStrict: true } as Record & { dkimStrict: boolean };
+ for (const c of CHECKS) {
+ const mode = MODES[level][c];
+ out[c] = c === 'dkimVerify' ? everywhere(mode) : mode === 'disable' ? everywhere('disable') : onPort25(mode);
+ }
+ return out;
+}
+
+function norm(e: unknown): string {
+ const x = (e ?? {}) as Partial;
+ const rules = Object.values(x.match ?? {}).map((r) => [r.if.replace(/\s+/g, ' ').trim(), r.then.trim()]);
+ return JSON.stringify([rules, (x.else ?? '').trim()]);
+}
+
+/** Which level the current settings are, or null when they've been set by hand. */
+export function currentLevel(values: Record): Level | null {
+ return (
+ LEVELS.find((level) => {
+ const want = levelValues(level);
+ return CHECKS.every((c) => norm(values[c]) === norm(want[c])) && values.dkimStrict !== false;
+ }) ?? null
+ );
+}