51 releases 59 tags

RSS feed

• v0.23.0 4b50f4f13b

  Compare

  v0.23.0 Stable

  joeyr released this 2026-08-19 23:22:51 -05:00 | 40 commits to main since this release

  A dmarc=pass was being reported as one fact when it is really two very different
  ones. 0.22.0 shipped an authentication block that came back all-green on a confirmed
  phishing message. That was accurate — the sender owned their domain and signed their own
  mail — but it read as a clean bill of health, and "technically true" is not the bar for a
  security signal.

  Added

  • The published DMARC policy, beside the verdict it qualifies. pass under
    p=reject means the domain owner asks receivers to bin anything that fails, so they
    have staked their own delivery on it. pass under p=none means they asked receivers
    to do nothing about failures — passing cost anyone controlling the domain almost
    nothing, and disposable and abused domains characteristically publish it. The phish
    published p=none, as did every message in the Junk folder, against 25 reject and
    18 quarantine across a 60-message inbox sample.

    It is not in Authentication-Results at all — it comes from iCloud's X-DMARC-Policy,
    a header already being fetched and discarded. The caveat also rides along in
    assessment, because a qualifier the reader has to go looking for is one that gets
    skipped.

  • The provider's own verdict — X-Apple-Action and X-ICL-Score, reported as
    provider with an explicit flagged_as_junk. A different question from
    authentication: not "did this domain send it" but "does Apple think it is junk".

    Reported with the honest limit attached. The scores do separate Apple's own junk
    calls (Junk at 4.33; inbox median 3.33, one message of 60 at or above the lowest Junk
    score) — but Apple's filter scored the confirmed phish 3.33, exactly the inbox
    median, and routed it to INBOX. So only the flagged direction carries information,
    and score_note says so in the payload rather than in a doc, so that "Apple didn't
    flag it" can never be read back as reassurance.

  Changed

  • probes/m5_verify.py now runs 21 read-only live checks, up from 16, including that
    a p=none pass is described as a weak claim in both the data and the assessment, and
    that a low provider score is never presented as reassurance.

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads