7.2.0 (2026-10-09)
Features
- bimi: apply the exact Assertion Record syntax in strict mode (85c4363), closes #166
- dkim: over-sign header field names repeated in headerList (021218f), closes #153
Bug Fixes
- arc: check a large authResults value without running out of stack (624e8a3)
- arc: do not modify the caller's seal options (5c57a9d), closes #159
- arc: fail a chain whose d= is not a host name (2f0babe)
- arc: refuse an ARC-Authentication-Results value that breaks the header (43713b4), closes #161
- arc: seal a malformed chain with cv=fail (c9a4e85), closes #162
- arc: seal with the computed chain status and AAR in authenticate() (d6f7efc), closes #160
- auth-results: write a U-label domain unquoted in strict mode (a24ffd6), closes #169
- bimi: check the SVG Tiny PS document rules, add strict mode (4cf9bfc), closes #165
- bimi: count From addresses with the parser of the DMARC check (0fb165e)
- bimi: ignore an invalid BIMI-Selector header (7f62164), closes #167
- bimi: read the avp= avatar preference tag (f577b50), closes #164
- bimi: report validateVMC() results in Authentication-Results (6b03caa), closes #168
- bimi: restrict logo and evidence downloads (658d8c2)
- bimi: validate logos against an SVG Tiny PS element allowlist (0cf9679)
- bimi: validate the logo from l= before building BIMI headers (bdc7b90)
- dkim: check the key type against a= in both modes (4b9ef52), closes #146
- dkim: encode i= as dkim-quoted-printable and check its syntax (59f63e1), closes #150
- dkim: never align a signature when From has no single Author Domain (ac882e2)
- dkim: parse key records without removing whitespace inside values (4b40376), closes #149
- dkim: read the canonicalization option like a c= value (1383056), closes #152
- dkim: reject a d= that is not a host name and never align it (387db0c)
- dkim: reject an l= larger than the canonicalized body in strict mode (5139833), closes #147
- dkim: report a key record name that can not exist as no key (d4f60ca), closes #145
- dkim: report signatures that are skipped for a missing key (bda5402), closes #151
- dkim: validate the c= syntax and canonicalize with the parsed value (5da00a5), closes #148
- dmarc: discard a policy record with whitespace before v=DMARC1 in strict mode (d84decf), closes #143
- dmarc: discard record fragments without "=" (0cdcf56), closes #142
- dmarc: parse the From header by the RFC 5322 grammar (08da841)
- dmarc: reject a From local-part with a domain literal between its words (ec0af9e)
- dmarc: reject an Author Domain with control or format characters (e1f1bb7)
- mailauth: use the HELO name from the Received header with trustReceived (f7e2869), closes #156
- mta-sts: limit retries of a new policy ID while a cached policy is used (599b988), closes #170
- received: do not guess the client IP when the HELO adds ";" or Exim comments (49b9a45)
- received: take the client IP only from an unambiguous from clause (be23ede)
- spf: accept 0 for maxVoidCount and maxResolveCount (e1826d7), closes #158
- spf: accept a MAIL FROM or HELO domain with a single trailing dot (11256ae)
- spf: check the expanded explanation string for US-ASCII (b4e844e), closes #155
- spf: do not count the %{p} PTR query as a void lookup (46f3298), closes #154
- spf: report the reason of macro syntax errors in the permerror comment (d3fe2bf), closes #157
- spf: split macro values on exactly the delimiters that are listed (98c32c0)
- types: mark DMARCResult policy fields optional and cite RFC 9989 9.1 (10dd7fe), closes #144