8.0.5 (2026-11-10)
Summary
This release makes a skipped DMARC evaluation visible in the Authentication-Results header, follows the newer DKIM2 draft for which header fields are signed, and moves joi to 18.3.2 so dependency audits no longer flag mailauth.
Who should upgrade
- Everyone who acts on the Authentication-Results header that
authenticate()generates. Before this release, a message whose From header had no usable Author Domain (missing, several addresses, several From fields, or a domain with an invisible character) got nodmarcentry at all, so it looked the same as a message nobody checked. - Anyone whose
npm auditreports GHSA-4528-x5fx-h6hg through mailauth. mailauth never called the affected joi function (Joi.string().email({ multiple: true })), so the vulnerable code was not reachable, but the old exact pin blocked the patched version.
Breaking changes / action required
- DKIM2 (experimental) now signs
Auto-SubmittedandVBR-Info, as in section 4.1 of draft-ietf-dkim-dkim2-spec-08. A DKIM2 signature made by a spec-06 or spec-07 implementation on a message that carries either field no longer verifies.
Highlights
- Authentication-Results now carries
dmarc=permerror reason="..."when DMARC could not be evaluated. The result object is unchanged. - DKIM2 signs
Auto-SubmittedandVBR-Info(thanks @serg-tanichev). - Runtime dependencies updated: joi 18.3.2, fast-xml-parser 5.12.0, libmime 5.6.4, nodemailer 10.5.0, undici 7.30.2.
Bug Fixes
- dkim2: sign Auto-Submitted and VBR-Info as in spec-08 (1b61603)
- report a skipped DMARC evaluation as dmarc=permerror in Authentication-Results (8c0b96c)
- update joi to 18.3.2 for GHSA-4528-x5fx-h6hg (bbc492d), closes #181