email header authentication audit derived

{
  "input": {
    "body": {
      "headers": "Received: from relay.vendor.test (relay.vendor.test [198.51.100.7])\n\tby mx.receiver.test with ESMTPS id abc123\n\tfor <ada@receiver.test>; Thu, 2 Oct 2026 12:00:00 +0000\nAuthentication-Results: relay.vendor.test;\n\tspf=softfail smtp.mailfrom=bounces.vendor.test;\n\tdkim=pass header.d=vendor.test;\n\tdmarc=fail\nAuthentication-Results: mx.receiver.test; spf=pass smtp.mailfrom=example.test; dkim=pass header.d=example.test\nFrom: Billing <billing@example.test>\nFrom: Billing <billing@example-test.test>\nSubject: Your invoice\n",
      "expected_from_domain": "example.test",
      "trusted_authserv_ids": [
        "mx.receiver.test"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "limits": {
        "maxRecords": 2000,
        "maxFindings": 500,
        "maxHeaderBytes": 131072,
        "maxIncludeTree": 200,
        "spfLookupLimit": 10,
        "maxRecordLength": 4096,
        "spfVoidLookupLimit": 2
      },
      "passed": false,
      "methods": {
        "spf": [
          "softfail"
        ],
        "dkim": [
          "pass"
        ],
        "dmarc": [
          "fail"
        ]
      },
      "complete": true,
      "findings": [
        {
          "code": "SEVERAL_FROM_HEADERS",
          "detail": "There are 2 From headers. Which one is displayed and which one is evaluated can differ between a mail client and a filter, which is the shape of a spoof rather than a mistake."
        },
        {
          "code": "SEVERAL_AUTHENTICATION_RESULTS",
          "detail": "There are 2 Authentication-Results headers. Only the topmost one added by a trusted server may be relied on, because anything below it can have been added before the message arrived."
        },
        {
          "code": "AUTHSERV_ID_NOT_TRUSTED",
          "name": "relay.vendor.test",
          "detail": "The topmost Authentication-Results was added by relay.vendor.test, which is not in the trusted list. A result from an untrusted server says nothing, because anything upstream can write that header."
        }
      ],
      "request_id": "example-request",
      "service_id": "email_header_authentication_audit",
      "spf_domain": "bounces.vendor.test",
      "assumptions": [
        "Headers are unfolded first, because a field continues on any line beginning with whitespace and reading line by line would split an Authentication-Results header across several and parse none of them.",
        "Only the topmost Authentication-Results is relied on, and only when its authserv-id is in a list the caller supplies, because anything below it can have been written before the message arrived.",
        "Alignment is checked against the From domain, since a pass on a different domain is a pass DMARC does not accept however valid the signature is."
      ],
      "dkim_domain": "vendor.test",
      "from_domain": "example.test",
      "limitations": [
        "The headers supplied. No signature is verified and no DNS is resolved, so this reports what the receiving server recorded rather than independently confirming it.",
        "authenticated is true only when every recorded method passed, every domain aligned, and the result came from a server the caller named as trusted."
      ],
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [],
      "authenticated": false,
      "finding_count": 7,
      "service_version": "1.0.0",
      "findings_by_code": {
        "SEVERAL_FROM_HEADERS": 1,
        "SPF_DOMAIN_NOT_ALIGNED": 1,
        "AUTHSERV_ID_NOT_TRUSTED": 1,
        "DKIM_DOMAIN_NOT_ALIGNED": 1,
        "SEVERAL_AUTHENTICATION_RESULTS": 1,
        "AUTHENTICATION_METHOD_DID_NOT_PASS": 2
      },
      "from_header_count": 2,
      "received_hop_count": 1,
      "topmost_authserv_id": "relay.vendor.test",
      "authentication_results_count": 2
    }
  }
}