[byjpr]

Closes #16

Changes

• settings.dmarc.enforceInbound (default true, unchanged behaviour). With false, Rspamd only scores DMARC failures instead of rejecting or quarantining according to the sender's policy.
• docs/deliverability.md covers:
  • Apps and services sending as your domain:
    • Send-only account: create one (sendOnly = true) and submit on 465, so the mail is DKIM-signed and passes DMARC.
    • Authorise the service: prefer the service's custom DKIM, use relay.spfInclude and its 10-lookup limit, and use subdomains for bulk mail.
    • Rollout: take a domain that already sends elsewhere through p=none → read reports → quarantine → reject.
  • Mailing lists that break DKIM without rewriting From: are rejected under enforcement, as Gmail and Outlook would do. It explains when to turn enforcement off.
• The README limitation links to it.

Testing

• The CI fixture now sets enforceInbound = false. The generated local.d/dmarc.conf then has no actions block, only reporting. With the default (true), the block is present as before. Enforcement itself was verified with Rspamd in Reject authenticated mail with a From: header the user does not own #26: DMARC_POLICY_REJECT → reject.
• All 5 provider example systems build. nixfmt, shellcheck and tofu validate pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01G22o7QQ17GRtkCqpJNFr9B

---

Generated by Claude Code