v2.2.0

Phase 3 of the Rust migration: the Rust security bridge is now mandatory
and all TypeScript security fallback implementations have been removed.

- UnifiedEmailServer.start() throws if Rust bridge fails to start
- SpfVerifier gutted to thin wrapper (parseSpfRecord stays in TS)
- DKIMVerifier gutted to thin wrapper delegating to bridge.verifyDkim()
- IPReputationChecker delegates to bridge.checkIpReputation(), keeps LRU cache
- DmarcVerifier keeps alignment logic (works with pre-computed results)
- DKIM signing via bridge.signDkim() in all 4 locations
- Removed mailauth and ip packages from plugins.ts (~1,200 lines deleted)

.gitea/release-template.md

@@ -6,7 +6,7 @@ Pre-compiled binaries for multiple platforms.
 
 #### Option 1: Via npm (recommended)
 ```bash
-npm install -g @serve.zone/mailer
+npm install -g @push.rocks/smartmta
 ```
 
 #### Option 2: Direct binary download

.gitea/workflows/npm-publish.yml

@@ -84,7 +84,7 @@ jobs:
           mailer --version || echo "Note: Binary execution may fail in CI environment"
           echo ""
           echo "Checking installed files:"
-          npm ls -g @serve.zone/mailer || true
+          npm ls -g @push.rocks/smartmta || true
 
       - name: Publish to npm
         env:
@@ -93,10 +93,10 @@ jobs:
           echo "Publishing to npm registry..."
           npm publish --access public
           echo ""
-          echo "✅ Successfully published @serve.zone/mailer to npm!"
+          echo "✅ Successfully published @push.rocks/smartmta to npm!"
           echo ""
           echo "Package info:"
-          npm view @serve.zone/mailer
+          npm view @push.rocks/smartmta
 
       - name: Verify npm package
         run: |
@@ -104,10 +104,10 @@ jobs:
           sleep 30
           echo ""
           echo "Verifying published package..."
-          npm view @serve.zone/mailer
+          npm view @push.rocks/smartmta
           echo ""
           echo "Testing installation from npm:"
-          npm install -g @serve.zone/mailer
+          npm install -g @push.rocks/smartmta
           echo ""
           echo "Package installed successfully!"
           which mailer || echo "Binary location check skipped"
@@ -118,12 +118,12 @@ jobs:
           echo "  npm Publish Complete!"
           echo "================================================"
           echo ""
-          echo "✅ Package: @serve.zone/mailer"
+          echo "✅ Package: @push.rocks/smartmta"
           echo "✅ Version: ${{ steps.version.outputs.version }}"
           echo ""
           echo "Installation:"
-          echo "  npm install -g @serve.zone/mailer"
+          echo "  npm install -g @push.rocks/smartmta"
           echo ""
           echo "Registry:"
-          echo "  https://www.npmjs.com/package/@serve.zone/mailer"
+          echo "  https://www.npmjs.com/package/@push.rocks/smartmta"
           echo ""

changelog.md

@@ -1,5 +1,48 @@
 # Changelog
 
+## 2026-02-10 - 2.2.0 - feat(mailer-smtp)
+implement in-process SMTP server and management IPC integration
+
+- Add full SMTP protocol engine crate (mailer-smtp) with modules: command, config, connection, data, response, session, state, validation, rate_limiter and server
+- Introduce SmtpServerConfig, DataAccumulator (DATA phase handling, dot-unstuffing, size limits) and SmtpResponse builder with EHLO capability construction
+- Add in-process RateLimiter using DashMap and runtime-configurable RateLimitConfig
+- Add TCP/TLS server start/stop API (start_server) with TlsAcceptor building from PEM and SmtpServerHandle for shutdown and status
+- Integrate callback registry and oneshot-based correlation callbacks in mailer-bin management mode for email processing/auth results and JSON IPC parsing for SmtpServerConfig
+- TypeScript bridge and routing updates: new IPC commands/types (startSmtpServer, stopSmtpServer, emailProcessingResult, authResult, configureRateLimits) and event handlers (emailReceived, authRequest)
+- Update Cargo manifests and lockfile to add dependencies (dashmap, regex, rustls, rustls-pemfile, rustls-pki-types, uuid, serde_json, base64, etc.)
+- Add comprehensive unit tests for new modules (config, data, response, session, state, rate_limiter, validation)
+
+## 2026-02-10 - 2.1.0 - feat(security)
+migrate content scanning and bounce detection to Rust security bridge; add scanContent IPC command and Rust content scanner with tests; update TS RustSecurityBridge and callers, and adjust CI package references
+
+- Add Rust content scanner implementation (rust/crates/mailer-security/src/content_scanner.rs) with pattern-based detection and unit tests (~515 lines)
+- Expose new IPC command 'scanContent' in mailer-bin and marshal results via JSON for the RustSecurityBridge
+- Update TypeScript RustSecurityBridge with scanContent typing and method, and replace local JS detection logic (bounce/content) to call Rust bridge
+- Update tests to start/stop the RustSecurityBridge and rely on Rust-based detection (test updates in test.bouncemanager.ts and test.contentscanner.ts)
+- Update CI workflow messages and package references from @serve.zone/mailer to @push.rocks/smartmta
+- Add regex dependency to rust mailer-security workspace (Cargo.toml / Cargo.lock updated)
+
+## 2026-02-10 - 2.0.1 - fix(docs/readme)
+update README: clarify APIs, document RustSecurityBridge, update examples and architecture diagram
+
+- Documented RustSecurityBridge: startup/shutdown, automatic delegation, compound verifyEmail API, and individual operations
+- Clarified verification APIs: SpfVerifier.verify() and DmarcVerifier.verify() examples now take an Email object as the first argument
+- Updated example method names/usages: scanEmail, createEmail, evaluateRoutes, checkMessageLimit, isEmailSuppressed, DKIMCreator rotation and output formatting
+- Reformatted architecture diagram and added Rust Security Bridge and expanded Rust Acceleration details
+- Rate limiter example updated: renamed/standardized config keys (maxMessagesPerMinute, domains) and added additional limits (maxRecipientsPerMessage, maxConnectionsPerIP, etc.)
+- DNS management documentation reorganized: UnifiedEmailServer now handles DNS record setup automatically; DNSManager usage clarified for standalone checks
+- Minor wording/formatting tweaks throughout README (arrow styles, headings, test counts)
+
+## 2026-02-10 - 2.0.0 - BREAKING CHANGE(smartmta)
+Rebrand package to @push.rocks/smartmta, add consolidated email security verification and IPC handler
+
+- Package renamed from @serve.zone/mailer to @push.rocks/smartmta (package.json, commitinfo, README and homepage/bugs/repository URLs updated) — breaking for consumers who import by package name.
+- Added new compound email security API verify_email_security that runs DKIM, SPF and DMARC in a single call (rust/crates/mailer-security/src/verify.rs) and exposed it from the mailer-security crate.
+- Added IPC handler "verifyEmail" in mailer-bin to call the new verify_email_security function from the Rust side.
+- Refactored DKIM and SPF code to convert mail-auth outputs to serializable results (dkim_outputs_to_results and SpfResult::from_output) and wired them into the combined verifier.
+- Updated TypeScript plugin exports and dependencies: added @push.rocks/smartrust and exported smartrust in ts/plugins.ts.
+- Large README overhaul to reflect rebranding, install instructions, architecture and legal/company info.
+
 ## 2026-02-10 - 1.3.1 - fix(deps)
 add workspace dependency entries for multiple crates across mailer-bin, mailer-core, and mailer-security
 

dist_ts/00_commitinfo_data.js

@@ -2,8 +2,8 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-    name: '@serve.zone/mailer',
+    name: '@push.rocks/smartmta',
-    version: '1.3.0',
+    version: '2.1.0',
-    description: 'Enterprise mail server with SMTP, HTTP API, and DNS management - built for serve.zone infrastructure'
+    description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxvQkFBb0I7SUFDMUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHNHQUFzRztDQUNwSCxDQUFBIn0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxzQkFBc0I7SUFDNUIsT0FBTyxFQUFFLE9BQU87SUFDaEIsV0FBVyxFQUFFLHlIQUF5SDtDQUN2SSxDQUFBIn0=

dist_ts/mail/core/classes.bouncemanager.d.ts

@@ -165,21 +165,6 @@ export declare class BounceManager {
         type: BounceType;
         category: BounceCategory;
     } | null;
-    /**
-     * Analyze SMTP response and diagnostic codes to determine bounce type
-     * @param smtpResponse SMTP response string
-     * @param diagnosticCode Diagnostic code from bounce
-     * @param statusCode Status code from bounce
-     * @returns Detected bounce type and category
-     */
-    private detectBounceType;
-    /**
-     * Check if text matches any pattern for a bounce type
-     * @param text Text to check against patterns
-     * @param bounceType Bounce type to get patterns for
-     * @returns Whether the text matches any pattern
-     */
-    private matchesPattern;
     /**
      * Get all known hard bounced addresses
      * @returns Array of hard bounced email addresses

dist_ts/mail/delivery/classes.emailsignjob.js

@@ -1,4 +1,5 @@
 import * as plugins from '../../plugins.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 export class EmailSignJob {
     emailServerRef;
     jobOptions;
@@ -12,25 +13,14 @@ export class EmailSignJob {
     }
     async getSignatureHeader(emailMessage) {
         const privateKey = await this.loadPrivateKey();
-        const signResult = await plugins.dkimSign(emailMessage, {
+        const bridge = RustSecurityBridge.getInstance();
-            signingDomain: this.jobOptions.domain,
+        const signResult = await bridge.signDkim({
+            rawMessage: emailMessage,
+            domain: this.jobOptions.domain,
             selector: this.jobOptions.selector,
             privateKey,
-            canonicalization: 'relaxed/relaxed',
-            algorithm: 'rsa-sha256',
-            signTime: new Date(),
-            signatureData: [
-                {
-                    signingDomain: this.jobOptions.domain,
-                    selector: this.jobOptions.selector,
-                    privateKey,
-                    algorithm: 'rsa-sha256',
-                    canonicalization: 'relaxed/relaxed',
-                },
-            ],
         });
-        const signature = signResult.signatures;
+        return signResult.header;
-        return signature;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lbWFpbHNpZ25qb2IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9tYWlsL2RlbGl2ZXJ5L2NsYXNzZXMuZW1haWxzaWduam9iLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFjNUMsTUFBTSxPQUFPLFlBQVk7SUFDdkIsY0FBYyxDQUFxQjtJQUNuQyxVQUFVLENBQXVCO0lBRWpDLFlBQVksY0FBa0MsRUFBRSxPQUE2QjtRQUMzRSxJQUFJLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztRQUNyQyxJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQztJQUM1QixDQUFDO0lBRUQsS0FBSyxDQUFDLGNBQWM7UUFDbEIsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRixPQUFPLE9BQU8sQ0FBQyxVQUFVLENBQUM7SUFDNUIsQ0FBQztJQUVNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxZQUFvQjtRQUNsRCxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUMvQyxNQUFNLFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxRQUFRLENBQUMsWUFBWSxFQUFFO1lBQ3RELGFBQWEsRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU07WUFDckMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUTtZQUNsQyxVQUFVO1lBQ1YsZ0JBQWdCLEVBQUUsaUJBQWlCO1lBQ25DLFNBQVMsRUFBRSxZQUFZO1lBQ3ZCLFFBQVEsRUFBRSxJQUFJLElBQUksRUFBRTtZQUNwQixhQUFhLEVBQUU7Z0JBQ2I7b0JBQ0UsYUFBYSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTTtvQkFDckMsUUFBUSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUTtvQkFDbEMsVUFBVTtvQkFDVixTQUFTLEVBQUUsWUFBWTtvQkFDdkIsZ0JBQWdCLEVBQUUsaUJBQWlCO2lCQUNwQzthQUNGO1NBQ0YsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFVBQVUsQ0FBQztRQUN4QyxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0NBQ0YifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lbWFpbHNpZ25qb2IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9tYWlsL2RlbGl2ZXJ5L2NsYXNzZXMuZW1haWxzaWduam9iLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sOENBQThDLENBQUM7QUFhbEYsTUFBTSxPQUFPLFlBQVk7SUFDdkIsY0FBYyxDQUFxQjtJQUNuQyxVQUFVLENBQXVCO0lBRWpDLFlBQVksY0FBa0MsRUFBRSxPQUE2QjtRQUMzRSxJQUFJLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztRQUNyQyxJQUFJLENBQUMsVUFBVSxHQUFHLE9BQU8sQ0FBQztJQUM1QixDQUFDO0lBRUQsS0FBSyxDQUFDLGNBQWM7UUFDbEIsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRixPQUFPLE9BQU8sQ0FBQyxVQUFVLENBQUM7SUFDNUIsQ0FBQztJQUVNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxZQUFvQjtRQUNsRCxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUMvQyxNQUFNLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNoRCxNQUFNLFVBQVUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxRQUFRLENBQUM7WUFDdkMsVUFBVSxFQUFFLFlBQVk7WUFDeEIsTUFBTSxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTTtZQUM5QixRQUFRLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRO1lBQ2xDLFVBQVU7U0FDWCxDQUFDLENBQUM7UUFDSCxPQUFPLFVBQVUsQ0FBQyxNQUFNLENBQUM7SUFDM0IsQ0FBQztDQUNGIn0=

dist_ts/mail/routing/classes.unified.email.server.d.ts

@@ -134,6 +134,7 @@ export declare class UnifiedEmailServer extends EventEmitter {
     private servers;
     private stats;
     dkimCreator: DKIMCreator;
+    private rustBridge;
     private ipReputationChecker;
     private bounceManager;
     private ipWarmupManager;
@@ -163,6 +164,22 @@ export declare class UnifiedEmailServer extends EventEmitter {
      * Stop the unified email server
      */
     stop(): Promise<void>;
+    /**
+     * Handle an emailReceived event from the Rust SMTP server.
+     * Decodes the email data, processes it through the routing system,
+     * and sends back the result via the correlation-ID callback.
+     */
+    private handleRustEmailReceived;
+    /**
+     * Handle an authRequest event from the Rust SMTP server.
+     * Validates credentials and sends back the result.
+     */
+    private handleRustAuthRequest;
+    /**
+     * Verify inbound email security (DKIM/SPF/DMARC) using the Rust bridge.
+     * Falls back gracefully if the bridge is not running.
+     */
+    private verifyInboundSecurity;
     /**
      * Process email based on routing rules
      */

dist_ts/mail/security/classes.dkimverifier.d.ts

@@ -11,36 +11,19 @@ export interface IDkimVerificationResult {
     signatureFields?: Record<string, string>;
 }
 /**
- * Enhanced DKIM verifier using smartmail capabilities
+ * DKIM verifier — delegates to the Rust security bridge.
  */
 export declare class DKIMVerifier {
-    private verificationCache;
-    private cacheTtl;
     constructor();
     /**
-     * Verify DKIM signature for an email
+     * Verify DKIM signature for an email via Rust bridge
-     * @param emailData The raw email data
-     * @param options Verification options
-     * @returns Verification result
      */
     verify(emailData: string, options?: {
         useCache?: boolean;
         returnDetails?: boolean;
     }): Promise<IDkimVerificationResult>;
-    /**
+    /** No-op — Rust bridge handles its own caching */
-     * Fetch DKIM public key from DNS
-     * @param domain The domain
-     * @param selector The DKIM selector
-     * @returns The DKIM public key or null if not found
-     */
-    private fetchDkimKey;
-    /**
-     * Clear the verification cache
-     */
     clearCache(): void;
-    /**
+    /** Always 0 — cache is managed by the Rust side */
-     * Get the size of the verification cache
-     * @returns Number of cached items
-     */
     getCacheSize(): number;
 }

dist_ts/mail/security/classes.spfverifier.d.ts

@@ -50,54 +50,22 @@ export interface SpfResult {
     error?: string;
 }
 /**
- * Class for verifying SPF records
+ * Class for verifying SPF records.
+ * Delegates actual SPF evaluation to the Rust security bridge.
+ * Retains parseSpfRecord() for lightweight local parsing.
  */
 export declare class SpfVerifier {
-    private dnsManager?;
+    constructor(_dnsManager?: any);
-    private lookupCount;
-    constructor(dnsManager?: any);
     /**
-     * Parse SPF record from TXT record
+     * Parse SPF record from TXT record (pure string parsing, no DNS)
-     * @param record SPF TXT record
-     * @returns Parsed SPF record or null if invalid
      */
     parseSpfRecord(record: string): SpfRecord | null;
     /**
-     * Check if IP is in CIDR range
+     * Verify SPF for a given email — delegates to Rust bridge
-     * @param ip IP address to check
-     * @param cidr CIDR range
-     * @returns Whether the IP is in the CIDR range
-     */
-    private isIpInCidr;
-    /**
-     * Check if a domain has the specified IP in its A or AAAA records
-     * @param domain Domain to check
-     * @param ip IP address to check
-     * @returns Whether the domain resolves to the IP
-     */
-    private isDomainResolvingToIp;
-    /**
-     * Verify SPF for a given email with IP and helo domain
-     * @param email Email to verify
-     * @param ip Sender IP address
-     * @param heloDomain HELO/EHLO domain used by sender
-     * @returns SPF verification result
      */
     verify(email: Email, ip: string, heloDomain: string): Promise<SpfResult>;
     /**
-     * Check SPF record against IP address
+     * Check if email passes SPF verification and apply headers
-     * @param spfRecord Parsed SPF record
-     * @param domain Domain being checked
-     * @param ip IP address to check
-     * @returns SPF result
-     */
-    private checkSpfRecord;
-    /**
-     * Check if email passes SPF verification
-     * @param email Email to verify
-     * @param ip Sender IP address
-     * @param heloDomain HELO/EHLO domain used by sender
-     * @returns Whether email passes SPF
      */
     verifyAndApply(email: Email, ip: string, heloDomain: string): Promise<boolean>;
 }

dist_ts/plugins.d.ts

@@ -32,18 +32,16 @@ import * as smartproxy from '@push.rocks/smartproxy';
 import * as smartpromise from '@push.rocks/smartpromise';
 import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartrule from '@push.rocks/smartrule';
+import * as smartrust from '@push.rocks/smartrust';
 import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 export declare const smartfs: SmartFs;
-export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrx, smartunique };
+export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrust, smartrx, smartunique };
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
-import * as mailauth from 'mailauth';
-import { dkimSign } from 'mailauth/lib/dkim/sign.js';
 import mailparser from 'mailparser';
 import * as uuid from 'uuid';
-import * as ip from 'ip';
+export { mailparser, uuid, };
-export { mailauth, dkimSign, mailparser, uuid, ip, };

dist_ts/plugins.js

@@ -36,10 +36,11 @@ import * as smartproxy from '@push.rocks/smartproxy';
 import * as smartpromise from '@push.rocks/smartpromise';
 import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartrule from '@push.rocks/smartrule';
+import * as smartrust from '@push.rocks/smartrust';
 import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 export const smartfs = new SmartFs(new SmartFsProviderNode());
-export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrx, smartunique };
+export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrust, smartrx, smartunique };
 // apiclient.xyz scope
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare, };
@@ -47,10 +48,7 @@ export { cloudflare, };
 import * as tsclass from '@tsclass/tsclass';
 export { tsclass, };
 // third party
-import * as mailauth from 'mailauth';
-import { dkimSign } from 'mailauth/lib/dkim/sign.js';
 import mailparser from 'mailparser';
 import * as uuid from 'uuid';
-import * as ip from 'ip';
+export { mailparser, uuid, };
-export { mailauth, dkimSign, mailparser, uuid, ip, };
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFDTCxHQUFHLEVBQ0gsRUFBRSxFQUNGLE1BQU0sRUFDTixJQUFJLEVBQ0osR0FBRyxFQUNILEVBQUUsRUFDRixJQUFJLEVBQ0osR0FBRyxFQUNILElBQUksR0FDTCxDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUU5RCxPQUFPLEVBQ0wsbUJBQW1CLEVBQ3BCLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUNMLFlBQVksRUFDWixXQUFXLEVBQ1gsV0FBVyxHQUNaLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLGtCQUFrQixDQUFDO0FBQ3pDLE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxFQUFFLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ25FLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxPQUFPLE1BQU0scUJBQXFCLENBQUM7QUFDL0MsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUV2RCxNQUFNLENBQUMsTUFBTSxPQUFPLEdBQUcsSUFBSSxPQUFPLENBQUMsSUFBSSxtQkFBbUIsRUFBRSxDQUFDLENBQUM7QUFFOUQsT0FBTyxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsWUFBWSxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFLdlAsc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUNMLFVBQVUsR0FDWCxDQUFBO0FBRUQsZ0JBQWdCO0FBQ2hCLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxFQUNMLE9BQU8sR0FDUixDQUFBO0FBRUQsY0FBYztBQUNkLE9BQU8sVUFBVSxNQUFNLFlBQVksQ0FBQztBQUNwQyxPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUU3QixPQUFPLEVBQ0wsVUFBVSxFQUNWLElBQUksR0FDTCxDQUFBIn0=
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsY0FBYztBQUNkLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxNQUFNLE1BQU0sUUFBUSxDQUFDO0FBQ2pDLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBQzdCLE9BQU8sS0FBSyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBQzNCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFDTCxHQUFHLEVBQ0gsRUFBRSxFQUNGLE1BQU0sRUFDTixJQUFJLEVBQ0osR0FBRyxFQUNILEVBQUUsRUFDRixJQUFJLEVBQ0osR0FBRyxFQUNILElBQUksR0FDTCxDQUFBO0FBRUQsb0JBQW9CO0FBQ3BCLE9BQU8sS0FBSyxtQkFBbUIsTUFBTSx3QkFBd0IsQ0FBQztBQUU5RCxPQUFPLEVBQ0wsbUJBQW1CLEVBQ3BCLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsT0FBTyxFQUNMLFlBQVksRUFDWixXQUFXLEVBQ1gsV0FBVyxHQUNaLENBQUE7QUFFRCxvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssSUFBSSxNQUFNLGtCQUFrQixDQUFDO0FBQ3pDLE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxFQUFFLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ25FLE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLFFBQVEsTUFBTSxzQkFBc0IsQ0FBQztBQUNqRCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssWUFBWSxNQUFNLDBCQUEwQixDQUFDO0FBQ3pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssT0FBTyxNQUFNLHFCQUFxQixDQUFDO0FBQy9DLE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFFdkQsTUFBTSxDQUFDLE1BQU0sT0FBTyxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksbUJBQW1CLEVBQUUsQ0FBQyxDQUFDO0FBRTlELE9BQU8sRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLENBQUM7QUFLNU8sc0JBQXNCO0FBQ3RCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUNMLFVBQVUsR0FDWCxDQUFBO0FBRUQsZ0JBQWdCO0FBQ2hCLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxFQUNMLE9BQU8sR0FDUixDQUFBO0FBRUQsY0FBYztBQUNkLE9BQU8sS0FBSyxRQUFRLE1BQU0sVUFBVSxDQUFDO0FBQ3JDLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUNyRCxPQUFPLFVBQVUsTUFBTSxZQUFZLENBQUM7QUFDcEMsT0FBTyxLQUFLLElBQUksTUFBTSxNQUFNLENBQUM7QUFDN0IsT0FBTyxLQUFLLEVBQUUsTUFBTSxJQUFJLENBQUM7QUFFekIsT0FBTyxFQUNMLFFBQVEsRUFDUixRQUFRLEVBQ1IsVUFBVSxFQUNWLElBQUksRUFDSixFQUFFLEdBQ0gsQ0FBQSJ9

dist_ts/security/classes.contentscanner.d.ts

@@ -54,9 +54,6 @@ export declare class ContentScanner {
     private static instance;
     private scanCache;
     private options;
-    private static readonly MALICIOUS_PATTERNS;
-    private static readonly EXECUTABLE_EXTENSIONS;
-    private static readonly MACRO_DOCUMENT_EXTENSIONS;
     /**
      * Default options for the content scanner
      */
@@ -73,7 +70,9 @@ export declare class ContentScanner {
      */
     static getInstance(options?: IContentScannerOptions): ContentScanner;
     /**
-     * Scan an email for malicious content
+     * Scan an email for malicious content.
+     * Delegates text/subject/html/filename pattern scanning to Rust.
+     * Binary attachment scanning (PE headers, VBA macros) stays in TS.
      * @param email The email to scan
      * @returns Scan result
      */
@@ -85,41 +84,19 @@ export declare class ContentScanner {
      */
     private generateCacheKey;
     /**
-     * Scan email subject for threats
+     * Scan attachment binary content for PE headers and VBA macros.
-     * @param subject The subject to scan
+     * This stays in TS because it accesses raw Buffer data (too large for IPC).
-     * @param result The scan result to update
-     */
-    private scanSubject;
-    /**
-     * Scan plain text content for threats
-     * @param text The text content to scan
-     * @param result The scan result to update
-     */
-    private scanTextContent;
-    /**
-     * Scan HTML content for threats
-     * @param html The HTML content to scan
-     * @param result The scan result to update
-     */
-    private scanHtmlContent;
-    /**
-     * Scan an attachment for threats
      * @param attachment The attachment to scan
      * @param result The scan result to update
      */
-    private scanAttachment;
+    private scanAttachmentBinary;
     /**
-     * Extract links from HTML content
+     * Apply custom rules (runtime-configured patterns) to the email.
-     * @param html HTML content
+     * These stay in TS because they are configured at runtime.
-     * @returns Array of extracted links
+     * @param email The email to check
+     * @param result The scan result to update
      */
-    private extractLinksFromHtml;
+    private applyCustomRules;
-    /**
-     * Extract plain text from HTML
-     * @param html HTML content
-     * @returns Extracted text
-     */
-    private extractTextFromHtml;
     /**
      * Extract text from a binary buffer for scanning
      * @param buffer Binary content
@@ -128,17 +105,10 @@ export declare class ContentScanner {
     private extractTextFromBuffer;
     /**
      * Check if an Office document likely contains macros
-     * This is a simplified check - real implementation would use specialized libraries
      * @param attachment The attachment to check
      * @returns Whether the file likely contains macros
      */
     private likelyContainsMacros;
-    /**
-     * Map a pattern category to a threat type
-     * @param category The pattern category
-     * @returns The corresponding threat type
-     */
-    private mapCategoryToThreatType;
     /**
      * Log a high threat finding to the security logger
      * @param email The email containing the threat

dist_ts/security/classes.ipreputationchecker.d.ts

@@ -48,103 +48,26 @@ export interface IIPReputationOptions {
     enableIPInfo?: boolean;
 }
 /**
- * Class for checking IP reputation of inbound email senders
+ * IP reputation checker — delegates DNSBL lookups to the Rust security bridge.
+ * Retains LRU caching and disk persistence in TypeScript.
  */
 export declare class IPReputationChecker {
     private static instance;
     private reputationCache;
     private options;
     private storageManager?;
-    private static readonly DEFAULT_DNSBL_SERVERS;
     private static readonly DEFAULT_OPTIONS;
-    /**
-     * Constructor for IPReputationChecker
-     * @param options Configuration options
-     * @param storageManager Optional StorageManager instance for persistence
-     */
     constructor(options?: IIPReputationOptions, storageManager?: any);
-    /**
-     * Get the singleton instance of the checker
-     * @param options Configuration options
-     * @param storageManager Optional StorageManager instance for persistence
-     * @returns Singleton instance
-     */
     static getInstance(options?: IIPReputationOptions, storageManager?: any): IPReputationChecker;
     /**
-     * Check an IP address's reputation
+     * Check an IP address's reputation via the Rust bridge
-     * @param ip IP address to check
-     * @returns Reputation check result
      */
     checkReputation(ip: string): Promise<IReputationResult>;
-    /**
-     * Check an IP against DNS blacklists
-     * @param ip IP address to check
-     * @returns DNSBL check results
-     */
-    private checkDNSBL;
-    /**
-     * Get information about an IP address
-     * @param ip IP address to check
-     * @returns IP information
-     */
-    private getIPInfo;
-    /**
-     * Simplified method to determine country from IP
-     * In a real implementation, this would use a geolocation database or service
-     * @param ip IP address
-     * @returns Country code
-     */
-    private determineCountry;
-    /**
-     * Simplified method to determine organization from IP
-     * In a real implementation, this would use an IP-to-org database or service
-     * @param ip IP address
-     * @returns Organization name
-     */
-    private determineOrg;
-    /**
-     * Reverse an IP address for DNSBL lookups (e.g., 1.2.3.4 -> 4.3.2.1)
-     * @param ip IP address to reverse
-     * @returns Reversed IP for DNSBL queries
-     */
-    private reverseIP;
-    /**
-     * Create an error result for when reputation check fails
-     * @param ip IP address
-     * @param errorMessage Error message
-     * @returns Error result
-     */
     private createErrorResult;
-    /**
-     * Validate IP address format
-     * @param ip IP address to validate
-     * @returns Whether the IP is valid
-     */
     private isValidIPAddress;
-    /**
-     * Log reputation check to security logger
-     * @param ip IP address
-     * @param result Reputation result
-     */
     private logReputationCheck;
-    /**
-     * Save cache to disk or storage manager
-     */
     private saveCache;
-    /**
-     * Load cache from disk or storage manager
-     */
     private loadCache;
-    /**
-     * Get the risk level for a reputation score
-     * @param score Reputation score (0-100)
-     * @returns Risk level description
-     */
     static getRiskLevel(score: number): 'high' | 'medium' | 'low' | 'trusted';
-    /**
-     * Update the storage manager after instantiation
-     * This is useful when the storage manager is not available at construction time
-     * @param storageManager The StorageManager instance to use
-     */
     updateStorageManager(storageManager: any): void;
 }

dist_ts/security/classes.rustsecuritybridge.d.ts

@@ -0,0 +1,229 @@
+interface IDkimVerificationResult {
+    is_valid: boolean;
+    domain: string | null;
+    selector: string | null;
+    status: string;
+    details: string | null;
+}
+interface ISpfResult {
+    result: string;
+    domain: string;
+    ip: string;
+    explanation: string | null;
+}
+interface IDmarcResult {
+    passed: boolean;
+    policy: string;
+    domain: string;
+    dkim_result: string;
+    spf_result: string;
+    action: string;
+    details: string | null;
+}
+interface IEmailSecurityResult {
+    dkim: IDkimVerificationResult[];
+    spf: ISpfResult | null;
+    dmarc: IDmarcResult | null;
+}
+interface IValidationResult {
+    valid: boolean;
+    formatValid: boolean;
+    score: number;
+    error: string | null;
+}
+interface IBounceDetection {
+    bounce_type: string;
+    category: string;
+}
+interface IReputationResult {
+    ip: string;
+    score: number;
+    risk_level: string;
+    ip_type: string;
+    dnsbl_results: Array<{
+        server: string;
+        listed: boolean;
+        response: string | null;
+    }>;
+    listed_count: number;
+    total_checked: number;
+}
+interface IContentScanResult {
+    threatScore: number;
+    threatType: string | null;
+    threatDetails: string | null;
+    scannedElements: string[];
+}
+interface IVersionInfo {
+    bin: string;
+    core: string;
+    security: string;
+    smtp: string;
+}
+interface ISmtpServerConfig {
+    hostname: string;
+    ports: number[];
+    securePort?: number;
+    tlsCertPem?: string;
+    tlsKeyPem?: string;
+    maxMessageSize?: number;
+    maxConnections?: number;
+    maxRecipients?: number;
+    connectionTimeoutSecs?: number;
+    dataTimeoutSecs?: number;
+    authEnabled?: boolean;
+    maxAuthFailures?: number;
+    socketTimeoutSecs?: number;
+    processingTimeoutSecs?: number;
+    rateLimits?: IRateLimitConfig;
+}
+interface IRateLimitConfig {
+    maxConnectionsPerIp?: number;
+    maxMessagesPerSender?: number;
+    maxAuthFailuresPerIp?: number;
+    windowSecs?: number;
+}
+interface IEmailData {
+    type: 'inline' | 'file';
+    base64?: string;
+    path?: string;
+}
+interface IEmailReceivedEvent {
+    correlationId: string;
+    sessionId: string;
+    mailFrom: string;
+    rcptTo: string[];
+    data: IEmailData;
+    remoteAddr: string;
+    clientHostname: string | null;
+    secure: boolean;
+    authenticatedUser: string | null;
+    securityResults: any | null;
+}
+interface IAuthRequestEvent {
+    correlationId: string;
+    sessionId: string;
+    username: string;
+    password: string;
+    remoteAddr: string;
+}
+/**
+ * Bridge between TypeScript and the Rust `mailer-bin` binary.
+ *
+ * Uses `@push.rocks/smartrust` for JSON-over-stdin/stdout IPC.
+ * Singleton — access via `RustSecurityBridge.getInstance()`.
+ */
+export declare class RustSecurityBridge {
+    private static instance;
+    private bridge;
+    private _running;
+    private constructor();
+    /** Get or create the singleton instance. */
+    static getInstance(): RustSecurityBridge;
+    /** Whether the Rust process is currently running and accepting commands. */
+    get running(): boolean;
+    /**
+     * Spawn the Rust binary and wait for the ready signal.
+     * @returns `true` if the binary started successfully, `false` otherwise.
+     */
+    start(): Promise<boolean>;
+    /** Kill the Rust process. */
+    stop(): Promise<void>;
+    /** Ping the Rust process. */
+    ping(): Promise<boolean>;
+    /** Get version information for all Rust crates. */
+    getVersion(): Promise<IVersionInfo>;
+    /** Validate an email address. */
+    validateEmail(email: string): Promise<IValidationResult>;
+    /** Detect bounce type from SMTP response / diagnostic code. */
+    detectBounce(opts: {
+        smtpResponse?: string;
+        diagnosticCode?: string;
+        statusCode?: string;
+    }): Promise<IBounceDetection>;
+    /** Scan email content for threats (phishing, spam, malware, etc.). */
+    scanContent(opts: {
+        subject?: string;
+        textBody?: string;
+        htmlBody?: string;
+        attachmentNames?: string[];
+    }): Promise<IContentScanResult>;
+    /** Check IP reputation via DNSBL. */
+    checkIpReputation(ip: string): Promise<IReputationResult>;
+    /** Verify DKIM signatures on a raw email message. */
+    verifyDkim(rawMessage: string): Promise<IDkimVerificationResult[]>;
+    /** Sign an email with DKIM. */
+    signDkim(opts: {
+        rawMessage: string;
+        domain: string;
+        selector?: string;
+        privateKey: string;
+    }): Promise<{
+        header: string;
+        signedMessage: string;
+    }>;
+    /** Check SPF for a sender. */
+    checkSpf(opts: {
+        ip: string;
+        heloDomain: string;
+        hostname?: string;
+        mailFrom: string;
+    }): Promise<ISpfResult>;
+    /**
+     * Compound email security verification: DKIM + SPF + DMARC in one IPC call.
+     *
+     * This is the preferred method for inbound email verification — it avoids
+     * 3 sequential round-trips and correctly passes raw mail-auth types internally.
+     */
+    verifyEmail(opts: {
+        rawMessage: string;
+        ip: string;
+        heloDomain: string;
+        hostname?: string;
+        mailFrom: string;
+    }): Promise<IEmailSecurityResult>;
+    /**
+     * Start the Rust SMTP server.
+     * The server will listen on the configured ports and emit events for
+     * emailReceived and authRequest that must be handled by the caller.
+     */
+    startSmtpServer(config: ISmtpServerConfig): Promise<boolean>;
+    /** Stop the Rust SMTP server. */
+    stopSmtpServer(): Promise<void>;
+    /**
+     * Send the result of email processing back to the Rust SMTP server.
+     * This resolves a pending correlation-ID callback, allowing the Rust
+     * server to send the SMTP response to the client.
+     */
+    sendEmailProcessingResult(opts: {
+        correlationId: string;
+        accepted: boolean;
+        smtpCode?: number;
+        smtpMessage?: string;
+    }): Promise<void>;
+    /**
+     * Send the result of authentication validation back to the Rust SMTP server.
+     */
+    sendAuthResult(opts: {
+        correlationId: string;
+        success: boolean;
+        message?: string;
+    }): Promise<void>;
+    /** Update rate limit configuration at runtime. */
+    configureRateLimits(config: IRateLimitConfig): Promise<void>;
+    /**
+     * Register a handler for emailReceived events from the Rust SMTP server.
+     * These events fire when a complete email has been received and needs processing.
+     */
+    onEmailReceived(handler: (data: IEmailReceivedEvent) => void): void;
+    /**
+     * Register a handler for authRequest events from the Rust SMTP server.
+     * The handler must call sendAuthResult() with the correlationId.
+     */
+    onAuthRequest(handler: (data: IAuthRequestEvent) => void): void;
+    /** Remove an emailReceived event handler. */
+    offEmailReceived(handler: (data: IEmailReceivedEvent) => void): void;
+    /** Remove an authRequest event handler. */
+    offAuthRequest(handler: (data: IAuthRequestEvent) => void): void;
+}
+export type { IDkimVerificationResult, ISpfResult, IDmarcResult, IEmailSecurityResult, IValidationResult, IBounceDetection, IContentScanResult, IReputationResult as IRustReputationResult, IVersionInfo, ISmtpServerConfig, IRateLimitConfig, IEmailData, IEmailReceivedEvent, IAuthRequestEvent, };

dist_ts/security/index.d.ts

@@ -1,3 +1,4 @@
 export { SecurityLogger, SecurityLogLevel, SecurityEventType, type ISecurityEvent } from './classes.securitylogger.js';
 export { IPReputationChecker, ReputationThreshold, IPType, type IReputationResult, type IIPReputationOptions } from './classes.ipreputationchecker.js';
 export { ContentScanner, ThreatCategory, type IScanResult, type IContentScannerOptions } from './classes.contentscanner.js';
+export { RustSecurityBridge, type IDkimVerificationResult, type ISpfResult, type IDmarcResult, type IEmailSecurityResult, type IValidationResult, type IBounceDetection, type IRustReputationResult, type IVersionInfo, } from './classes.rustsecuritybridge.js';

dist_ts/security/index.js

@@ -1,4 +1,5 @@
 export { SecurityLogger, SecurityLogLevel, SecurityEventType } from './classes.securitylogger.js';
 export { IPReputationChecker, ReputationThreshold, IPType } from './classes.ipreputationchecker.js';
 export { ContentScanner, ThreatCategory } from './classes.contentscanner.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zZWN1cml0eS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixpQkFBaUIsRUFFbEIsTUFBTSw2QkFBNkIsQ0FBQztBQUVyQyxPQUFPLEVBQ0wsbUJBQW1CLEVBQ25CLG1CQUFtQixFQUNuQixNQUFNLEVBR1AsTUFBTSxrQ0FBa0MsQ0FBQztBQUUxQyxPQUFPLEVBQ0wsY0FBYyxFQUNkLGNBQWMsRUFHZixNQUFNLDZCQUE2QixDQUFDIn0=
+export { RustSecurityBridge, } from './classes.rustsecuritybridge.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9zZWN1cml0eS9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsY0FBYyxFQUNkLGdCQUFnQixFQUNoQixpQkFBaUIsRUFFbEIsTUFBTSw2QkFBNkIsQ0FBQztBQUVyQyxPQUFPLEVBQ0wsbUJBQW1CLEVBQ25CLG1CQUFtQixFQUNuQixNQUFNLEVBR1AsTUFBTSxrQ0FBa0MsQ0FBQztBQUUxQyxPQUFPLEVBQ0wsY0FBYyxFQUNkLGNBQWMsRUFHZixNQUFNLDZCQUE2QixDQUFDO0FBRXJDLE9BQU8sRUFDTCxrQkFBa0IsR0FTbkIsTUFBTSxpQ0FBaUMsQ0FBQyJ9

package.json

@@ -1,30 +1,30 @@
 {
-  "name": "@serve.zone/mailer",
+  "name": "@push.rocks/smartmta",
-  "version": "1.3.1",
+  "version": "2.2.0",
-  "description": "Enterprise mail server with SMTP, HTTP API, and DNS management - built for serve.zone infrastructure",
+  "description": "A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.",
   "keywords": [
-    "mailer",
+    "mta",
     "smtp",
     "email",
     "mail server",
-    "mailgun",
+    "mail transfer agent",
     "dkim",
     "spf",
+    "dmarc",
     "dns",
     "cloudflare",
-    "daemon service",
+    "typescript",
-    "api",
+    "rust"
-    "serve.zone"
   ],
-  "homepage": "https://code.foss.global/serve.zone/mailer",
+  "homepage": "https://code.foss.global/push.rocks/smartmta",
   "bugs": {
-    "url": "https://code.foss.global/serve.zone/mailer/issues"
+    "url": "https://code.foss.global/push.rocks/smartmta/issues"
   },
   "repository": {
     "type": "git",
-    "url": "git+https://code.foss.global/serve.zone/mailer.git"
+    "url": "git+https://code.foss.global/push.rocks/smartmta.git"
   },
-  "author": "Serve Zone",
+  "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "type": "module",
   "bin": {
@@ -66,6 +66,7 @@
     "@push.rocks/smartproxy": "^23.1.0",
     "@push.rocks/smartrequest": "^5.0.1",
     "@push.rocks/smartrule": "^2.0.1",
+    "@push.rocks/smartrust": "^1.1.1",
     "@push.rocks/smartrx": "^3.0.10",
     "@push.rocks/smartunique": "^3.0.9",
     "@serve.zone/interfaces": "^5.0.4",

pnpm-lock.yaml

@@ -74,6 +74,9 @@ importers:
       '@push.rocks/smartrule':
         specifier: ^2.0.1
         version: 2.0.1
+      '@push.rocks/smartrust':
+        specifier: ^1.1.1
+        version: 1.1.1
       '@push.rocks/smartrx':
         specifier: ^3.0.10
         version: 3.0.10

readme.md

@@ -1,361 +1,566 @@
-# @serve.zone/mailer
+# @push.rocks/smartmta
 
-> Enterprise mail server with SMTP, HTTP API, and DNS management
+A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration — no nodemailer, no shortcuts.
 
-[![License](https://img.shields.io/badge/license-MIT-blue.svg)](license)
+## Issue Reporting and Security
-[![Version](https://img.shields.io/badge/version-1.0.0-green.svg)](package.json)
+
+For reporting bugs, issues, or security vulnerabilities, please visit [community.foss.global/](https://community.foss.global/). This is the central community hub for all issue reporting. Developers who sign and comply with our contribution agreement and go through identification can also get a [code.foss.global/](https://code.foss.global/) account to submit Pull Requests directly.
+
+## Install
+
+```bash
+pnpm install @push.rocks/smartmta
+# or
+npm install @push.rocks/smartmta
+```
 
 ## Overview
 
-`@serve.zone/mailer` is a comprehensive mail server solution built with Deno, featuring:
+`@push.rocks/smartmta` is a **complete mail server solution** — SMTP server, SMTP client, email security, content scanning, and delivery management — all built with a custom SMTP implementation. No wrappers around nodemailer. No half-measures.
 
-- **SMTP Server & Client** - Full-featured SMTP implementation for sending and receiving emails
+### What's Inside
-- **HTTP REST API** - Mailgun-compatible API for programmatic email management
-- **DNS Management** - Automatic DNS setup via Cloudflare API
-- **DKIM/SPF/DMARC** - Complete email authentication and security
-- **Daemon Service** - Systemd integration for production deployments
-- **CLI Interface** - Command-line management of all features
 
-## Architecture
+| Module | What It Does |
+|---|---|
+| **SMTP Server** | RFC 5321-compliant server with TLS/STARTTLS, authentication, pipelining |
+| **SMTP Client** | Outbound delivery with connection pooling, retry logic, TLS negotiation |
+| **DKIM** | Key generation, signing, and verification — per domain |
+| **SPF** | Full SPF record validation |
+| **DMARC** | Policy enforcement and verification |
+| **Email Router** | Pattern-based routing with priority, forward/deliver/reject/process actions |
+| **Bounce Manager** | Automatic bounce detection, classification (hard/soft), and tracking |
+| **Content Scanner** | Spam, phishing, malware, XSS, and suspicious link detection |
+| **IP Reputation** | DNSBL checks, proxy/TOR/VPN detection, risk scoring |
+| **Rate Limiter** | Hierarchical rate limiting (global, per-domain, per-IP) |
+| **Delivery Queue** | Persistent queue with exponential backoff retry |
+| **Template Engine** | Email templates with variable substitution |
+| **Domain Registry** | Multi-domain management with per-domain configuration |
+| **DNS Manager** | Automatic DNS record management with Cloudflare API integration |
+| **Rust Accelerator** | Performance-critical operations (DKIM, MIME, validation) in Rust via IPC |
+| **Rust Security Bridge** | Compound email security verification (DKIM+SPF+DMARC) via Rust binary |
 
-### Technology Stack
+### Architecture
-
-- **Runtime**: Deno (compiles to standalone binaries)
-- **Language**: TypeScript
-- **Distribution**: npm (via binary wrappers)
-- **Service**: systemd daemon
-- **DNS**: Cloudflare API integration
-
-### Project Structure
 
 ```
-mailer/
+┌─────────────────────────────────────────────────────────┐
-├── bin/                    # npm binary wrappers
+│                   UnifiedEmailServer                     │
-├── scripts/                # Build scripts
+│   (orchestrates all components, emits events)            │
-├── ts/                     # TypeScript source
+├──────────┬──────────┬────────────┬──────────────────────┤
-│   ├── mail/              # Email implementation (ported from dcrouter)
+│  SMTP    │  Email   │  Security  │    Delivery          │
-│   │   ├── core/          # Email classes, validation, templates
+│  Server  │  Router  │  Stack     │    System            │
-│   │   ├── delivery/      # SMTP client/server, queues
+│  ┌─────┐ │  ┌─────┐ │ ┌───────┐  │  ┌────────────────┐ │
-│   │   ├── routing/       # Email routing, domain config
+│  │ TLS │ │  │Match│ │ │ DKIM  │  │  │ Queue          │ │
-│   │   └── security/      # DKIM, SPF, DMARC
+│  │ Auth│ │  │Route│ │ │ SPF   │  │  │ Rate Limit     │ │
-│   ├── api/               # HTTP REST API (Mailgun-compatible)
+│  │ Cmd │ │  │ Act │ │ │ DMARC │  │  │ SMTP Client    │ │
-│   ├── dns/               # DNS management + Cloudflare
+│  │ Data│ │  │     │ │ │ IPRep │  │  │ Retry Logic    │ │
-│   ├── daemon/            # Systemd service management
+│  └─────┘ │  └─────┘ │ │ Scan  │  │  └────────────────┘ │
-│   ├── config/            # Configuration system
+│          │          │ └───────┘  │                      │
-│   └── cli/               # Command-line interface
+├──────────┴──────────┴────────────┴──────────────────────┤
-├── test/                  # Test suite
+│              Rust Security Bridge                        │
-├── deno.json              # Deno configuration
+│  (RustSecurityBridge singleton via smartrust IPC)        │
-├── package.json           # npm metadata
+├─────────────────────────────────────────────────────────┤
-└── mod.ts                 # Main entry point
+│              Rust Acceleration Layer                      │
-```
+│  (mailer-core, mailer-security, mailer-bin)              │
-
+└─────────────────────────────────────────────────────────┘
-## Installation
-
-### Via npm (recommended)
-
-```bash
-npm install -g @serve.zone/mailer
-```
-
-### From source
-
-```bash
-git clone https://code.foss.global/serve.zone/mailer
-cd mailer
-deno task compile
 ```
 
 ## Usage
 
-### CLI Commands
+### Setting Up the Email Server
 
-#### Service Management
+The central entry point is `UnifiedEmailServer`, which orchestrates SMTP, routing, security, and delivery:
-
-```bash
-# Start the mailer daemon
-sudo mailer service start
-
-# Stop the daemon
-sudo mailer service stop
-
-# Restart the daemon
-sudo mailer service restart
-
-# Check status
-mailer service status
-
-# Enable systemd service
-sudo mailer service enable
-
-# Disable systemd service
-sudo mailer service disable
-```
-
-#### Domain Management
-
-```bash
-# Add a domain
-mailer domain add example.com
-
-# Remove a domain
-mailer domain remove example.com
-
-# List all domains
-mailer domain list
-```
-
-#### DNS Management
-
-```bash
-# Auto-configure DNS via Cloudflare
-mailer dns setup example.com
-
-# Validate DNS configuration
-mailer dns validate example.com
-
-# Show required DNS records
-mailer dns show example.com
-```
-
-#### Sending Email
-
-```bash
-# Send email via CLI
-mailer send \\
-  --from sender@example.com \\
-  --to recipient@example.com \\
-  --subject "Hello" \\
-  --text "World"
-```
-
-#### Configuration
-
-```bash
-# Show current configuration
-mailer config show
-
-# Set configuration value
-mailer config set smtpPort 25
-mailer config set apiPort 8080
-mailer config set hostname mail.example.com
-```
-
-### HTTP API
-
-The mailer provides a Mailgun-compatible REST API:
-
-#### Send Email
-
-```bash
-POST /v1/messages
-Content-Type: application/json
-
-{
-  "from": "sender@example.com",
-  "to": "recipient@example.com",
-  "subject": "Hello",
-  "text": "World",
-  "html": "<p>World</p>"
-}
-```
-
-#### List Domains
-
-```bash
-GET /v1/domains
-```
-
-#### Manage SMTP Credentials
-
-```bash
-GET /v1/domains/:domain/credentials
-POST /v1/domains/:domain/credentials
-DELETE /v1/domains/:domain/credentials/:id
-```
-
-#### Email Events
-
-```bash
-GET /v1/events
-```
-
-### Programmatic Usage
 
 ```typescript
-import { Email, SmtpClient } from '@serve.zone/mailer';
+import { UnifiedEmailServer } from '@push.rocks/smartmta';
 
-// Create an email
+const emailServer = new UnifiedEmailServer(dcRouterRef, {
-const email = new Email({
+  ports: [25, 587, 465],
-  from: 'sender@example.com',
+  hostname: 'mail.example.com',
-  to: 'recipient@example.com',
+  domains: [
-  subject: 'Hello from Mailer',
+    {
-  text: 'This is a test email',
+      domain: 'example.com',
-  html: '<p>This is a test email</p>',
+      dnsMode: 'external-dns',
+      dkim: {
+        selector: 'default',
+        keySize: 2048,
+        rotateKeys: true,
+        rotationInterval: 90,
+      },
+      rateLimits: {
+        maxMessagesPerMinute: 100,
+        maxRecipientsPerMessage: 50,
+      },
+    },
+  ],
+  routes: [
+    {
+      name: 'catch-all-forward',
+      priority: 10,
+      match: {
+        recipients: '*@example.com',
+      },
+      action: {
+        type: 'forward',
+        forward: {
+          host: 'internal-mail.example.com',
+          port: 25,
+        },
+      },
+    },
+    {
+      name: 'reject-spam-senders',
+      priority: 100,
+      match: {
+        senders: '*@spamdomain.com',
+      },
+      action: {
+        type: 'reject',
+        reject: {
+          code: 550,
+          message: 'Sender rejected by policy',
+        },
+      },
+    },
+  ],
+  auth: {
+    required: false,
+    methods: ['PLAIN', 'LOGIN'],
+    users: [{ username: 'outbound', password: 'secret' }],
+  },
+  tls: {
+    certPath: '/etc/ssl/mail.crt',
+    keyPath: '/etc/ssl/mail.key',
+  },
+  maxMessageSize: 25 * 1024 * 1024, // 25 MB
+  maxClients: 500,
 });
 
-// Send via SMTP
+await emailServer.start();
-const client = new SmtpClient({
+```
+
+### Sending Emails with the SMTP Client
+
+Create and send emails using the built-in SMTP client with connection pooling:
+
+```typescript
+import { Email, createSmtpClient } from '@push.rocks/smartmta';
+
+// Create a client with connection pooling
+const client = createSmtpClient({
   host: 'smtp.example.com',
   port: 587,
-  secure: true,
+  secure: false,     // will upgrade via STARTTLS
+  pool: true,
+  maxConnections: 5,
   auth: {
-    user: 'username',
+    user: 'sender@example.com',
-    pass: 'password',
+    pass: 'your-password',
   },
 });
 
-await client.sendMail(email);
+// Build an email
+const email = new Email({
+  from: 'sender@example.com',
+  to: ['recipient@example.com'],
+  cc: ['cc@example.com'],
+  subject: 'Hello from smartmta!',
+  text: 'Plain text body',
+  html: '<h1>Hello!</h1><p>HTML body with <strong>formatting</strong></p>',
+  priority: 'high',
+  attachments: [
+    {
+      filename: 'report.pdf',
+      content: pdfBuffer,
+      contentType: 'application/pdf',
+    },
+  ],
+});
+
+// Send it
+const result = await client.sendMail(email);
+console.log(`Message sent: ${result.messageId}`);
 ```
 
-## Configuration
+### DKIM Signing
 
-Configuration is stored in `~/.mailer/config.json`:
+DKIM key management is handled by `DKIMCreator`, which generates, stores, and rotates keys per domain. Signing is performed automatically by `UnifiedEmailServer` during outbound delivery — there is no standalone `signEmail()` call:
 
-```json
+```typescript
-{
+import { DKIMCreator } from '@push.rocks/smartmta';
-  "domains": [
+
-    {
+const dkimCreator = new DKIMCreator('/path/to/keys');
-      "domain": "example.com",
+
-      "dnsMode": "external-dns",
+// Auto-generate keys if they don't exist
-      "cloudflare": {
+await dkimCreator.handleDKIMKeysForDomain('example.com');
-        "apiToken": "your-cloudflare-token"
+
-      }
+// Get the DNS record you need to publish
-    }
+const dnsRecord = await dkimCreator.getDNSRecordForDomain('example.com');
-  ],
+console.log(dnsRecord);
-  "apiKeys": ["api-key-1", "api-key-2"],
+// -> { type: 'TXT', name: 'default._domainkey.example.com', value: 'v=DKIM1; k=rsa; p=...' }
-  "smtpPort": 25,
+
-  "apiPort": 8080,
+// Check if keys need rotation
-  "hostname": "mail.example.com"
+const needsRotation = await dkimCreator.needsRotation('example.com', 'default', 90);
+if (needsRotation) {
+  const newSelector = await dkimCreator.rotateDkimKeys('example.com', 'default', 2048);
+  console.log(`Rotated to selector: ${newSelector}`);
 }
 ```
 
-## DNS Setup
+When `UnifiedEmailServer.start()` is called, DKIM signing is applied to all outbound mail automatically using the keys managed by `DKIMCreator`. The `RustSecurityBridge` can also perform DKIM signing via its `signDkim()` method for high-performance scenarios.
 
-The mailer requires the following DNS records for each domain:
+### Email Authentication (SPF, DKIM, DMARC)
 
-### MX Record
+Verify incoming emails against all three authentication standards. Note that the first argument to `SpfVerifier.verify()` and `DmarcVerifier.verify()` is an `Email` object:
-```
+
-Type: MX
+```typescript
-Name: @
+import { DKIMVerifier, SpfVerifier, DmarcVerifier } from '@push.rocks/smartmta';
-Value: mail.example.com
+
-Priority: 10
+// SPF verification — first arg is an Email object
-TTL: 3600
+const spfVerifier = new SpfVerifier();
+const spfResult = await spfVerifier.verify(email, senderIP, heloDomain);
+// -> { result: 'pass' | 'fail' | 'softfail' | 'neutral' | 'none' | 'temperror' | 'permerror',
+//      domain: string, ip: string }
+
+// DKIM verification
+const dkimVerifier = new DKIMVerifier();
+const dkimResult = await dkimVerifier.verify(rawEmailContent);
+
+// DMARC verification — first arg is an Email object
+const dmarcVerifier = new DmarcVerifier();
+const dmarcResult = await dmarcVerifier.verify(email, spfResult, dkimResult);
+// -> { action: 'pass' | 'quarantine' | 'reject', hasDmarc: boolean,
+//      spfDomainAligned: boolean, dkimDomainAligned: boolean, ... }
 ```
 
-### A Record
+### Email Routing
-```
+
-Type: A
+Pattern-based routing engine with priority ordering and flexible match criteria. Routes are evaluated by priority (highest first) using `evaluateRoutes()`:
-Name: mail
+
-Value: <your-server-ip>
+```typescript
-TTL: 3600
+import { EmailRouter } from '@push.rocks/smartmta';
+
+const router = new EmailRouter([
+  {
+    name: 'admin-mail',
+    priority: 100,
+    match: {
+      recipients: 'admin@example.com',
+      authenticated: true,
+    },
+    action: {
+      type: 'deliver',
+    },
+  },
+  {
+    name: 'external-forward',
+    priority: 50,
+    match: {
+      recipients: '*@example.com',
+      sizeRange: { max: 10 * 1024 * 1024 },  // under 10MB
+    },
+    action: {
+      type: 'forward',
+      forward: {
+        host: 'backend-mail.internal',
+        port: 25,
+        preserveHeaders: true,
+      },
+    },
+  },
+  {
+    name: 'process-with-scanning',
+    priority: 10,
+    match: {
+      recipients: '*@*',
+    },
+    action: {
+      type: 'process',
+      process: {
+        scan: true,
+        dkim: true,
+        queue: 'normal',
+      },
+    },
+  },
+]);
+
+// Evaluate routes against an email context
+const matchedRoute = await router.evaluateRoutes(emailContext);
 ```
 
-### SPF Record
+### Content Scanning
-```
+
-Type: TXT
+Built-in content scanner for detecting spam, phishing, malware, and other threats. Use the `scanEmail()` method:
-Name: @
+
-Value: v=spf1 mx ip4:<your-server-ip> ~all
+```typescript
-TTL: 3600
+import { ContentScanner } from '@push.rocks/smartmta';
+
+const scanner = new ContentScanner({
+  scanSubject: true,
+  scanBody: true,
+  scanAttachments: true,
+  blockExecutables: true,
+  blockMacros: true,
+  minThreatScore: 30,
+  highThreatScore: 70,
+  customRules: [
+    {
+      pattern: /bitcoin.*wallet/i,
+      type: 'scam',
+      score: 80,
+      description: 'Cryptocurrency scam pattern',
+    },
+  ],
+});
+
+const result = await scanner.scanEmail(email);
+// -> { isClean: false, threatScore: 85, threatType: 'phishing', scannedElements: [...] }
 ```
 
-### DKIM Record
+### IP Reputation Checking
-```
+
-Type: TXT
+Check sender IP addresses against DNSBL blacklists and classify IP types:
-Name: default._domainkey
+
-Value: <dkim-public-key>
+```typescript
-TTL: 3600
+import { IPReputationChecker } from '@push.rocks/smartmta';
+
+const ipChecker = new IPReputationChecker({
+  enableDNSBL: true,
+  dnsblServers: ['zen.spamhaus.org', 'bl.spamcop.net'],
+  cacheTTL: 24 * 60 * 60 * 1000,  // 24 hours
+});
+
+const reputation = await ipChecker.checkReputation('192.168.1.1');
+// -> { score: 85, isSpam: false, isProxy: false, isTor: false, blacklists: [] }
 ```
 
-### DMARC Record
+When the `RustSecurityBridge` is running, `IPReputationChecker` automatically delegates DNSBL lookups to the Rust binary for improved performance.
-```
+
-Type: TXT
+### Rate Limiting
-Name: _dmarc
+
-Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com
+Hierarchical rate limiting to protect your server and maintain deliverability. Configuration uses `maxMessagesPerMinute` and organizes domain-level limits under the `domains` key:
-TTL: 3600
+
+```typescript
+import { UnifiedRateLimiter } from '@push.rocks/smartmta';
+
+const rateLimiter = new UnifiedRateLimiter({
+  global: {
+    maxMessagesPerMinute: 1000,
+    maxRecipientsPerMessage: 500,
+    maxConnectionsPerIP: 20,
+    maxErrorsPerIP: 10,
+    maxAuthFailuresPerIP: 5,
+    blockDuration: 600000, // 10 minutes
+  },
+  domains: {
+    'example.com': {
+      maxMessagesPerMinute: 100,
+      maxRecipientsPerMessage: 50,
+    },
+  },
+});
+
+// Check before sending
+const allowed = rateLimiter.checkMessageLimit(
+  'sender@example.com',
+  '192.168.1.1',
+  recipientCount,
+  undefined,
+  'example.com'
+);
+
+if (!allowed.allowed) {
+  console.log(`Rate limited: ${allowed.reason}`);
+}
 ```
 
-Use `mailer dns setup <domain>` to automatically configure these via Cloudflare.
+### Bounce Management
 
-## Development
+Automatic bounce detection, classification, and suppression tracking. Use `isEmailSuppressed()` to check if an address should be suppressed:
 
-### Prerequisites
+```typescript
+import { BounceManager } from '@push.rocks/smartmta';
 
-- Deno 1.40+
+const bounceManager = new BounceManager();
-- Node.js 14+ (for npm distribution)
 
-### Build
+// Process an SMTP failure
+const bounce = await bounceManager.processSmtpFailure(
+  'recipient@example.com',
+  '550 5.1.1 User unknown',
+  { originalEmailId: 'msg-123' }
+);
+// -> { bounceType: 'invalid_recipient', bounceCategory: 'hard', ... }
 
-```bash
+// Check if an address is suppressed due to bounces
-# Compile for all platforms
+const suppressed = bounceManager.isEmailSuppressed('recipient@example.com');
-deno task compile
 
-# Run in development mode
+// Manually manage the suppression list
-deno task dev
+bounceManager.addToSuppressionList('bad@example.com', 'repeated hard bounces');
-
+bounceManager.removeFromSuppressionList('recovered@example.com');
-# Run tests
-deno task test
-
-# Format code
-deno task fmt
-
-# Lint code
-deno task lint
 ```
 
-### Ported Components
+### Email Templates
 
-The mail implementation is ported from [dcrouter](https://code.foss.global/serve.zone/dcrouter) and adapted for Deno:
+Template engine with variable substitution for transactional and notification emails. Use `createEmail()` to produce a ready-to-send `Email` from a registered template:
 
-- ✅ Email core (Email, EmailValidator, BounceManager, TemplateManager)
+```typescript
-- ✅ SMTP Server (with TLS support)
+import { TemplateManager } from '@push.rocks/smartmta';
-- ✅ SMTP Client (with connection pooling)
-- ✅ Email routing and domain management
-- ✅ DKIM signing and verification
-- ✅ SPF and DMARC validation
-- ✅ Delivery queues and rate limiting
 
-## Roadmap
+const templates = new TemplateManager({
+  from: 'noreply@example.com',
+  footerHtml: '<p>2026 Example Corp</p>',
+});
 
-### Phase 1 - Core Functionality (Current)
+// Register a template
-- [x] Project structure and build system
+templates.registerTemplate({
-- [x] Port mail implementation from dcrouter
+  id: 'welcome',
-- [x] CLI interface
+  name: 'Welcome Email',
-- [x] Configuration management
+  description: 'Sent to new users',
-- [x] DNS management basics
+  from: 'welcome@example.com',
-- [ ] Cloudflare DNS integration
+  subject: 'Welcome, {{name}}!',
-- [ ] HTTP REST API implementation
+  bodyHtml: '<h1>Welcome, {{name}}!</h1><p>Your account is ready.</p>',
-- [ ] Systemd service integration
+  bodyText: 'Welcome, {{name}}! Your account is ready.',
+  category: 'transactional',
+});
 
-### Phase 2 - Production Ready
+// Create an Email object from the template
-- [ ] Comprehensive testing
+const email = await templates.createEmail('welcome', {
-- [ ] Documentation
+  to: 'newuser@example.com',
-- [ ] Performance optimization
+  variables: { name: 'Alice' },
-- [ ] Security hardening
+});
-- [ ] Monitoring and logging
+```
 
-### Phase 3 - Advanced Features
+### DNS Management
-- [ ] Webhook support
-- [ ] Email templates
-- [ ] Analytics and reporting
-- [ ] Multi-tenancy
-- [ ] Load balancing
 
-## License
+DNS record management for email authentication is handled internally by `UnifiedEmailServer`. The `DnsManager` is not instantiated directly — it receives its configuration from the `dcRouter` reference and automatically ensures MX, SPF, DKIM, and DMARC records are in place for all configured domains:
 
-MIT © Serve Zone
+```typescript
+// DNS management is automatic when using UnifiedEmailServer.
+// When the server starts, it calls ensureDnsRecords() internally
+// for all configured domains, setting up:
+//   - MX records pointing to your mail server
+//   - SPF TXT records authorizing your server IP
+//   - DKIM TXT records with public keys from DKIMCreator
+//   - DMARC TXT records with your policy
 
-## Contributing
+const emailServer = new UnifiedEmailServer(dcRouterRef, {
+  hostname: 'mail.example.com',
+  domains: [
+    {
+      domain: 'example.com',
+      dnsMode: 'external-dns',  // managed via Cloudflare API
+    },
+  ],
+  // ... other config
+});
 
-Contributions are welcome! Please see our [contributing guidelines](https://code.foss.global/serve.zone/mailer/contributing).
+// DNS records are set up automatically on start
+await emailServer.start();
+```
 
-## Support
+For DNS lookups and record verification outside of the server lifecycle, the `DNSManager` class (note the capital N) can be used directly:
 
-- Documentation: https://code.foss.global/serve.zone/mailer
+```typescript
-- Issues: https://code.foss.global/serve.zone/mailer/issues
+import { DNSManager, DKIMCreator } from '@push.rocks/smartmta';
-- Email: support@serve.zone
 
-## Acknowledgments
+const dkimCreator = new DKIMCreator('/path/to/keys');
+const dnsManager = new DNSManager(dkimCreator);
 
-- Mail implementation ported from [dcrouter](https://code.foss.global/serve.zone/dcrouter)
+// Verify all email authentication records for a domain
-- Inspired by [Mailgun](https://www.mailgun.com/) API design
+const results = await dnsManager.verifyEmailAuthRecords('example.com', 'default');
-- Built with [Deno](https://deno.land/)
+console.log(results.spf);   // { valid: boolean, record: string, ... }
+console.log(results.dkim);  // { valid: boolean, record: string, ... }
+console.log(results.dmarc); // { valid: boolean, record: string, ... }
+
+// Generate recommended DNS records
+const records = await dnsManager.generateAllRecommendedRecords('example.com');
+```
+
+## Rust Acceleration
+
+Performance-critical operations are implemented in Rust and communicate with the TypeScript runtime via `@push.rocks/smartrust` (JSON-over-stdin/stdout IPC).
+
+### Rust Crates
+
+The Rust workspace is at `rust/` with five crates:
+
+| Crate | Status | Purpose |
+|---|---|---|
+| `mailer-core` | Complete (26 tests) | Email types, validation, MIME building, bounce detection |
+| `mailer-security` | Complete (12 tests) | DKIM signing/verification, SPF checks, DMARC policy, IP reputation/DNSBL |
+| `mailer-bin` | Complete | CLI + smartrust IPC bridge (handles `verifyEmail` compound method) |
+| `mailer-smtp` | Planned (Phase 3) | SMTP protocol in Rust |
+| `mailer-napi` | Planned (Phase 3) | Native Node.js addon |
+
+### RustSecurityBridge
+
+The `RustSecurityBridge` is a singleton that manages the Rust binary process and provides high-performance security verification. It is automatically started and stopped with `UnifiedEmailServer`:
+
+```typescript
+import { RustSecurityBridge } from '@push.rocks/smartmta';
+
+const bridge = RustSecurityBridge.getInstance();
+await bridge.start();
+
+// Compound verification: DKIM + SPF + DMARC in a single IPC call
+const securityResult = await bridge.verifyEmail({
+  rawMessage: rawEmailString,
+  ip: '203.0.113.10',
+  heloDomain: 'sender.example.com',
+  mailFrom: 'user@example.com',
+});
+// -> { dkim: [...], spf: { result, explanation }, dmarc: { result, policy } }
+
+// Individual operations
+const dkimResults = await bridge.verifyDkim(rawEmailString);
+const spfResult = await bridge.checkSpf({
+  ip: '203.0.113.10',
+  heloDomain: 'sender.example.com',
+  mailFrom: 'user@example.com',
+});
+const reputationResult = await bridge.checkIpReputation('203.0.113.10');
+
+await bridge.stop();
+```
+
+When the bridge is running, the TypeScript security components (`SpfVerifier`, `DKIMVerifier`, `IPReputationChecker`) automatically delegate to the Rust binary. If the binary is unavailable, the system falls back gracefully to TypeScript-only verification.
+
+## Project Structure
+
+```
+smartmta/
+├── ts/                            # TypeScript source
+│   ├── mail/
+│   │   ├── core/                  # Email, EmailValidator, BounceManager, TemplateManager
+│   │   ├── delivery/              # DeliverySystem, Queue, RateLimiter
+│   │   │   ├── smtpclient/        # SMTP client with connection pooling
+│   │   │   └── smtpserver/        # SMTP server with TLS, auth, pipelining
+│   │   ├── routing/               # UnifiedEmailServer, EmailRouter, DomainRegistry, DnsManager
+│   │   └── security/              # DKIMCreator, DKIMVerifier, SpfVerifier, DmarcVerifier
+│   └── security/                  # ContentScanner, IPReputationChecker, RustSecurityBridge
+├── rust/                          # Rust workspace
+│   └── crates/                    # mailer-core, mailer-security, mailer-bin, mailer-smtp, mailer-napi
+├── test/                          # Comprehensive test suite
+└── dist_ts/                       # Compiled output
+```
+
+## License and Legal Information
+
+This repository contains open-source code licensed under the MIT License. A copy of the license can be found in the [LICENSE](./LICENSE) file.
+
+**Please note:** The MIT License does not grant permission to use the trade names, trademarks, service marks, or product names of the project, except as required for reasonable and customary use in describing the origin of the work and reproducing the content of the NOTICE file.
+
+### Trademarks
+
+This project is owned and maintained by Task Venture Capital GmbH. The names and logos associated with Task Venture Capital GmbH and any related products or services are trademarks of Task Venture Capital GmbH or third parties, and are not included within the scope of the MIT license granted herein.
+
+Use of these trademarks must comply with Task Venture Capital GmbH's Trademark Guidelines or the guidelines of the respective third-party owners, and any usage must be approved in writing. Third-party trademarks used herein are the property of their respective owners and used only in a descriptive manner, e.g. for an implementation of an API or similar.
+
+### Company Information
+
+Task Venture Capital GmbH
+Registered at District Court Bremen HRB 35230 HB, Germany
+
+For any legal inquiries or further information, please contact us via email at hello@task.vc.
+
+By using this repository, you acknowledge that you have read this section, agree to comply with its terms, and understand that the licensing of the code does not imply endorsement by Task Venture Capital GmbH of any derivative works.

readme.plan.md

@@ -1,198 +1,24 @@
-# Mailer Implementation Plan & Progress
+# Rust Migration Plan
 
-## Project Goals
+## Completed Phases
 
-Build a Deno-based mail server package (`@serve.zone/mailer`) with:
+### Phase 3: Rust Primary Backend (DKIM/SPF/DMARC/IP Reputation)
-1. CLI interface similar to nupst/spark
+- Rust is the mandatory security backend — no TS fallbacks
-2. SMTP server and client (ported from dcrouter)
+- All DKIM signing/verification, SPF, DMARC, IP reputation through Rust bridge
-3. HTTP REST API (Mailgun-compatible)
-4. Automatic DNS management via Cloudflare
-5. Systemd daemon service
-6. Binary distribution via npm
 
-## Completed Work
+### Phase 5: BounceManager + ContentScanner
+- BounceManager bounce detection delegated to Rust `detectBounce` IPC command
+- ContentScanner pattern matching delegated to new Rust `scanContent` IPC command
+- New module: `rust/crates/mailer-security/src/content_scanner.rs` (10 Rust tests)
+- ~215 lines removed from BounceManager, ~350 lines removed from ContentScanner
+- Binary attachment scanning (PE headers, VBA macros) stays in TS
+- Custom rules (runtime-configured) stay in TS
+- Net change: ~-560 TS lines, +265 Rust lines
 
-### ✅ Phase 1: Project Structure
+## Deferred
-- [x] Created Deno-based project structure (deno.json, package.json)
-- [x] Set up bin/ wrappers for npm binary distribution
-- [x] Created compilation scripts (compile-all.sh)
-- [x] Set up install scripts (install-binary.js)
-- [x] Created TypeScript source directory structure
 
-### ✅ Phase 2: Mail Implementation (Ported from dcrouter)
+| Component | Rationale |
-- [x] Copied and adapted mail/core/ (Email, EmailValidator, BounceManager, TemplateManager)
+|-----------|-----------|
-- [x] Copied and adapted mail/delivery/ (SMTP client, SMTP server, queues, rate limiting)
+| EmailValidator | Already thin; uses smartmail; minimal gain |
-- [x] Copied and adapted mail/routing/ (EmailRouter, DomainRegistry, DnsManager)
+| DNS record generation | Pure string building; zero benefit from Rust |
-- [x] Copied and adapted mail/security/ (DKIM, SPF, DMARC)
+| MIME building (`toRFC822String`) | Sync in TS, async via IPC; too much blast radius |
-- [x] Fixed all imports from .js to .ts extensions
-- [x] Created stub modules for dcrouter dependencies (storage, security, deliverability, errors)
-
-### ✅ Phase 3: Supporting Modules
-- [x] Created logger module (simple console logging)
-- [x] Created paths module (project paths)
-- [x] Created plugins.ts (Deno dependencies + Node.js compatibility)
-- [x] Added required npm dependencies (lru-cache, mailaddress-validator, cloudflare)
-
-### ✅ Phase 4: DNS Management
-- [x] Created DnsManager class with DNS record generation
-- [x] Created CloudflareClient for automatic DNS setup
-- [x] Added DNS validation functionality
-
-### ✅ Phase 5: HTTP API
-- [x] Created ApiServer class with basic routing
-- [x] Implemented Mailgun-compatible endpoint structure
-- [x] Added authentication and rate limiting stubs
-
-### ✅ Phase 6: Configuration Management
-- [x] Created ConfigManager for JSON-based config storage
-- [x] Added domain configuration support
-- [x] Implemented config load/save functionality
-
-### ✅ Phase 7: Daemon Service
-- [x] Created DaemonManager to coordinate SMTP server and API server
-- [x] Added start/stop functionality
-- [x] Integrated with ConfigManager
-
-### ✅ Phase 8: CLI Interface
-- [x] Created MailerCli class with command routing
-- [x] Implemented service commands (start/stop/restart/status/enable/disable)
-- [x] Implemented domain commands (add/remove/list)
-- [x] Implemented DNS commands (setup/validate/show)
-- [x] Implemented send command
-- [x] Implemented config commands (show/set)
-- [x] Added help and version commands
-
-### ✅ Phase 9: Documentation
-- [x] Created comprehensive README.md
-- [x] Documented all CLI commands
-- [x] Documented HTTP API endpoints
-- [x] Provided configuration examples
-- [x] Documented DNS requirements
-- [x] Created changelog
-
-## Next Steps (Remaining Work)
-
-### Testing & Debugging
-1. Fix remaining import/dependency issues
-2. Test compilation with `deno compile`
-3. Test CLI commands end-to-end
-4. Test SMTP sending/receiving
-5. Test HTTP API endpoints
-6. Write unit tests
-
-### Systemd Integration
-1. Create systemd service file
-2. Implement service enable/disable
-3. Add service status checking
-4. Test daemon auto-restart
-
-### Cloudflare Integration
-1. Test actual Cloudflare API calls
-2. Handle Cloudflare errors gracefully
-3. Add zone detection
-4. Verify DNS record creation
-
-### Production Readiness
-1. Add proper error handling throughout
-2. Implement logging to files
-3. Add rate limiting implementation
-4. Implement API key authentication
-5. Add TLS certificate management
-6. Implement email queue persistence
-
-### Advanced Features
-1. Webhook support for incoming emails
-2. Email template system
-3. Analytics and reporting
-4. SMTP credential management
-5. Email event tracking
-6. Bounce handling
-
-## Known Issues
-
-1. Some npm dependencies may need version adjustments
-2. Deno crypto APIs may need adaptation for DKIM signing
-3. Buffer vs Uint8Array conversions may be needed
-4. Some dcrouter-specific code may need further adaptation
-
-## File Structure Overview
-
-```
-mailer/
-├── README.md                      ✅ Complete
-├── license                        ✅ Complete
-├── changelog.md                   ✅ Complete
-├── deno.json                      ✅ Complete
-├── package.json                   ✅ Complete
-├── mod.ts                         ✅ Complete
-│
-├── bin/
-│   └── mailer-wrapper.js          ✅ Complete
-│
-├── scripts/
-│   ├── compile-all.sh             ✅ Complete
-│   └── install-binary.js          ✅ Complete
-│
-└── ts/
-    ├── 00_commitinfo_data.ts      ✅ Complete
-    ├── index.ts                   ✅ Complete
-    ├── cli.ts                     ✅ Complete
-    ├── plugins.ts                 ✅ Complete
-    ├── logger.ts                  ✅ Complete
-    ├── paths.ts                   ✅ Complete
-    ├── classes.mailer.ts          ✅ Complete
-    │
-    ├── cli/
-    │   ├── index.ts               ✅ Complete
-    │   └── mailer-cli.ts          ✅ Complete
-    │
-    ├── api/
-    │   ├── index.ts               ✅ Complete
-    │   ├── api-server.ts          ✅ Complete
-    │   └── routes/                ✅ Structure ready
-    │
-    ├── dns/
-    │   ├── index.ts               ✅ Complete
-    │   ├── dns-manager.ts         ✅ Complete
-    │   └── cloudflare-client.ts   ✅ Complete
-    │
-    ├── daemon/
-    │   ├── index.ts               ✅ Complete
-    │   └── daemon-manager.ts      ✅ Complete
-    │
-    ├── config/
-    │   ├── index.ts               ✅ Complete
-    │   └── config-manager.ts      ✅ Complete
-    │
-    ├── storage/
-    │   └── index.ts               ✅ Stub complete
-    │
-    ├── security/
-    │   └── index.ts               ✅ Stub complete
-    │
-    ├── deliverability/
-    │   └── index.ts               ✅ Stub complete
-    │
-    ├── errors/
-    │   └── index.ts               ✅ Stub complete
-    │
-    └── mail/                      ✅ Ported from dcrouter
-        ├── core/                  ✅ Complete
-        ├── delivery/              ✅ Complete
-        ├── routing/               ✅ Complete
-        └── security/              ✅ Complete
-```
-
-## Summary
-
-The mailer package structure is **95% complete**. All major components have been implemented:
-- Project structure and build system ✅
-- Mail implementation ported from dcrouter ✅
-- CLI interface ✅
-- DNS management ✅
-- HTTP API ✅
-- Configuration system ✅
-- Daemon management ✅
-- Documentation ✅
-
-**Remaining work**: Testing, debugging dependency issues, systemd integration, and production hardening.

rust/Cargo.lock

@@ -41,6 +41,56 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "anstream"
+version = "0.6.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
+dependencies = [
+ "anstyle",
+ "once_cell_polyfill",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "arbitrary"
 version = "1.4.2"
@@ -83,12 +133,6 @@ dependencies = [
  "fs_extra",
 ]
 
-[[package]]
-name = "base64"
-version = "0.21.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
-
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -116,12 +160,6 @@ version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
 
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
 [[package]]
 name = "bytes"
 version = "1.11.1"
@@ -130,21 +168,11 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "bzip2"
-version = "0.5.2"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49ecfb22d906f800d4fe833b6282cf4dc1c298f5057ca0b5445e5c209735ca47"
+checksum = "f3a53fac24f34a81bc9954b5d6cfce0c21e18ec6959f44f56e8e90e4bb7c346c"
 dependencies = [
- "bzip2-sys",
+ "libbz2-rs-sys",
-]
-
-[[package]]
-name = "bzip2-sys"
-version = "0.1.13+1.0.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "225bff33b2141874fe80d71e07d6eec4f85c5c216453dd96388240f96e1acc14"
-dependencies = [
- "cc",
- "pkg-config",
 ]
 
 [[package]]
@@ -171,7 +199,7 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1f927b07c74ba84c7e5fe4db2baeb3e996ab2688992e39ac68ce3220a677c7e"
 dependencies = [
- "base64 0.22.1",
+ "base64",
  "encoding_rs",
 ]
 
@@ -185,6 +213,46 @@ dependencies = [
  "inout",
 ]
 
+[[package]]
+name = "clap"
+version = "4.5.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6899ea499e3fb9305a65d5ebf6e3d2248c5fab291f300ad0a704fbe142eae31a"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.57"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b12c8b680195a62a8364d16b8447b01b6c2c8f9aaf68bee653be34d4245e238"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex",
+ "strsim",
+]
+
+[[package]]
+name = "clap_derive"
+version = "4.5.55"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"
+dependencies = [
+ "heck",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.7.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"
+
 [[package]]
 name = "cmake"
 version = "0.1.57"
@@ -194,6 +262,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.1"
@@ -417,6 +491,7 @@ checksum = "843fba2746e448b37e26a819579957415c8cef339bf08564fe8b7ddbd959573c"
 dependencies = [
  "crc32fast",
  "miniz_oxide",
+ "zlib-rs",
 ]
 
 [[package]]
@@ -486,12 +561,12 @@ dependencies = [
 
 [[package]]
 name = "gethostname"
-version = "0.4.3"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0176e0459c2e4a1fe232f984bca6890e681076abb9934f6cea7c326f3fc47818"
+checksum = "1bd49230192a3797a9a4d6abe9b3eed6f7fa4c8a8a4947977c6f80025f92cbd8"
 dependencies = [
- "libc",
+ "rustix",
- "windows-targets 0.48.5",
+ "windows-link",
 ]
 
 [[package]]
@@ -512,11 +587,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
- "js-sys",
  "libc",
  "r-efi",
  "wasip2",
- "wasm-bindgen",
 ]
 
 [[package]]
@@ -531,40 +604,23 @@ version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
 
+[[package]]
+name = "hashify"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "149e3ea90eb5a26ad354cfe3cb7f7401b9329032d0235f2687d03a35f30e5d4c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "heck"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hickory-proto"
-version = "0.24.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248"
-dependencies = [
- "async-trait",
- "cfg-if",
- "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
- "idna",
- "ipnet",
- "once_cell",
- "rand 0.8.5",
- "ring",
- "rustls 0.21.12",
- "rustls-pemfile 1.0.4",
- "thiserror 1.0.69",
- "tinyvec",
- "tokio",
- "tokio-rustls 0.24.1",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "hickory-proto"
 version = "0.25.2"
@@ -581,9 +637,9 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.2",
+ "rand",
  "ring",
- "thiserror 2.0.18",
+ "thiserror",
  "tinyvec",
  "tokio",
  "tracing",
@@ -591,26 +647,34 @@ dependencies = [
 ]
 
 [[package]]
-name = "hickory-resolver"
+name = "hickory-proto"
-version = "0.24.4"
+version = "0.26.0-alpha.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cbb117a1ca520e111743ab2f6688eddee69db4e0ea242545a604dce8a66fd22e"
+checksum = "a62d7684f766b0f96344be88c023f9b6650039aea09d526b4974cce302eb61b1"
 dependencies = [
+ "async-trait",
+ "bitflags",
+ "bytes",
  "cfg-if",
+ "data-encoding",
+ "enum-as-inner",
+ "futures-channel",
+ "futures-io",
  "futures-util",
- "hickory-proto 0.24.4",
+ "idna",
- "ipconfig",
+ "ipnet",
- "lru-cache",
  "once_cell",
- "parking_lot",
+ "rand",
- "rand 0.8.5",
+ "ring",
- "resolv-conf",
+ "rustls",
- "rustls 0.21.12",
+ "rustls-pki-types",
- "smallvec",
+ "thiserror",
- "thiserror 1.0.69",
+ "time",
+ "tinyvec",
  "tokio",
- "tokio-rustls 0.24.1",
+ "tokio-rustls",
  "tracing",
+ "url",
 ]
 
 [[package]]
@@ -626,14 +690,37 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.2",
+ "rand",
  "resolv-conf",
  "smallvec",
- "thiserror 2.0.18",
+ "thiserror",
  "tokio",
  "tracing",
 ]
 
+[[package]]
+name = "hickory-resolver"
+version = "0.26.0-alpha.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbab5e26a7f82341145ba1fbd1f1858d0490624fcc46270db2d3c4a101f763f4"
+dependencies = [
+ "cfg-if",
+ "futures-util",
+ "hickory-proto 0.26.0-alpha.1",
+ "ipconfig",
+ "moka",
+ "once_cell",
+ "parking_lot",
+ "rand",
+ "resolv-conf",
+ "rustls",
+ "smallvec",
+ "thiserror",
+ "tokio",
+ "tokio-rustls",
+ "tracing",
+]
+
 [[package]]
 name = "hmac"
 version = "0.12.1"
@@ -782,6 +869,12 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
+
 [[package]]
 name = "itoa"
 version = "1.0.17"
@@ -808,6 +901,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "libbz2-rs-sys"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c4a545a15244c7d945065b5d392b2d2d7f21526fba56ce51467b06ed445e8f7"
+
 [[package]]
 name = "libc"
 version = "0.2.181"
@@ -825,10 +924,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "linked-hash-map"
+name = "linux-raw-sys"
-version = "0.5.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
 
 [[package]]
 name = "litemap"
@@ -852,51 +951,31 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
 
 [[package]]
-name = "lru-cache"
+name = "lzma-rust2"
-version = "0.1.2"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "31e24f1ad8321ca0e8a1e0ac13f23cb668e6f5466c2c57319f6a5cf1cc8e3b1c"
+checksum = "c60a23ffb90d527e23192f1246b14746e2f7f071cb84476dd879071696c18a4a"
 dependencies = [
- "linked-hash-map",
-]
-
-[[package]]
-name = "lzma-rs"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "297e814c836ae64db86b36cf2a557ba54368d03f6afcd7d947c266692f71115e"
-dependencies = [
- "byteorder",
  "crc",
-]
+ "sha2",
-
-[[package]]
-name = "lzma-sys"
-version = "0.1.20"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fda04ab3764e6cde78b9974eec4f779acaba7c4e84b36eca3cf77c581b85d27"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
 ]
 
 [[package]]
 name = "mail-auth"
-version = "0.4.3"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bd9d657de66a3d5ac360c3eab8c9f5cac2565f2b97cc032d5de4c900ef470de"
+checksum = "5b7da45f78cc525d3750b623c967ae21c0cd28b2e6a9a2ee4b536a7cce3b21ce"
 dependencies = [
  "ahash",
  "flate2",
- "hickory-resolver 0.24.4",
+ "hashify",
- "lru-cache",
+ "hickory-resolver 0.26.0-alpha.1",
  "mail-builder",
  "mail-parser",
- "parking_lot",
  "quick-xml",
+ "quick_cache",
  "ring",
- "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
  "serde",
  "serde_json",
  "zip",
@@ -904,26 +983,30 @@ dependencies = [
 
 [[package]]
 name = "mail-builder"
-version = "0.3.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25f5871d5270ed80f2ee750b95600c8d69b05f8653ad3be913b2ad2e924fefcb"
+checksum = "900998f307338c4013a28ab14d760b784067324b164448c6d98a89e44810473b"
 dependencies = [
  "gethostname",
 ]
 
 [[package]]
 name = "mail-parser"
-version = "0.9.4"
+version = "0.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93c3b9e5d8b17faf573330bbc43b37d6e918c0a3bf8a88e7d0a220ebc84af9fc"
+checksum = "dcf4390741c4e6fa330bdeccdfb580815dbb462952de91838b723357985119a3"
 dependencies = [
  "encoding_rs",
+ "hashify",
 ]
 
 [[package]]
 name = "mailer-bin"
 version = "0.1.0"
 dependencies = [
+ "clap",
+ "dashmap",
+ "hickory-resolver 0.25.2",
  "mailer-core",
  "mailer-security",
  "mailer-smtp",
@@ -937,12 +1020,15 @@ dependencies = [
 name = "mailer-core"
 version = "0.1.0"
 dependencies = [
+ "base64",
  "bytes",
  "mailparse",
+ "regex",
  "serde",
  "serde_json",
- "thiserror 2.0.18",
+ "thiserror",
  "tracing",
+ "uuid",
 ]
 
 [[package]]
@@ -964,11 +1050,18 @@ dependencies = [
 name = "mailer-security"
 version = "0.1.0"
 dependencies = [
+ "hickory-resolver 0.25.2",
+ "ipnet",
  "mail-auth",
  "mailer-core",
+ "psl",
+ "regex",
  "ring",
+ "rustls-pki-types",
  "serde",
- "thiserror 2.0.18",
+ "serde_json",
+ "thiserror",
+ "tokio",
  "tracing",
 ]
 
@@ -976,22 +1069,30 @@ dependencies = [
 name = "mailer-smtp"
 version = "0.1.0"
 dependencies = [
+ "base64",
  "bytes",
  "dashmap",
  "hickory-resolver 0.25.2",
  "mailer-core",
+ "mailer-security",
+ "regex",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "serde",
- "thiserror 2.0.18",
+ "serde_json",
+ "thiserror",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tracing",
+ "uuid",
 ]
 
 [[package]]
 name = "mailparse"
-version = "0.15.0"
+version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3da03d5980411a724e8aaf7b61a7b5e386ec55a7fb49ee3d0ff79efc7e5e7c7e"
+checksum = "60819a97ddcb831a5614eb3b0174f3620e793e97e09195a395bfa948fd68ed2f"
 dependencies = [
  "charset",
  "data-encoding",
@@ -1118,6 +1219,12 @@ dependencies = [
  "portable-atomic",
 ]
 
+[[package]]
+name = "once_cell_polyfill"
+version = "1.70.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
+
 [[package]]
 name = "parking_lot"
 version = "0.12.5"
@@ -1196,6 +1303,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
+[[package]]
+name = "ppmd-rust"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "efca4c95a19a79d1c98f791f10aebd5c1363b473244630bb7dbde1dc98455a24"
+
 [[package]]
 name = "ppv-lite86"
 version = "0.2.21"
@@ -1215,14 +1328,41 @@ dependencies = [
 ]
 
 [[package]]
-name = "quick-xml"
+name = "psl"
-version = "0.32.0"
+version = "2.1.188"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d3a6e5838b60e0e8fa7a43f22ade549a37d61f8bdbe636d0d7816191de969c2"
+checksum = "b033d75bca9da25cfdcd9528de22ed7870d1695b9e1c3ce55b7127a4a2b16fac"
+dependencies = [
+ "psl-types",
+]
+
+[[package]]
+name = "psl-types"
+version = "2.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33cb294fe86a74cbcf50d4445b37da762029549ebeea341421c7c70370f86cac"
+
+[[package]]
+name = "quick-xml"
+version = "0.38.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b66c2058c55a409d601666cffe35f04333cf1013010882cec174a7467cd4e21c"
 dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "quick_cache"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ada44a88ef953a3294f6eb55d2007ba44646015e18613d2f213016379203ef3"
+dependencies = [
+ "ahash",
+ "equivalent",
+ "hashbrown 0.16.1",
+ "parking_lot",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.44"
@@ -1244,35 +1384,14 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
-[[package]]
-name = "rand"
-version = "0.8.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
-dependencies = [
- "libc",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "rand"
 version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
- "rand_chacha 0.9.0",
+ "rand_chacha",
- "rand_core 0.9.5",
+ "rand_core",
-]
-
-[[package]]
-name = "rand_chacha"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -1282,16 +1401,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.5",
+ "rand_core",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
-dependencies = [
- "getrandom 0.2.17",
 ]
 
 [[package]]
@@ -1362,15 +1472,16 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustls"
+name = "rustix"
-version = "0.21.12"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
 dependencies = [
- "log",
+ "bitflags",
- "ring",
+ "errno",
- "rustls-webpki 0.101.7",
+ "libc",
- "sct",
+ "linux-raw-sys",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1382,21 +1493,13 @@ dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
+ "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.9",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
@@ -1415,16 +1518,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "rustls-webpki"
 version = "0.103.9"
@@ -1449,16 +1542,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "semver"
 version = "1.0.27"
@@ -1519,6 +1602,17 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.10.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
 [[package]]
 name = "shlex"
 version = "1.3.0"
@@ -1579,6 +1673,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
@@ -1613,33 +1713,13 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b2093cf4c8eb1e67749a6762251bc9cd836b6fc171623bd0a9d324d37af2417"
 
-[[package]]
-name = "thiserror"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
-dependencies = [
- "thiserror-impl 1.0.69",
-]
-
 [[package]]
 name = "thiserror"
 version = "2.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
 dependencies = [
- "thiserror-impl 2.0.18",
+ "thiserror-impl",
-]
-
-[[package]]
-name = "thiserror-impl"
-version = "1.0.69"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
 ]
 
 [[package]]
@@ -1725,23 +1805,13 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.36",
+ "rustls",
  "tokio",
 ]
 
@@ -1818,6 +1888,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
 [[package]]
 name = "uuid"
 version = "1.20.0"
@@ -2151,15 +2227,6 @@ version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
 
-[[package]]
-name = "xz2"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "388c44dc09d76f1536602ead6d325eb532f5c122f17782bd57fb47baeeb767e2"
-dependencies = [
- "lzma-sys",
-]
-
 [[package]]
 name = "yoke"
 version = "0.8.1"
@@ -2279,34 +2346,37 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "2.4.2"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabe6324e908f85a1c52063ce7aa26b68dcb7eb6dbc83a2d148403c9bc3eba50"
+checksum = "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b"
 dependencies = [
  "aes",
  "arbitrary",
  "bzip2",
  "constant_time_eq",
  "crc32fast",
- "crossbeam-utils",
  "deflate64",
- "displaydoc",
  "flate2",
  "getrandom 0.3.4",
  "hmac",
  "indexmap",
- "lzma-rs",
+ "lzma-rust2",
  "memchr",
  "pbkdf2",
+ "ppmd-rust",
  "sha1",
- "thiserror 2.0.18",
  "time",
- "xz2",
  "zeroize",
  "zopfli",
  "zstd",
 ]
 
+[[package]]
+name = "zlib-rs"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7948af682ccbc3342b6e9420e8c51c1fe5d7bf7756002b4a3c6cabfe96a7e3c"
+
 [[package]]
 name = "zmij"
 version = "1.0.20"

rust/crates/mailer-bin/Cargo.toml

@@ -17,3 +17,5 @@ tracing.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 clap.workspace = true
+hickory-resolver.workspace = true
+dashmap.workspace = true

rust/crates/mailer-core/src/bounce.rs

@@ -0,0 +1,485 @@
+use regex::Regex;
+use serde::{Deserialize, Serialize};
+use std::sync::LazyLock;
+
+/// Type of email bounce.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BounceType {
+    // Hard bounces
+    InvalidRecipient,
+    DomainNotFound,
+    MailboxFull,
+    MailboxInactive,
+    Blocked,
+    SpamRelated,
+    PolicyRelated,
+    // Soft bounces
+    ServerUnavailable,
+    TemporaryFailure,
+    QuotaExceeded,
+    NetworkError,
+    Timeout,
+    // Special
+    AutoResponse,
+    ChallengeResponse,
+    Unknown,
+}
+
+/// Broad category of a bounce.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum BounceCategory {
+    Hard,
+    Soft,
+    AutoResponse,
+    Unknown,
+}
+
+impl BounceType {
+    /// Get the category for this bounce type.
+    pub fn category(&self) -> BounceCategory {
+        match self {
+            BounceType::InvalidRecipient
+            | BounceType::DomainNotFound
+            | BounceType::MailboxFull
+            | BounceType::MailboxInactive
+            | BounceType::Blocked
+            | BounceType::SpamRelated
+            | BounceType::PolicyRelated => BounceCategory::Hard,
+
+            BounceType::ServerUnavailable
+            | BounceType::TemporaryFailure
+            | BounceType::QuotaExceeded
+            | BounceType::NetworkError
+            | BounceType::Timeout => BounceCategory::Soft,
+
+            BounceType::AutoResponse | BounceType::ChallengeResponse => {
+                BounceCategory::AutoResponse
+            }
+
+            BounceType::Unknown => BounceCategory::Unknown,
+        }
+    }
+}
+
+/// Result of bounce detection.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BounceDetection {
+    pub bounce_type: BounceType,
+    pub category: BounceCategory,
+}
+
+/// Pattern set for a bounce type: compiled regexes for matching against SMTP responses.
+struct BouncePatterns {
+    bounce_type: BounceType,
+    patterns: Vec<Regex>,
+}
+
+/// All bounce detection patterns, compiled once.
+static BOUNCE_PATTERNS: LazyLock<Vec<BouncePatterns>> = LazyLock::new(|| {
+    vec![
+        BouncePatterns {
+            bounce_type: BounceType::InvalidRecipient,
+            patterns: compile_patterns(&[
+                r"(?i)no such user",
+                r"(?i)user unknown",
+                r"(?i)does not exist",
+                r"(?i)invalid recipient",
+                r"(?i)unknown recipient",
+                r"(?i)no mailbox",
+                r"(?i)user not found",
+                r"(?i)recipient address rejected",
+                r"(?i)550 5\.1\.1",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::DomainNotFound,
+            patterns: compile_patterns(&[
+                r"(?i)domain not found",
+                r"(?i)unknown domain",
+                r"(?i)no such domain",
+                r"(?i)host not found",
+                r"(?i)domain invalid",
+                r"(?i)550 5\.1\.2",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::MailboxFull,
+            patterns: compile_patterns(&[
+                r"(?i)mailbox full",
+                r"(?i)over quota",
+                r"(?i)quota exceeded",
+                r"(?i)552 5\.2\.2",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::MailboxInactive,
+            patterns: compile_patterns(&[
+                r"(?i)mailbox disabled",
+                r"(?i)mailbox inactive",
+                r"(?i)account disabled",
+                r"(?i)mailbox not active",
+                r"(?i)account suspended",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::Blocked,
+            patterns: compile_patterns(&[
+                r"(?i)blocked",
+                r"(?i)rejected",
+                r"(?i)denied",
+                r"(?i)blacklisted",
+                r"(?i)prohibited",
+                r"(?i)refused",
+                r"(?i)550 5\.7\.",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::SpamRelated,
+            patterns: compile_patterns(&[
+                r"(?i)spam",
+                r"(?i)bulk mail",
+                r"(?i)content rejected",
+                r"(?i)message rejected",
+                r"(?i)550 5\.7\.1",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::ServerUnavailable,
+            patterns: compile_patterns(&[
+                r"(?i)server unavailable",
+                r"(?i)service unavailable",
+                r"(?i)try again later",
+                r"(?i)try later",
+                r"(?i)451 4\.3\.",
+                r"(?i)421 4\.3\.",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::TemporaryFailure,
+            patterns: compile_patterns(&[
+                r"(?i)temporary failure",
+                r"(?i)temporary error",
+                r"(?i)temporary problem",
+                r"(?i)try again",
+                r"(?i)451 4\.",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::QuotaExceeded,
+            patterns: compile_patterns(&[
+                r"(?i)quota temporarily exceeded",
+                r"(?i)mailbox temporarily full",
+                r"(?i)452 4\.2\.2",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::NetworkError,
+            patterns: compile_patterns(&[
+                r"(?i)network error",
+                r"(?i)connection error",
+                r"(?i)connection timed out",
+                r"(?i)routing error",
+                r"(?i)421 4\.4\.",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::Timeout,
+            patterns: compile_patterns(&[
+                r"(?i)timed out",
+                r"(?i)timeout",
+                r"(?i)450 4\.4\.2",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::AutoResponse,
+            patterns: compile_patterns(&[
+                r"(?i)auto[- ]reply",
+                r"(?i)auto[- ]response",
+                r"(?i)vacation",
+                r"(?i)out of office",
+                r"(?i)away from office",
+                r"(?i)on vacation",
+                r"(?i)automatic reply",
+            ]),
+        },
+        BouncePatterns {
+            bounce_type: BounceType::ChallengeResponse,
+            patterns: compile_patterns(&[
+                r"(?i)challenge[- ]response",
+                r"(?i)verify your email",
+                r"(?i)confirm your email",
+                r"(?i)email verification",
+            ]),
+        },
+    ]
+});
+
+/// Regex for detecting bounce email subjects.
+static BOUNCE_SUBJECT_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)mail delivery|delivery (?:failed|status|notification)|failure notice|returned mail|undeliverable|delivery problem")
+        .expect("invalid bounce subject regex")
+});
+
+/// Regex for extracting recipient from bounce messages.
+static BOUNCE_RECIPIENT_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)(?:failed recipient|to[:=]\s*|recipient:|delivery failed:)\s*<?([a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,})>?")
+        .expect("invalid bounce recipient regex")
+});
+
+/// Regex for extracting diagnostic code.
+static DIAGNOSTIC_CODE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)diagnostic(?:-|\s+)code:\s*(.+)")
+        .expect("invalid diagnostic code regex")
+});
+
+/// Regex for extracting status code.
+static STATUS_CODE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)status(?:-|\s+)code:\s*([0-9.]+)")
+        .expect("invalid status code regex")
+});
+
+/// Regex for DSN original-recipient.
+static DSN_ORIGINAL_RECIPIENT_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)original-recipient:.*?([a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,})")
+        .expect("invalid DSN original-recipient regex")
+});
+
+/// Regex for DSN final-recipient.
+static DSN_FINAL_RECIPIENT_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"(?i)final-recipient:.*?([a-zA-Z0-9._%+\-]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,})")
+        .expect("invalid DSN final-recipient regex")
+});
+
+fn compile_patterns(patterns: &[&str]) -> Vec<Regex> {
+    patterns
+        .iter()
+        .map(|p| Regex::new(p).expect("invalid bounce pattern regex"))
+        .collect()
+}
+
+/// Detect bounce type from an SMTP response, diagnostic code, or status code.
+pub fn detect_bounce_type(
+    smtp_response: Option<&str>,
+    diagnostic_code: Option<&str>,
+    status_code: Option<&str>,
+) -> BounceDetection {
+    // Check all text sources against patterns
+    let texts: Vec<&str> = [smtp_response, diagnostic_code, status_code]
+        .into_iter()
+        .flatten()
+        .collect();
+
+    for bp in BOUNCE_PATTERNS.iter() {
+        for text in &texts {
+            for pattern in &bp.patterns {
+                if pattern.is_match(text) {
+                    return BounceDetection {
+                        bounce_type: bp.bounce_type,
+                        category: bp.bounce_type.category(),
+                    };
+                }
+            }
+        }
+    }
+
+    // Fallback: parse DSN status code (class.subject.detail)
+    if let Some(code) = status_code {
+        if let Some(detection) = parse_dsn_status(code) {
+            return detection;
+        }
+    }
+
+    // Try to find DSN code in SMTP response
+    if let Some(resp) = smtp_response {
+        if let Some(code) = STATUS_CODE_RE.captures(resp).and_then(|c| c.get(1)) {
+            if let Some(detection) = parse_dsn_status(code.as_str()) {
+                return detection;
+            }
+        }
+    }
+
+    BounceDetection {
+        bounce_type: BounceType::Unknown,
+        category: BounceCategory::Unknown,
+    }
+}
+
+/// Parse a DSN enhanced status code like "5.1.1" or "4.2.2".
+fn parse_dsn_status(code: &str) -> Option<BounceDetection> {
+    let parts: Vec<&str> = code.split('.').collect();
+    if parts.len() < 2 {
+        return None;
+    }
+
+    let class: u8 = parts[0].parse().ok()?;
+    let subject: u8 = parts[1].parse().ok()?;
+
+    let bounce_type = match (class, subject) {
+        (5, 1) => BounceType::InvalidRecipient,
+        (5, 2) => BounceType::MailboxFull,
+        (5, 7) => BounceType::Blocked,
+        (5, _) => BounceType::PolicyRelated,
+        (4, 2) => BounceType::QuotaExceeded,
+        (4, 3) => BounceType::ServerUnavailable,
+        (4, 4) => BounceType::NetworkError,
+        (4, _) => BounceType::TemporaryFailure,
+        _ => return None,
+    };
+
+    Some(BounceDetection {
+        category: bounce_type.category(),
+        bounce_type,
+    })
+}
+
+/// Check if a subject line looks like a bounce notification.
+pub fn is_bounce_subject(subject: &str) -> bool {
+    BOUNCE_SUBJECT_RE.is_match(subject)
+}
+
+/// Extract the bounced recipient email from a bounce message body.
+pub fn extract_bounce_recipient(body: &str) -> Option<String> {
+    BOUNCE_RECIPIENT_RE
+        .captures(body)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().to_string())
+        .or_else(|| {
+            DSN_FINAL_RECIPIENT_RE
+                .captures(body)
+                .and_then(|c| c.get(1))
+                .map(|m| m.as_str().to_string())
+        })
+        .or_else(|| {
+            DSN_ORIGINAL_RECIPIENT_RE
+                .captures(body)
+                .and_then(|c| c.get(1))
+                .map(|m| m.as_str().to_string())
+        })
+}
+
+/// Extract the diagnostic code from a bounce message body.
+pub fn extract_diagnostic_code(body: &str) -> Option<String> {
+    DIAGNOSTIC_CODE_RE
+        .captures(body)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().trim().to_string())
+}
+
+/// Extract the status code from a bounce message body.
+pub fn extract_status_code(body: &str) -> Option<String> {
+    STATUS_CODE_RE
+        .captures(body)
+        .and_then(|c| c.get(1))
+        .map(|m| m.as_str().trim().to_string())
+}
+
+/// Calculate retry delay using exponential backoff.
+///
+/// * `retry_count` - Number of retries so far (0-based)
+/// * `initial_delay_ms` - Initial delay in milliseconds (default 15 min = 900_000)
+/// * `max_delay_ms` - Maximum delay in milliseconds (default 24h = 86_400_000)
+/// * `backoff_factor` - Multiplier per retry (default 2.0)
+pub fn retry_delay_ms(
+    retry_count: u32,
+    initial_delay_ms: u64,
+    max_delay_ms: u64,
+    backoff_factor: f64,
+) -> u64 {
+    let delay = (initial_delay_ms as f64) * backoff_factor.powi(retry_count as i32);
+    (delay as u64).min(max_delay_ms)
+}
+
+/// Default retry delay with standard parameters.
+pub fn default_retry_delay_ms(retry_count: u32) -> u64 {
+    retry_delay_ms(
+        retry_count,
+        15 * 60 * 1000,       // 15 minutes
+        24 * 60 * 60 * 1000,  // 24 hours
+        2.0,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_detect_invalid_recipient() {
+        let result = detect_bounce_type(Some("550 5.1.1 User unknown"), None, None);
+        assert_eq!(result.bounce_type, BounceType::InvalidRecipient);
+        assert_eq!(result.category, BounceCategory::Hard);
+    }
+
+    #[test]
+    fn test_detect_mailbox_full() {
+        let result = detect_bounce_type(Some("552 5.2.2 Mailbox full"), None, None);
+        assert_eq!(result.bounce_type, BounceType::MailboxFull);
+        assert_eq!(result.category, BounceCategory::Hard);
+    }
+
+    #[test]
+    fn test_detect_temporary_failure() {
+        let result = detect_bounce_type(Some("451 4.3.0 Try again later"), None, None);
+        assert_eq!(result.bounce_type, BounceType::ServerUnavailable);
+        assert_eq!(result.category, BounceCategory::Soft);
+    }
+
+    #[test]
+    fn test_detect_auto_response() {
+        let result = detect_bounce_type(Some("Auto-reply: Out of office"), None, None);
+        assert_eq!(result.bounce_type, BounceType::AutoResponse);
+        assert_eq!(result.category, BounceCategory::AutoResponse);
+    }
+
+    #[test]
+    fn test_detect_from_dsn_status() {
+        let result = detect_bounce_type(None, None, Some("5.1.1"));
+        assert_eq!(result.bounce_type, BounceType::InvalidRecipient);
+
+        let result = detect_bounce_type(None, None, Some("4.4.1"));
+        assert_eq!(result.bounce_type, BounceType::NetworkError);
+    }
+
+    #[test]
+    fn test_detect_unknown() {
+        let result = detect_bounce_type(Some("Something weird happened"), None, None);
+        assert_eq!(result.bounce_type, BounceType::Unknown);
+    }
+
+    #[test]
+    fn test_is_bounce_subject() {
+        assert!(is_bounce_subject("Mail Delivery Failure"));
+        assert!(is_bounce_subject("Delivery Status Notification"));
+        assert!(is_bounce_subject("Returned mail: see transcript for details"));
+        assert!(is_bounce_subject("Undeliverable: Your message"));
+        assert!(!is_bounce_subject("Hello World"));
+        assert!(!is_bounce_subject("Meeting tomorrow"));
+    }
+
+    #[test]
+    fn test_extract_bounce_recipient() {
+        let body = "Delivery to the following recipient failed:\n  recipient: user@example.com";
+        assert_eq!(
+            extract_bounce_recipient(body),
+            Some("user@example.com".to_string())
+        );
+
+        let body = "Final-Recipient: rfc822;bounce@test.org";
+        assert_eq!(
+            extract_bounce_recipient(body),
+            Some("bounce@test.org".to_string())
+        );
+    }
+
+    #[test]
+    fn test_retry_delay() {
+        assert_eq!(default_retry_delay_ms(0), 900_000); // 15 min
+        assert_eq!(default_retry_delay_ms(1), 1_800_000); // 30 min
+        assert_eq!(default_retry_delay_ms(2), 3_600_000); // 1 hour
+
+        // Capped at 24h
+        assert_eq!(default_retry_delay_ms(20), 86_400_000);
+    }
+}

rust/crates/mailer-core/src/email.rs

@@ -0,0 +1,411 @@
+use std::collections::HashMap;
+use std::fmt;
+
+use serde::{Deserialize, Serialize};
+
+use crate::error::{MailerError, Result};
+use crate::mime::build_rfc822;
+use crate::validation::is_valid_email_format;
+
+/// Email priority level.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum Priority {
+    High,
+    Normal,
+    Low,
+}
+
+impl Default for Priority {
+    fn default() -> Self {
+        Priority::Normal
+    }
+}
+
+impl fmt::Display for Priority {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Priority::High => write!(f, "high"),
+            Priority::Normal => write!(f, "normal"),
+            Priority::Low => write!(f, "low"),
+        }
+    }
+}
+
+/// A parsed email address with local part and domain.
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct EmailAddress {
+    pub local: String,
+    pub domain: String,
+}
+
+impl EmailAddress {
+    /// Parse an email address string like "user@example.com" or "Name <user@example.com>".
+    pub fn parse(input: &str) -> Result<Self> {
+        let addr = extract_email_address(input)
+            .ok_or_else(|| MailerError::InvalidEmail(input.to_string()))?;
+
+        let parts: Vec<&str> = addr.splitn(2, '@').collect();
+        if parts.len() != 2 || parts[0].is_empty() || parts[1].is_empty() {
+            return Err(MailerError::InvalidEmail(input.to_string()));
+        }
+
+        Ok(EmailAddress {
+            local: parts[0].to_string(),
+            domain: parts[1].to_lowercase(),
+        })
+    }
+
+    /// Return the full address as "local@domain".
+    pub fn address(&self) -> String {
+        format!("{}@{}", self.local, self.domain)
+    }
+}
+
+impl fmt::Display for EmailAddress {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}@{}", self.local, self.domain)
+    }
+}
+
+/// Extract the bare email address from a string that may contain display names or angle brackets.
+/// Handles formats like:
+/// - "user@example.com"
+/// - "<user@example.com>"
+/// - "John Doe <user@example.com>"
+pub fn extract_email_address(input: &str) -> Option<String> {
+    let trimmed = input.trim();
+
+    // Handle null sender
+    if trimmed == "<>" {
+        return None;
+    }
+
+    // Try to extract from angle brackets
+    if let Some(start) = trimmed.find('<') {
+        if let Some(end) = trimmed.find('>') {
+            if end > start {
+                let addr = trimmed[start + 1..end].trim();
+                if !addr.is_empty() {
+                    return Some(addr.to_string());
+                }
+            }
+        }
+    }
+
+    // No angle brackets — treat entire string as address if it contains @
+    if trimmed.contains('@') {
+        return Some(trimmed.to_string());
+    }
+
+    None
+}
+
+/// An email attachment.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Attachment {
+    pub filename: String,
+    #[serde(with = "serde_bytes_base64")]
+    pub content: Vec<u8>,
+    pub content_type: String,
+    pub content_id: Option<String>,
+}
+
+/// Serde helper for base64-encoding Vec<u8> in JSON.
+mod serde_bytes_base64 {
+    use base64::engine::general_purpose::STANDARD;
+    use base64::Engine;
+    use serde::{Deserialize, Deserializer, Serializer};
+
+    pub fn serialize<S: Serializer>(data: &[u8], serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(&STANDARD.encode(data))
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(deserializer: D) -> Result<Vec<u8>, D::Error> {
+        let s = String::deserialize(deserializer)?;
+        STANDARD.decode(s).map_err(serde::de::Error::custom)
+    }
+}
+
+/// A complete email message.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Email {
+    pub from: String,
+    pub to: Vec<String>,
+    pub cc: Vec<String>,
+    pub bcc: Vec<String>,
+    pub subject: String,
+    pub text: String,
+    pub html: Option<String>,
+    pub attachments: Vec<Attachment>,
+    pub headers: HashMap<String, String>,
+    pub priority: Priority,
+    pub might_be_spam: bool,
+    message_id: Option<String>,
+    envelope_from: Option<String>,
+}
+
+impl Email {
+    /// Create a new email with the minimum required fields.
+    pub fn new(from: &str, subject: &str, text: &str) -> Self {
+        Email {
+            from: from.to_string(),
+            to: Vec::new(),
+            cc: Vec::new(),
+            bcc: Vec::new(),
+            subject: subject.to_string(),
+            text: text.to_string(),
+            html: None,
+            attachments: Vec::new(),
+            headers: HashMap::new(),
+            priority: Priority::Normal,
+            might_be_spam: false,
+            message_id: None,
+            envelope_from: None,
+        }
+    }
+
+    /// Add a To recipient.
+    pub fn add_to(&mut self, email: &str) -> &mut Self {
+        self.to.push(email.to_string());
+        self
+    }
+
+    /// Add a CC recipient.
+    pub fn add_cc(&mut self, email: &str) -> &mut Self {
+        self.cc.push(email.to_string());
+        self
+    }
+
+    /// Add a BCC recipient.
+    pub fn add_bcc(&mut self, email: &str) -> &mut Self {
+        self.bcc.push(email.to_string());
+        self
+    }
+
+    /// Set the HTML body.
+    pub fn set_html(&mut self, html: &str) -> &mut Self {
+        self.html = Some(html.to_string());
+        self
+    }
+
+    /// Add an attachment.
+    pub fn add_attachment(&mut self, attachment: Attachment) -> &mut Self {
+        self.attachments.push(attachment);
+        self
+    }
+
+    /// Add a custom header.
+    pub fn add_header(&mut self, name: &str, value: &str) -> &mut Self {
+        self.headers.insert(name.to_string(), value.to_string());
+        self
+    }
+
+    /// Set email priority.
+    pub fn set_priority(&mut self, priority: Priority) -> &mut Self {
+        self.priority = priority;
+        self
+    }
+
+    /// Get the sender domain.
+    pub fn from_domain(&self) -> Option<String> {
+        EmailAddress::parse(&self.from)
+            .ok()
+            .map(|addr| addr.domain)
+    }
+
+    /// Get the sender address (bare email, no display name).
+    pub fn from_address(&self) -> Option<String> {
+        extract_email_address(&self.from)
+    }
+
+    /// Get all recipients (to + cc + bcc), deduplicated.
+    pub fn all_recipients(&self) -> Vec<String> {
+        let mut seen = std::collections::HashSet::new();
+        let mut result = Vec::new();
+        for addr in self.to.iter().chain(self.cc.iter()).chain(self.bcc.iter()) {
+            let lower = addr.to_lowercase();
+            if seen.insert(lower) {
+                result.push(addr.clone());
+            }
+        }
+        result
+    }
+
+    /// Get the primary (first To) recipient.
+    pub fn primary_recipient(&self) -> Option<&str> {
+        self.to.first().map(|s| s.as_str())
+    }
+
+    /// Check whether this email has attachments.
+    pub fn has_attachments(&self) -> bool {
+        !self.attachments.is_empty()
+    }
+
+    /// Get total attachment size in bytes.
+    pub fn attachments_size(&self) -> usize {
+        self.attachments.iter().map(|a| a.content.len()).sum()
+    }
+
+    /// Get or generate a Message-ID.
+    pub fn message_id(&self) -> String {
+        if let Some(ref id) = self.message_id {
+            return id.clone();
+        }
+        let domain = self.from_domain().unwrap_or_else(|| "localhost".to_string());
+        let unique = uuid::Uuid::new_v4();
+        format!("<{}.{}@{}>", chrono_millis(), unique, domain)
+    }
+
+    /// Set an explicit Message-ID.
+    pub fn set_message_id(&mut self, id: &str) -> &mut Self {
+        self.message_id = Some(id.to_string());
+        self
+    }
+
+    /// Get the envelope-from (MAIL FROM), falls back to the From header address.
+    pub fn envelope_from(&self) -> Option<String> {
+        self.envelope_from
+            .clone()
+            .or_else(|| self.from_address())
+    }
+
+    /// Set the envelope-from address.
+    pub fn set_envelope_from(&mut self, addr: &str) -> &mut Self {
+        self.envelope_from = Some(addr.to_string());
+        self
+    }
+
+    /// Sanitize a string by removing CR/LF (header injection prevention).
+    pub fn sanitize_string(input: &str) -> String {
+        input.replace(['\r', '\n'], " ")
+    }
+
+    /// Validate all addresses in this email.
+    pub fn validate_addresses(&self) -> Vec<String> {
+        let mut errors = Vec::new();
+
+        if !is_valid_email_format(&self.from) {
+            if extract_email_address(&self.from)
+                .map(|a| !is_valid_email_format(&a))
+                .unwrap_or(true)
+            {
+                errors.push(format!("Invalid from address: {}", self.from));
+            }
+        }
+
+        for addr in &self.to {
+            if !is_valid_email_format(addr) {
+                if extract_email_address(addr)
+                    .map(|a| !is_valid_email_format(&a))
+                    .unwrap_or(true)
+                {
+                    errors.push(format!("Invalid to address: {}", addr));
+                }
+            }
+        }
+
+        for addr in &self.cc {
+            if !is_valid_email_format(addr) {
+                if extract_email_address(addr)
+                    .map(|a| !is_valid_email_format(&a))
+                    .unwrap_or(true)
+                {
+                    errors.push(format!("Invalid cc address: {}", addr));
+                }
+            }
+        }
+
+        for addr in &self.bcc {
+            if !is_valid_email_format(addr) {
+                if extract_email_address(addr)
+                    .map(|a| !is_valid_email_format(&a))
+                    .unwrap_or(true)
+                {
+                    errors.push(format!("Invalid bcc address: {}", addr));
+                }
+            }
+        }
+
+        errors
+    }
+
+    /// Convert the email to RFC 5322 format.
+    pub fn to_rfc822(&self) -> Result<String> {
+        build_rfc822(self)
+    }
+}
+
+/// Simple epoch millis using std::time (no chrono dependency needed).
+fn chrono_millis() -> u128 {
+    std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_millis()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_email_address_parse() {
+        let addr = EmailAddress::parse("user@example.com").unwrap();
+        assert_eq!(addr.local, "user");
+        assert_eq!(addr.domain, "example.com");
+
+        let addr = EmailAddress::parse("John Doe <john@example.com>").unwrap();
+        assert_eq!(addr.local, "john");
+        assert_eq!(addr.domain, "example.com");
+
+        let addr = EmailAddress::parse("<admin@test.org>").unwrap();
+        assert_eq!(addr.local, "admin");
+        assert_eq!(addr.domain, "test.org");
+    }
+
+    #[test]
+    fn test_extract_email_address() {
+        assert_eq!(
+            extract_email_address("John <john@example.com>"),
+            Some("john@example.com".to_string())
+        );
+        assert_eq!(
+            extract_email_address("user@example.com"),
+            Some("user@example.com".to_string())
+        );
+        assert_eq!(extract_email_address("<>"), None);
+        assert_eq!(extract_email_address("no-at-sign"), None);
+    }
+
+    #[test]
+    fn test_email_new() {
+        let mut email = Email::new("sender@example.com", "Test", "Hello");
+        email.add_to("recipient@example.com");
+        assert_eq!(email.from_domain(), Some("example.com".to_string()));
+        assert_eq!(email.all_recipients().len(), 1);
+    }
+
+    #[test]
+    fn test_all_recipients_dedup() {
+        let mut email = Email::new("sender@example.com", "Test", "Hello");
+        email.add_to("a@example.com");
+        email.add_cc("a@example.com"); // duplicate (case-insensitive)
+        email.add_bcc("b@example.com");
+        assert_eq!(email.all_recipients().len(), 2);
+    }
+
+    #[test]
+    fn test_sanitize_string() {
+        assert_eq!(Email::sanitize_string("hello\r\nworld"), "hello  world");
+        assert_eq!(Email::sanitize_string("normal"), "normal");
+    }
+
+    #[test]
+    fn test_message_id_generation() {
+        let email = Email::new("sender@example.com", "Test", "Hello");
+        let mid = email.message_id();
+        assert!(mid.starts_with('<'));
+        assert!(mid.ends_with('>'));
+        assert!(mid.contains("@example.com"));
+    }
+}

rust/crates/mailer-core/src/error.rs

@@ -0,0 +1,31 @@
+use thiserror::Error;
+
+/// Core error types for the mailer system.
+#[derive(Debug, Error)]
+pub enum MailerError {
+    #[error("invalid email address: {0}")]
+    InvalidEmail(String),
+
+    #[error("invalid email format: {0}")]
+    InvalidFormat(String),
+
+    #[error("missing required field: {0}")]
+    MissingField(String),
+
+    #[error("MIME encoding error: {0}")]
+    MimeError(String),
+
+    #[error("validation error: {0}")]
+    ValidationError(String),
+
+    #[error("parse error: {0}")]
+    ParseError(String),
+
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+
+    #[error("regex error: {0}")]
+    Regex(#[from] regex::Error),
+}
+
+pub type Result<T> = std::result::Result<T, MailerError>;

rust/crates/mailer-core/src/lib.rs

@@ -1,9 +1,25 @@
 //! mailer-core: Email model, validation, and RFC 5322 primitives.
 
+pub mod bounce;
+pub mod email;
+pub mod error;
+pub mod mime;
+pub mod validation;
+
+// Re-exports for convenience
+pub use bounce::{
+    detect_bounce_type, extract_bounce_recipient, is_bounce_subject, BounceCategory,
+    BounceDetection, BounceType,
+};
+pub use email::{extract_email_address, Attachment, Email, EmailAddress, Priority};
+pub use error::{MailerError, Result};
+pub use mime::build_rfc822;
+pub use validation::{is_valid_email_format, validate_email, EmailValidationResult};
+
 /// Re-export mailparse for MIME parsing.
 pub use mailparse;
 
-/// Placeholder for email address validation and data types.
+/// Crate version.
 pub fn version() -> &'static str {
     env!("CARGO_PKG_VERSION")
 }

rust/crates/mailer-core/src/mime.rs

@@ -0,0 +1,377 @@
+use base64::engine::general_purpose::STANDARD;
+use base64::Engine;
+
+use crate::email::Email;
+use crate::error::Result;
+
+/// Generate a MIME boundary string.
+fn generate_boundary() -> String {
+    let id = uuid::Uuid::new_v4();
+    format!("----=_Part_{}", id.as_simple())
+}
+
+/// Build an RFC 5322 compliant email message from an Email struct.
+pub fn build_rfc822(email: &Email) -> Result<String> {
+    let mut output = String::with_capacity(4096);
+    let message_id = email.message_id();
+
+    // Required headers
+    output.push_str(&format!(
+        "From: {}\r\n",
+        Email::sanitize_string(&email.from)
+    ));
+
+    if !email.to.is_empty() {
+        output.push_str(&format!(
+            "To: {}\r\n",
+            email
+                .to
+                .iter()
+                .map(|a| Email::sanitize_string(a))
+                .collect::<Vec<_>>()
+                .join(", ")
+        ));
+    }
+
+    if !email.cc.is_empty() {
+        output.push_str(&format!(
+            "Cc: {}\r\n",
+            email
+                .cc
+                .iter()
+                .map(|a| Email::sanitize_string(a))
+                .collect::<Vec<_>>()
+                .join(", ")
+        ));
+    }
+
+    output.push_str(&format!(
+        "Subject: {}\r\n",
+        Email::sanitize_string(&email.subject)
+    ));
+    output.push_str(&format!("Message-ID: {}\r\n", message_id));
+    output.push_str(&format!("Date: {}\r\n", rfc2822_now()));
+    output.push_str("MIME-Version: 1.0\r\n");
+
+    // Priority headers
+    match email.priority {
+        crate::email::Priority::High => {
+            output.push_str("X-Priority: 1\r\n");
+            output.push_str("Importance: high\r\n");
+        }
+        crate::email::Priority::Low => {
+            output.push_str("X-Priority: 5\r\n");
+            output.push_str("Importance: low\r\n");
+        }
+        crate::email::Priority::Normal => {}
+    }
+
+    // Custom headers
+    for (name, value) in &email.headers {
+        output.push_str(&format!(
+            "{}: {}\r\n",
+            Email::sanitize_string(name),
+            Email::sanitize_string(value)
+        ));
+    }
+
+    let has_html = email.html.is_some();
+    let has_attachments = !email.attachments.is_empty();
+
+    match (has_html, has_attachments) {
+        (false, false) => {
+            // Plain text only
+            output.push_str("Content-Type: text/plain; charset=UTF-8\r\n");
+            output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+            output.push_str("\r\n");
+            output.push_str(&quoted_printable_encode(&email.text));
+        }
+        (true, false) => {
+            // multipart/alternative (text + html)
+            let boundary = generate_boundary();
+            output.push_str(&format!(
+                "Content-Type: multipart/alternative; boundary=\"{}\"\r\n",
+                boundary
+            ));
+            output.push_str("\r\n");
+
+            // Text part
+            output.push_str(&format!("--{}\r\n", boundary));
+            output.push_str("Content-Type: text/plain; charset=UTF-8\r\n");
+            output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+            output.push_str("\r\n");
+            output.push_str(&quoted_printable_encode(&email.text));
+            output.push_str("\r\n");
+
+            // HTML part
+            output.push_str(&format!("--{}\r\n", boundary));
+            output.push_str("Content-Type: text/html; charset=UTF-8\r\n");
+            output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+            output.push_str("\r\n");
+            output.push_str(&quoted_printable_encode(email.html.as_deref().unwrap()));
+            output.push_str("\r\n");
+
+            output.push_str(&format!("--{}--\r\n", boundary));
+        }
+        (_, true) => {
+            // multipart/mixed with optional multipart/alternative inside
+            let mixed_boundary = generate_boundary();
+            output.push_str(&format!(
+                "Content-Type: multipart/mixed; boundary=\"{}\"\r\n",
+                mixed_boundary
+            ));
+            output.push_str("\r\n");
+
+            if has_html {
+                // multipart/alternative for text+html
+                let alt_boundary = generate_boundary();
+                output.push_str(&format!("--{}\r\n", mixed_boundary));
+                output.push_str(&format!(
+                    "Content-Type: multipart/alternative; boundary=\"{}\"\r\n",
+                    alt_boundary
+                ));
+                output.push_str("\r\n");
+
+                // Text part
+                output.push_str(&format!("--{}\r\n", alt_boundary));
+                output.push_str("Content-Type: text/plain; charset=UTF-8\r\n");
+                output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+                output.push_str("\r\n");
+                output.push_str(&quoted_printable_encode(&email.text));
+                output.push_str("\r\n");
+
+                // HTML part
+                output.push_str(&format!("--{}\r\n", alt_boundary));
+                output.push_str("Content-Type: text/html; charset=UTF-8\r\n");
+                output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+                output.push_str("\r\n");
+                output.push_str(&quoted_printable_encode(email.html.as_deref().unwrap()));
+                output.push_str("\r\n");
+
+                output.push_str(&format!("--{}--\r\n", alt_boundary));
+            } else {
+                // Plain text only
+                output.push_str(&format!("--{}\r\n", mixed_boundary));
+                output.push_str("Content-Type: text/plain; charset=UTF-8\r\n");
+                output.push_str("Content-Transfer-Encoding: quoted-printable\r\n");
+                output.push_str("\r\n");
+                output.push_str(&quoted_printable_encode(&email.text));
+                output.push_str("\r\n");
+            }
+
+            // Attachments
+            for attachment in &email.attachments {
+                output.push_str(&format!("--{}\r\n", mixed_boundary));
+                output.push_str(&format!(
+                    "Content-Type: {}; name=\"{}\"\r\n",
+                    attachment.content_type, attachment.filename
+                ));
+                output.push_str("Content-Transfer-Encoding: base64\r\n");
+
+                if let Some(ref cid) = attachment.content_id {
+                    output.push_str(&format!("Content-ID: <{}>\r\n", cid));
+                    output.push_str("Content-Disposition: inline\r\n");
+                } else {
+                    output.push_str(&format!(
+                        "Content-Disposition: attachment; filename=\"{}\"\r\n",
+                        attachment.filename
+                    ));
+                }
+
+                output.push_str("\r\n");
+                output.push_str(&base64_encode_wrapped(&attachment.content));
+                output.push_str("\r\n");
+            }
+
+            output.push_str(&format!("--{}--\r\n", mixed_boundary));
+        }
+    }
+
+    Ok(output)
+}
+
+/// Encode a string as quoted-printable (RFC 2045).
+fn quoted_printable_encode(input: &str) -> String {
+    let mut output = String::with_capacity(input.len() * 2);
+    let mut line_len = 0;
+
+    for byte in input.bytes() {
+        let encoded = match byte {
+            // Printable ASCII that doesn't need encoding (except =)
+            b' '..=b'<' | b'>'..=b'~' => {
+                line_len += 1;
+                (byte as char).to_string()
+            }
+            b'\t' => {
+                line_len += 1;
+                "\t".to_string()
+            }
+            b'\r' => continue, // handled with \n
+            b'\n' => {
+                line_len = 0;
+                "\r\n".to_string()
+            }
+            _ => {
+                line_len += 3;
+                format!("={:02X}", byte)
+            }
+        };
+
+        // Soft line break at 76 characters
+        if line_len > 75 && byte != b'\n' {
+            output.push_str("=\r\n");
+            line_len = encoded.len();
+        }
+
+        output.push_str(&encoded);
+    }
+
+    output
+}
+
+/// Base64-encode binary data with 76-character line wrapping.
+fn base64_encode_wrapped(data: &[u8]) -> String {
+    let encoded = STANDARD.encode(data);
+    let mut output = String::with_capacity(encoded.len() + encoded.len() / 76 * 2);
+    for (i, ch) in encoded.chars().enumerate() {
+        if i > 0 && i % 76 == 0 {
+            output.push_str("\r\n");
+        }
+        output.push(ch);
+    }
+    output
+}
+
+/// Generate current date in RFC 2822 format (e.g., "Tue, 10 Feb 2026 12:00:00 +0000").
+fn rfc2822_now() -> String {
+    use std::time::SystemTime;
+
+    let now = SystemTime::now()
+        .duration_since(SystemTime::UNIX_EPOCH)
+        .unwrap_or_default()
+        .as_secs();
+
+    // Simple UTC formatting without chrono dependency
+    let days = now / 86400;
+    let time_of_day = now % 86400;
+    let hours = time_of_day / 3600;
+    let minutes = (time_of_day % 3600) / 60;
+    let seconds = time_of_day % 60;
+
+    // Calculate year/month/day from days since epoch
+    let (year, month, day) = days_to_ymd(days);
+
+    let day_of_week = ((days + 4) % 7) as usize; // Jan 1 1970 = Thursday (4)
+    let dow = ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"];
+    let mon = [
+        "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec",
+    ];
+
+    format!(
+        "{}, {:02} {} {:04} {:02}:{:02}:{:02} +0000",
+        dow[day_of_week],
+        day,
+        mon[(month - 1) as usize],
+        year,
+        hours,
+        minutes,
+        seconds
+    )
+}
+
+/// Convert days since Unix epoch to (year, month, day).
+fn days_to_ymd(days: u64) -> (u64, u64, u64) {
+    // Algorithm from https://howardhinnant.github.io/date_algorithms.html
+    let z = days + 719468;
+    let era = z / 146097;
+    let doe = z - era * 146097;
+    let yoe = (doe - doe / 1460 + doe / 36524 - doe / 146096) / 365;
+    let y = yoe + era * 400;
+    let doy = doe - (365 * yoe + yoe / 4 - yoe / 100);
+    let mp = (5 * doy + 2) / 153;
+    let d = doy - (153 * mp + 2) / 5 + 1;
+    let m = if mp < 10 { mp + 3 } else { mp - 9 };
+    let y = if m <= 2 { y + 1 } else { y };
+    (y, m, d)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::email::Email;
+
+    #[test]
+    fn test_plain_text_email() {
+        let mut email = Email::new("sender@example.com", "Test Subject", "Hello World");
+        email.add_to("recipient@example.com");
+        email.set_message_id("<test@example.com>");
+
+        let rfc822 = build_rfc822(&email).unwrap();
+        assert!(rfc822.contains("From: sender@example.com"));
+        assert!(rfc822.contains("To: recipient@example.com"));
+        assert!(rfc822.contains("Subject: Test Subject"));
+        assert!(rfc822.contains("Content-Type: text/plain; charset=UTF-8"));
+        assert!(rfc822.contains("Hello World"));
+    }
+
+    #[test]
+    fn test_html_email() {
+        let mut email = Email::new("sender@example.com", "HTML Test", "Plain text");
+        email.add_to("recipient@example.com");
+        email.set_html("<p>HTML content</p>");
+        email.set_message_id("<test@example.com>");
+
+        let rfc822 = build_rfc822(&email).unwrap();
+        assert!(rfc822.contains("multipart/alternative"));
+        assert!(rfc822.contains("text/plain"));
+        assert!(rfc822.contains("text/html"));
+        assert!(rfc822.contains("Plain text"));
+        assert!(rfc822.contains("HTML content"));
+    }
+
+    #[test]
+    fn test_email_with_attachment() {
+        let mut email = Email::new("sender@example.com", "Attachment Test", "See attached");
+        email.add_to("recipient@example.com");
+        email.set_message_id("<test@example.com>");
+        email.add_attachment(crate::email::Attachment {
+            filename: "test.txt".to_string(),
+            content: b"Hello attachment".to_vec(),
+            content_type: "text/plain".to_string(),
+            content_id: None,
+        });
+
+        let rfc822 = build_rfc822(&email).unwrap();
+        assert!(rfc822.contains("multipart/mixed"));
+        assert!(rfc822.contains("Content-Disposition: attachment"));
+        assert!(rfc822.contains("test.txt"));
+    }
+
+    #[test]
+    fn test_quoted_printable() {
+        let input = "Hello = World";
+        let encoded = quoted_printable_encode(input);
+        assert!(encoded.contains("=3D")); // = is encoded
+
+        let input = "Plain ASCII text";
+        let encoded = quoted_printable_encode(input);
+        assert_eq!(encoded, "Plain ASCII text");
+    }
+
+    #[test]
+    fn test_base64_wrapped() {
+        let data = vec![0u8; 100];
+        let encoded = base64_encode_wrapped(&data);
+        for line in encoded.split("\r\n") {
+            assert!(line.len() <= 76);
+        }
+    }
+
+    #[test]
+    fn test_rfc2822_date() {
+        let date = rfc2822_now();
+        // Should match pattern like "Tue, 10 Feb 2026 12:00:00 +0000"
+        assert!(date.contains("+0000"));
+        assert!(date.len() > 20);
+    }
+}

rust/crates/mailer-core/src/validation.rs

@@ -0,0 +1,178 @@
+use regex::Regex;
+use std::sync::LazyLock;
+
+/// Basic email format regex — covers the vast majority of valid email addresses.
+/// Does NOT attempt to match the full RFC 5321 grammar (which is impractical via regex).
+static EMAIL_REGEX: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(
+        r"(?i)^[a-z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$",
+    )
+    .expect("invalid email regex")
+});
+
+/// Check whether an email address has valid syntax.
+pub fn is_valid_email_format(email: &str) -> bool {
+    let email = email.trim();
+    if email.is_empty() || email.len() > 254 {
+        return false;
+    }
+
+    let parts: Vec<&str> = email.rsplitn(2, '@').collect();
+    if parts.len() != 2 {
+        return false;
+    }
+    let local = parts[1];
+    let domain = parts[0];
+
+    // Local part max 64 chars
+    if local.is_empty() || local.len() > 64 {
+        return false;
+    }
+
+    // Domain must have at least one dot (TLD only not valid for email)
+    if !domain.contains('.') {
+        return false;
+    }
+
+    EMAIL_REGEX.is_match(email)
+}
+
+/// Email validation result with scoring.
+#[derive(Debug, Clone)]
+pub struct EmailValidationResult {
+    pub is_valid: bool,
+    pub format_valid: bool,
+    pub score: f64,
+    pub error_message: Option<String>,
+}
+
+/// Validate an email address (synchronous, format-only).
+/// DNS-based validation (MX records, disposable domains) would require async and is
+/// intended for the N-API bridge layer where the TypeScript side already has DNS access.
+pub fn validate_email(email: &str) -> EmailValidationResult {
+    let format_valid = is_valid_email_format(email);
+
+    if !format_valid {
+        return EmailValidationResult {
+            is_valid: false,
+            format_valid: false,
+            score: 0.0,
+            error_message: Some(format!("Invalid email format: {}", email)),
+        };
+    }
+
+    // Role account detection (weight 0.1 penalty)
+    let local = email.split('@').next().unwrap_or("");
+    let is_role = is_role_account(local);
+
+    // Score: format (0.4) + assumed-mx (0.3) + assumed-not-disposable (0.2) + role (0.1)
+    let mut score = 0.4 + 0.3 + 0.2; // format + mx + not-disposable
+    if !is_role {
+        score += 0.1;
+    }
+
+    EmailValidationResult {
+        is_valid: score >= 0.7,
+        format_valid: true,
+        score,
+        error_message: None,
+    }
+}
+
+/// Check if a local part is a common role account.
+fn is_role_account(local: &str) -> bool {
+    const ROLE_ACCOUNTS: &[&str] = &[
+        "abuse",
+        "admin",
+        "administrator",
+        "billing",
+        "compliance",
+        "devnull",
+        "dns",
+        "ftp",
+        "hostmaster",
+        "info",
+        "inoc",
+        "ispfeedback",
+        "ispsupport",
+        "list",
+        "list-request",
+        "maildaemon",
+        "mailer-daemon",
+        "mailerdaemon",
+        "marketing",
+        "noc",
+        "no-reply",
+        "noreply",
+        "null",
+        "phish",
+        "phishing",
+        "postmaster",
+        "privacy",
+        "registrar",
+        "root",
+        "sales",
+        "security",
+        "spam",
+        "support",
+        "sysadmin",
+        "tech",
+        "undisclosed-recipients",
+        "unsubscribe",
+        "usenet",
+        "uucp",
+        "webmaster",
+        "www",
+    ];
+    let lower = local.to_lowercase();
+    ROLE_ACCOUNTS.contains(&lower.as_str())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_valid_emails() {
+        assert!(is_valid_email_format("user@example.com"));
+        assert!(is_valid_email_format("first.last@example.com"));
+        assert!(is_valid_email_format("user+tag@example.com"));
+        assert!(is_valid_email_format("user@sub.domain.example.com"));
+    }
+
+    #[test]
+    fn test_invalid_emails() {
+        assert!(!is_valid_email_format(""));
+        assert!(!is_valid_email_format("@"));
+        assert!(!is_valid_email_format("user@"));
+        assert!(!is_valid_email_format("@domain.com"));
+        assert!(!is_valid_email_format("user@domain")); // no TLD
+        assert!(!is_valid_email_format("user @domain.com")); // space
+        assert!(!is_valid_email_format("user@.com")); // leading dot
+    }
+
+    #[test]
+    fn test_validate_email_scoring() {
+        let result = validate_email("user@example.com");
+        assert!(result.is_valid);
+        assert!(result.score >= 0.9);
+
+        let result = validate_email("postmaster@example.com");
+        assert!(result.is_valid);
+        assert!(result.score >= 0.7);
+        assert!(result.score < 1.0); // role account penalty
+
+        let result = validate_email("not-an-email");
+        assert!(!result.is_valid);
+        assert_eq!(result.score, 0.0);
+    }
+
+    #[test]
+    fn test_role_accounts() {
+        assert!(is_role_account("postmaster"));
+        assert!(is_role_account("abuse"));
+        assert!(is_role_account("noreply"));
+        assert!(!is_role_account("john"));
+        assert!(!is_role_account("alice"));
+    }
+}

rust/crates/mailer-security/Cargo.toml

@@ -17,3 +17,4 @@ hickory-resolver.workspace = true
 ipnet.workspace = true
 rustls-pki-types.workspace = true
 psl.workspace = true
+regex.workspace = true

rust/crates/mailer-security/src/content_scanner.rs

@@ -0,0 +1,515 @@
+//! Content scanning for email threat detection.
+//!
+//! Provides pattern-based scanning of email subjects, text bodies, HTML bodies,
+//! and attachment filenames for phishing, spam, malware, suspicious links,
+//! script injection, and sensitive data patterns.
+
+use regex::Regex;
+use serde::Serialize;
+use std::sync::LazyLock;
+
+// ---------------------------------------------------------------------------
+// Result types
+// ---------------------------------------------------------------------------
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct ContentScanResult {
+    pub threat_score: u32,
+    pub threat_type: Option<String>,
+    pub threat_details: Option<String>,
+    pub scanned_elements: Vec<String>,
+}
+
+// ---------------------------------------------------------------------------
+// Pattern definitions (compiled once via LazyLock)
+// ---------------------------------------------------------------------------
+
+static PHISHING_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"(?i)(?:verify|confirm|update|login).*(?:account|password|details)").unwrap(),
+        Regex::new(r"(?i)urgent.*(?:action|attention|required)").unwrap(),
+        Regex::new(r"(?i)(?:paypal|apple|microsoft|amazon|google|bank).*(?:verify|confirm|suspend)").unwrap(),
+        Regex::new(r"(?i)your.*(?:account).*(?:suspended|compromised|locked)").unwrap(),
+        Regex::new(r"(?i)\b(?:password reset|security alert|security notice)\b").unwrap(),
+    ]
+});
+
+static SPAM_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"(?i)\b(?:viagra|cialis|enlargement|diet pill|lose weight fast|cheap meds)\b").unwrap(),
+        Regex::new(r"(?i)\b(?:million dollars|lottery winner|prize claim|inheritance|rich widow)\b").unwrap(),
+        Regex::new(r"(?i)\b(?:earn from home|make money fast|earn \$\d{3,}/day)\b").unwrap(),
+        Regex::new(r"(?i)\b(?:limited time offer|act now|exclusive deal|only \d+ left)\b").unwrap(),
+        Regex::new(r"(?i)\b(?:forex|stock tip|investment opportunity|cryptocurrency|bitcoin)\b").unwrap(),
+    ]
+});
+
+static MALWARE_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"(?i)(?:attached file|see attachment).*(?:invoice|receipt|statement|document)").unwrap(),
+        Regex::new(r"(?i)open.*(?:the attached|this attachment)").unwrap(),
+        Regex::new(r"(?i)(?:enable|allow).*(?:macros|content|editing)").unwrap(),
+        Regex::new(r"(?i)download.*(?:attachment|file|document)").unwrap(),
+        Regex::new(r"(?i)\b(?:ransomware protection|virus alert|malware detected)\b").unwrap(),
+    ]
+});
+
+static SUSPICIOUS_LINK_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"(?i)https?://bit\.ly/").unwrap(),
+        Regex::new(r"(?i)https?://goo\.gl/").unwrap(),
+        Regex::new(r"(?i)https?://t\.co/").unwrap(),
+        Regex::new(r"(?i)https?://tinyurl\.com/").unwrap(),
+        Regex::new(r"(?i)https?://(?:\d{1,3}\.){3}\d{1,3}").unwrap(),
+        Regex::new(r"(?i)https?://.*\.(?:xyz|top|club|gq|cf)/").unwrap(),
+        Regex::new(r"(?i)(?:login|account|signin|auth).*\.(?:xyz|top|club|gq|cf|tk|ml|ga|pw|ws|buzz)\b").unwrap(),
+    ]
+});
+
+static SCRIPT_INJECTION_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"(?is)<script.*>.*</script>").unwrap(),
+        Regex::new(r"(?i)javascript:").unwrap(),
+        Regex::new(r#"(?i)on(?:click|load|mouse|error|focus|blur)=".*""#).unwrap(),
+        Regex::new(r"(?i)document\.(?:cookie|write|location)").unwrap(),
+        Regex::new(r"(?i)eval\s*\(").unwrap(),
+    ]
+});
+
+static SENSITIVE_DATA_PATTERNS: LazyLock<Vec<Regex>> = LazyLock::new(|| {
+    vec![
+        Regex::new(r"\b(?:\d{3}-\d{2}-\d{4}|\d{9})\b").unwrap(),
+        Regex::new(r"\b\d{13,16}\b").unwrap(),
+        Regex::new(r"\b(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\b").unwrap(),
+    ]
+});
+
+/// Link extraction from HTML href attributes.
+static HREF_PATTERN: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?i)href=["'](https?://[^"']+)["']"#).unwrap()
+});
+
+/// Executable file extensions that are considered dangerous.
+static EXECUTABLE_EXTENSIONS: LazyLock<Vec<&'static str>> = LazyLock::new(|| {
+    vec![
+        ".exe", ".dll", ".bat", ".cmd", ".msi", ".vbs", ".ps1",
+        ".sh", ".jar", ".py", ".com", ".scr", ".pif", ".hta", ".cpl",
+        ".reg", ".vba", ".lnk", ".wsf", ".msp", ".mst",
+    ]
+});
+
+/// Document extensions that may contain macros.
+static MACRO_DOCUMENT_EXTENSIONS: LazyLock<Vec<&'static str>> = LazyLock::new(|| {
+    vec![
+        ".doc", ".docm", ".xls", ".xlsm", ".ppt", ".pptm",
+        ".dotm", ".xlsb", ".ppam", ".potm",
+    ]
+});
+
+// ---------------------------------------------------------------------------
+// HTML helpers
+// ---------------------------------------------------------------------------
+
+/// Strip HTML tags and decode common entities to produce plain text.
+fn extract_text_from_html(html: &str) -> String {
+    // Remove style and script blocks first
+    let no_style = Regex::new(r"(?is)<style[^>]*>.*?</style>").unwrap();
+    let no_script = Regex::new(r"(?is)<script[^>]*>.*?</script>").unwrap();
+    let no_tags = Regex::new(r"<[^>]+>").unwrap();
+
+    let text = no_style.replace_all(html, " ");
+    let text = no_script.replace_all(&text, " ");
+    let text = no_tags.replace_all(&text, " ");
+
+    text.replace("&nbsp;", " ")
+        .replace("&lt;", "<")
+        .replace("&gt;", ">")
+        .replace("&amp;", "&")
+        .replace("&quot;", "\"")
+        .replace("&apos;", "'")
+        .split_whitespace()
+        .collect::<Vec<_>>()
+        .join(" ")
+}
+
+/// Extract all href links from HTML.
+fn extract_links_from_html(html: &str) -> Vec<String> {
+    HREF_PATTERN
+        .captures_iter(html)
+        .filter_map(|cap| cap.get(1).map(|m| m.as_str().to_string()))
+        .collect()
+}
+
+// ---------------------------------------------------------------------------
+// Scoring helpers
+// ---------------------------------------------------------------------------
+
+fn matches_any(text: &str, patterns: &[Regex]) -> bool {
+    patterns.iter().any(|p| p.is_match(text))
+}
+
+// ---------------------------------------------------------------------------
+// Main scan entry point
+// ---------------------------------------------------------------------------
+
+/// Scan email content for threats.
+///
+/// This mirrors the TypeScript ContentScanner logic — scanning the subject,
+/// text body, HTML body, and attachment filenames against predefined patterns.
+/// Returns an aggregate threat score and the highest-severity threat type.
+pub fn scan_content(
+    subject: Option<&str>,
+    text_body: Option<&str>,
+    html_body: Option<&str>,
+    attachment_names: &[String],
+) -> ContentScanResult {
+    let mut score: u32 = 0;
+    let mut threat_type: Option<String> = None;
+    let mut threat_details: Option<String> = None;
+    let mut scanned: Vec<String> = Vec::new();
+
+    // Helper: upgrade threat info only if the new finding is more severe.
+    macro_rules! record {
+        ($new_score:expr, $ttype:expr, $details:expr) => {
+            score += $new_score;
+            // Always adopt the threat type from the highest-scoring match.
+            threat_type = Some($ttype.to_string());
+            threat_details = Some($details.to_string());
+        };
+    }
+
+    // ── Subject scanning ──────────────────────────────────────────────
+    if let Some(subj) = subject {
+        scanned.push("subject".into());
+
+        if matches_any(subj, &PHISHING_PATTERNS) {
+            record!(25, "phishing", format!("Subject contains potential phishing indicators: {}", subj));
+        } else if matches_any(subj, &SPAM_PATTERNS) {
+            record!(15, "spam", format!("Subject contains potential spam indicators: {}", subj));
+        }
+    }
+
+    // ── Text body scanning ────────────────────────────────────────────
+    if let Some(text) = text_body {
+        scanned.push("text".into());
+
+        // Check each category and accumulate score (same order as TS)
+        for pat in SUSPICIOUS_LINK_PATTERNS.iter() {
+            if pat.is_match(text) {
+                score += 20;
+                if threat_type.as_deref() != Some("suspicious_link") {
+                    threat_type = Some("suspicious_link".into());
+                    threat_details = Some("Text contains suspicious links".into());
+                }
+            }
+        }
+
+        for pat in PHISHING_PATTERNS.iter() {
+            if pat.is_match(text) {
+                score += 25;
+                threat_type = Some("phishing".into());
+                threat_details = Some("Text contains potential phishing indicators".into());
+            }
+        }
+
+        for pat in SPAM_PATTERNS.iter() {
+            if pat.is_match(text) {
+                score += 15;
+                if threat_type.is_none() {
+                    threat_type = Some("spam".into());
+                    threat_details = Some("Text contains potential spam indicators".into());
+                }
+            }
+        }
+
+        for pat in MALWARE_PATTERNS.iter() {
+            if pat.is_match(text) {
+                score += 30;
+                threat_type = Some("malware".into());
+                threat_details = Some("Text contains potential malware indicators".into());
+            }
+        }
+
+        for pat in SENSITIVE_DATA_PATTERNS.iter() {
+            if pat.is_match(text) {
+                score += 25;
+                if threat_type.is_none() {
+                    threat_type = Some("sensitive_data".into());
+                    threat_details = Some("Text contains potentially sensitive data patterns".into());
+                }
+            }
+        }
+    }
+
+    // ── HTML body scanning ────────────────────────────────────────────
+    if let Some(html) = html_body {
+        scanned.push("html".into());
+
+        // Script injection check
+        for pat in SCRIPT_INJECTION_PATTERNS.iter() {
+            if pat.is_match(html) {
+                score += 40;
+                if threat_type.as_deref() != Some("xss") {
+                    threat_type = Some("xss".into());
+                    threat_details = Some("HTML contains potentially malicious script content".into());
+                }
+            }
+        }
+
+        // Extract text from HTML and scan (half score to avoid double counting)
+        let text_content = extract_text_from_html(html);
+        if !text_content.is_empty() {
+            let mut html_text_score: u32 = 0;
+            let mut html_text_type: Option<String> = None;
+            let mut html_text_details: Option<String> = None;
+
+            // Re-run text patterns on extracted HTML text
+            for pat in SUSPICIOUS_LINK_PATTERNS.iter() {
+                if pat.is_match(&text_content) {
+                    html_text_score += 20;
+                    html_text_type = Some("suspicious_link".into());
+                    html_text_details = Some("Text contains suspicious links".into());
+                }
+            }
+            for pat in PHISHING_PATTERNS.iter() {
+                if pat.is_match(&text_content) {
+                    html_text_score += 25;
+                    html_text_type = Some("phishing".into());
+                    html_text_details = Some("Text contains potential phishing indicators".into());
+                }
+            }
+            for pat in SPAM_PATTERNS.iter() {
+                if pat.is_match(&text_content) {
+                    html_text_score += 15;
+                    if html_text_type.is_none() {
+                        html_text_type = Some("spam".into());
+                        html_text_details = Some("Text contains potential spam indicators".into());
+                    }
+                }
+            }
+            for pat in MALWARE_PATTERNS.iter() {
+                if pat.is_match(&text_content) {
+                    html_text_score += 30;
+                    html_text_type = Some("malware".into());
+                    html_text_details = Some("Text contains potential malware indicators".into());
+                }
+            }
+            for pat in SENSITIVE_DATA_PATTERNS.iter() {
+                if pat.is_match(&text_content) {
+                    html_text_score += 25;
+                    if html_text_type.is_none() {
+                        html_text_type = Some("sensitive_data".into());
+                        html_text_details = Some("Text contains potentially sensitive data patterns".into());
+                    }
+                }
+            }
+
+            if html_text_score > 0 {
+                // Add half of the text content score to avoid double counting
+                score += html_text_score / 2;
+                if let Some(t) = html_text_type {
+                    if threat_type.is_none() || html_text_score > score {
+                        threat_type = Some(t);
+                        threat_details = html_text_details;
+                    }
+                }
+            }
+        }
+
+        // Extract and check links from HTML
+        let links = extract_links_from_html(html);
+        if !links.is_empty() {
+            let mut suspicious_count = 0u32;
+            for link in &links {
+                if matches_any(link, &SUSPICIOUS_LINK_PATTERNS) {
+                    suspicious_count += 1;
+                }
+            }
+
+            if suspicious_count > 0 {
+                let pct = (suspicious_count as f64 / links.len() as f64) * 100.0;
+                let additional = std::cmp::min(40, (pct / 2.5) as u32);
+                score += additional;
+
+                if additional > 20 || threat_type.is_none() {
+                    threat_type = Some("suspicious_link".into());
+                    threat_details = Some(format!(
+                        "HTML contains {} suspicious links out of {} total links",
+                        suspicious_count,
+                        links.len()
+                    ));
+                }
+            }
+        }
+    }
+
+    // ── Attachment filename scanning ──────────────────────────────────
+    for name in attachment_names {
+        let lower = name.to_lowercase();
+        scanned.push(format!("attachment:{}", lower));
+
+        // Check executable extensions
+        for ext in EXECUTABLE_EXTENSIONS.iter() {
+            if lower.ends_with(ext) {
+                score += 70;
+                threat_type = Some("executable".into());
+                threat_details = Some(format!(
+                    "Attachment has a potentially dangerous extension: {}",
+                    name
+                ));
+                break;
+            }
+        }
+
+        // Check macro document extensions
+        for ext in MACRO_DOCUMENT_EXTENSIONS.iter() {
+            if lower.ends_with(ext) {
+                // Flag macro-capable documents (lower score than executables)
+                score += 20;
+                if threat_type.is_none() {
+                    threat_type = Some("malicious_macro".into());
+                    threat_details = Some(format!(
+                        "Attachment is a macro-capable document: {}",
+                        name
+                    ));
+                }
+                break;
+            }
+        }
+    }
+
+    ContentScanResult {
+        threat_score: score,
+        threat_type,
+        threat_details,
+        scanned_elements: scanned,
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_clean_content() {
+        let result = scan_content(
+            Some("Project Update"),
+            Some("The project is on track."),
+            None,
+            &[],
+        );
+        assert_eq!(result.threat_score, 0);
+        assert!(result.threat_type.is_none());
+    }
+
+    #[test]
+    fn test_phishing_subject() {
+        let result = scan_content(
+            Some("URGENT: Verify your bank account details immediately"),
+            None,
+            None,
+            &[],
+        );
+        assert!(result.threat_score >= 25);
+        assert_eq!(result.threat_type.as_deref(), Some("phishing"));
+    }
+
+    #[test]
+    fn test_spam_body() {
+        let result = scan_content(
+            None,
+            Some("Win a million dollars in the lottery winner contest!"),
+            None,
+            &[],
+        );
+        assert!(result.threat_score >= 15);
+        assert_eq!(result.threat_type.as_deref(), Some("spam"));
+    }
+
+    #[test]
+    fn test_suspicious_links() {
+        let result = scan_content(
+            None,
+            Some("Check out https://bit.ly/2x3F5 for more info"),
+            None,
+            &[],
+        );
+        assert!(result.threat_score >= 20);
+        assert_eq!(result.threat_type.as_deref(), Some("suspicious_link"));
+    }
+
+    #[test]
+    fn test_script_injection() {
+        let result = scan_content(
+            None,
+            None,
+            Some("<p>Hello</p><script>document.cookie='steal';</script>"),
+            &[],
+        );
+        assert!(result.threat_score >= 40);
+        assert_eq!(result.threat_type.as_deref(), Some("xss"));
+    }
+
+    #[test]
+    fn test_executable_attachment() {
+        let result = scan_content(
+            None,
+            None,
+            None,
+            &["update.exe".into()],
+        );
+        assert!(result.threat_score >= 70);
+        assert_eq!(result.threat_type.as_deref(), Some("executable"));
+    }
+
+    #[test]
+    fn test_macro_document() {
+        let result = scan_content(
+            None,
+            None,
+            None,
+            &["report.docm".into()],
+        );
+        assert!(result.threat_score >= 20);
+        assert_eq!(result.threat_type.as_deref(), Some("malicious_macro"));
+    }
+
+    #[test]
+    fn test_malware_indicators() {
+        let result = scan_content(
+            None,
+            Some("Please enable macros to view this document properly."),
+            None,
+            &[],
+        );
+        assert!(result.threat_score >= 30);
+        assert_eq!(result.threat_type.as_deref(), Some("malware"));
+    }
+
+    #[test]
+    fn test_html_link_extraction() {
+        let result = scan_content(
+            None,
+            None,
+            Some(r#"<a href="https://bit.ly/abc">click</a> and <a href="https://t.co/xyz">here</a>"#),
+            &[],
+        );
+        assert!(result.threat_score > 0);
+    }
+
+    #[test]
+    fn test_compound_threats() {
+        let result = scan_content(
+            Some("URGENT: Verify your account details immediately"),
+            Some("Your account will be suspended unless you verify at https://bit.ly/2x3F5"),
+            Some(r#"<a href="https://bit.ly/2x3F5">verify</a>"#),
+            &["verification.exe".into()],
+        );
+        assert!(result.threat_score > 70);
+    }
+}

rust/crates/mailer-security/src/dkim.rs

@@ -0,0 +1,152 @@
+use mail_auth::common::crypto::{RsaKey, Sha256};
+use mail_auth::common::headers::HeaderWriter;
+use mail_auth::dkim::{Canonicalization, DkimSigner};
+use mail_auth::{AuthenticatedMessage, DkimOutput, DkimResult, MessageAuthenticator};
+use rustls_pki_types::{PrivateKeyDer, PrivatePkcs1KeyDer, pem::PemObject};
+use serde::{Deserialize, Serialize};
+
+use crate::error::{Result, SecurityError};
+
+/// Result of DKIM verification.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DkimVerificationResult {
+    /// Whether the DKIM signature is valid.
+    pub is_valid: bool,
+    /// The signing domain (d= tag).
+    pub domain: Option<String>,
+    /// The selector (s= tag).
+    pub selector: Option<String>,
+    /// Result status: "pass", "fail", "permerror", "temperror", "none".
+    pub status: String,
+    /// Human-readable details.
+    pub details: Option<String>,
+}
+
+/// Convert raw `mail-auth` DKIM outputs to our serializable results.
+///
+/// This is used internally by `verify_dkim` and by the compound `verify_email_security`.
+pub fn dkim_outputs_to_results(dkim_outputs: &[DkimOutput<'_>]) -> Vec<DkimVerificationResult> {
+    if dkim_outputs.is_empty() {
+        return vec![DkimVerificationResult {
+            is_valid: false,
+            domain: None,
+            selector: None,
+            status: "none".to_string(),
+            details: Some("No DKIM signatures found".to_string()),
+        }];
+    }
+
+    dkim_outputs
+        .iter()
+        .map(|output| {
+            let (is_valid, status, details) = match output.result() {
+                DkimResult::Pass => (true, "pass", None),
+                DkimResult::Neutral(err) => (false, "neutral", Some(err.to_string())),
+                DkimResult::Fail(err) => (false, "fail", Some(err.to_string())),
+                DkimResult::PermError(err) => (false, "permerror", Some(err.to_string())),
+                DkimResult::TempError(err) => (false, "temperror", Some(err.to_string())),
+                DkimResult::None => (false, "none", None),
+            };
+
+            let (domain, selector) = output
+                .signature()
+                .map(|sig| (Some(sig.d.clone()), Some(sig.s.clone())))
+                .unwrap_or((None, None));
+
+            DkimVerificationResult {
+                is_valid,
+                domain,
+                selector,
+                status: status.to_string(),
+                details,
+            }
+        })
+        .collect()
+}
+
+/// Verify DKIM signatures on a raw email message.
+///
+/// Uses the `mail-auth` crate which performs full RFC 6376 verification
+/// including DNS lookups for the public key.
+pub async fn verify_dkim(
+    raw_message: &[u8],
+    authenticator: &MessageAuthenticator,
+) -> Result<Vec<DkimVerificationResult>> {
+    let message = AuthenticatedMessage::parse(raw_message)
+        .ok_or_else(|| SecurityError::Parse("Failed to parse email for DKIM verification".into()))?;
+
+    let dkim_outputs = authenticator.verify_dkim(&message).await;
+    Ok(dkim_outputs_to_results(&dkim_outputs))
+}
+
+/// Sign a raw email message with DKIM (RSA-SHA256).
+///
+/// * `raw_message` - The raw RFC 5322 message bytes
+/// * `domain` - The signing domain (d= tag)
+/// * `selector` - The DKIM selector (s= tag)
+/// * `private_key_pem` - RSA private key in PEM format (PKCS#1 or PKCS#8)
+///
+/// Returns the DKIM-Signature header string to prepend to the message.
+pub fn sign_dkim(
+    raw_message: &[u8],
+    domain: &str,
+    selector: &str,
+    private_key_pem: &str,
+) -> Result<String> {
+    // Try PKCS#1 PEM first, then PKCS#8
+    let key_der = PrivatePkcs1KeyDer::from_pem_slice(private_key_pem.as_bytes())
+        .map(PrivateKeyDer::Pkcs1)
+        .or_else(|_| {
+            // Try PKCS#8
+            rustls_pki_types::PrivatePkcs8KeyDer::from_pem_slice(private_key_pem.as_bytes())
+                .map(PrivateKeyDer::Pkcs8)
+        })
+        .map_err(|e| SecurityError::Key(format!("Failed to parse private key PEM: {}", e)))?;
+
+    let rsa_key = RsaKey::<Sha256>::from_key_der(key_der)
+        .map_err(|e| SecurityError::Key(format!("Failed to load RSA key: {}", e)))?;
+
+    let signature = DkimSigner::from_key(rsa_key)
+        .domain(domain)
+        .selector(selector)
+        .headers(["From", "To", "Subject", "Date", "Message-ID", "MIME-Version", "Content-Type"])
+        .header_canonicalization(Canonicalization::Relaxed)
+        .body_canonicalization(Canonicalization::Relaxed)
+        .sign(raw_message)
+        .map_err(|e| SecurityError::Dkim(format!("DKIM signing failed: {}", e)))?;
+
+    Ok(signature.to_header())
+}
+
+/// Generate a DKIM DNS TXT record value for a given public key.
+///
+/// Returns the value for a TXT record at `{selector}._domainkey.{domain}`.
+pub fn dkim_dns_record_value(public_key_pem: &str) -> String {
+    // Extract the base64 content from PEM
+    let key_b64: String = public_key_pem
+        .lines()
+        .filter(|line| !line.starts_with("-----"))
+        .collect::<Vec<_>>()
+        .join("");
+
+    format!("v=DKIM1; h=sha256; k=rsa; p={}", key_b64)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_dkim_dns_record_value() {
+        let pem = "-----BEGIN PUBLIC KEY-----\nMIIBIjANBg==\n-----END PUBLIC KEY-----";
+        let record = dkim_dns_record_value(pem);
+        assert!(record.starts_with("v=DKIM1; h=sha256; k=rsa; p="));
+        assert!(record.contains("MIIBIjANBg=="));
+    }
+
+    #[test]
+    fn test_sign_dkim_invalid_key() {
+        let result = sign_dkim(b"From: test@example.com\r\n\r\nBody", "example.com", "mta", "not a key");
+        assert!(result.is_err());
+    }
+}

rust/crates/mailer-security/src/dmarc.rs

@@ -0,0 +1,127 @@
+use mail_auth::dmarc::verify::DmarcParameters;
+use mail_auth::dmarc::Policy;
+use mail_auth::{
+    AuthenticatedMessage, DkimOutput, DmarcResult as MailAuthDmarcResult, MessageAuthenticator,
+    SpfOutput,
+};
+use serde::{Deserialize, Serialize};
+
+use crate::error::{Result, SecurityError};
+
+/// DMARC policy.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum DmarcPolicy {
+    None,
+    Quarantine,
+    Reject,
+}
+
+impl From<Policy> for DmarcPolicy {
+    fn from(p: Policy) -> Self {
+        match p {
+            Policy::None | Policy::Unspecified => DmarcPolicy::None,
+            Policy::Quarantine => DmarcPolicy::Quarantine,
+            Policy::Reject => DmarcPolicy::Reject,
+        }
+    }
+}
+
+/// DMARC verification result.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DmarcResult {
+    /// Whether DMARC verification passed overall.
+    pub passed: bool,
+    /// The evaluated policy.
+    pub policy: DmarcPolicy,
+    /// The domain that was checked.
+    pub domain: String,
+    /// DKIM alignment result: "pass", "fail", etc.
+    pub dkim_result: String,
+    /// SPF alignment result: "pass", "fail", etc.
+    pub spf_result: String,
+    /// Recommended action: "pass", "quarantine", "reject".
+    pub action: String,
+    /// Human-readable details.
+    pub details: Option<String>,
+}
+
+/// Check DMARC for an email, given prior DKIM and SPF results.
+///
+/// * `raw_message` - The raw RFC 5322 message bytes
+/// * `dkim_output` - DKIM verification results from `verify_dkim`
+/// * `spf_output` - SPF verification output from `check_spf`
+/// * `mail_from_domain` - The MAIL FROM domain (RFC 5321)
+/// * `authenticator` - The MessageAuthenticator for DNS lookups
+pub async fn check_dmarc<'x>(
+    raw_message: &'x [u8],
+    dkim_output: &'x [DkimOutput<'x>],
+    spf_output: &'x SpfOutput,
+    mail_from_domain: &'x str,
+    authenticator: &MessageAuthenticator,
+) -> Result<DmarcResult> {
+    let message = AuthenticatedMessage::parse(raw_message)
+        .ok_or_else(|| SecurityError::Parse("Failed to parse email for DMARC check".into()))?;
+
+    let dmarc_output = authenticator
+        .verify_dmarc(
+            DmarcParameters::new(&message, dkim_output, mail_from_domain, spf_output)
+                .with_domain_suffix_fn(|domain| psl::domain_str(domain).unwrap_or(domain)),
+        )
+        .await;
+
+    let policy = DmarcPolicy::from(dmarc_output.policy());
+    let domain = dmarc_output.domain().to_string();
+
+    let dkim_result_str = dmarc_result_to_string(dmarc_output.dkim_result());
+    let spf_result_str = dmarc_result_to_string(dmarc_output.spf_result());
+
+    let dkim_passed = matches!(dmarc_output.dkim_result(), MailAuthDmarcResult::Pass);
+    let spf_passed = matches!(dmarc_output.spf_result(), MailAuthDmarcResult::Pass);
+    let passed = dkim_passed || spf_passed;
+
+    let action = if passed {
+        "pass".to_string()
+    } else {
+        match policy {
+            DmarcPolicy::None => "pass".to_string(), // p=none means monitor only
+            DmarcPolicy::Quarantine => "quarantine".to_string(),
+            DmarcPolicy::Reject => "reject".to_string(),
+        }
+    };
+
+    Ok(DmarcResult {
+        passed,
+        policy,
+        domain,
+        dkim_result: dkim_result_str,
+        spf_result: spf_result_str,
+        action,
+        details: None,
+    })
+}
+
+fn dmarc_result_to_string(result: &MailAuthDmarcResult) -> String {
+    match result {
+        MailAuthDmarcResult::Pass => "pass".to_string(),
+        MailAuthDmarcResult::Fail(err) => format!("fail: {}", err),
+        MailAuthDmarcResult::TempError(err) => format!("temperror: {}", err),
+        MailAuthDmarcResult::PermError(err) => format!("permerror: {}", err),
+        MailAuthDmarcResult::None => "none".to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_dmarc_policy_from() {
+        assert_eq!(DmarcPolicy::from(Policy::None), DmarcPolicy::None);
+        assert_eq!(
+            DmarcPolicy::from(Policy::Quarantine),
+            DmarcPolicy::Quarantine
+        );
+        assert_eq!(DmarcPolicy::from(Policy::Reject), DmarcPolicy::Reject);
+    }
+}

rust/crates/mailer-security/src/error.rs

@@ -0,0 +1,31 @@
+use thiserror::Error;
+
+/// Security-related error types.
+#[derive(Debug, Error)]
+pub enum SecurityError {
+    #[error("DKIM error: {0}")]
+    Dkim(String),
+
+    #[error("SPF error: {0}")]
+    Spf(String),
+
+    #[error("DMARC error: {0}")]
+    Dmarc(String),
+
+    #[error("DNS resolution error: {0}")]
+    Dns(String),
+
+    #[error("key error: {0}")]
+    Key(String),
+
+    #[error("IP reputation error: {0}")]
+    IpReputation(String),
+
+    #[error("parse error: {0}")]
+    Parse(String),
+
+    #[error("IO error: {0}")]
+    Io(#[from] std::io::Error),
+}
+
+pub type Result<T> = std::result::Result<T, SecurityError>;

rust/crates/mailer-security/src/ip_reputation.rs

@@ -0,0 +1,280 @@
+use hickory_resolver::TokioResolver;
+use serde::{Deserialize, Serialize};
+use std::net::{IpAddr, Ipv4Addr};
+
+use crate::error::Result;
+
+/// Default DNSBL servers to check, same as the TypeScript IPReputationChecker.
+pub const DEFAULT_DNSBL_SERVERS: &[&str] = &[
+    "zen.spamhaus.org",
+    "bl.spamcop.net",
+    "b.barracudacentral.org",
+    "spam.dnsbl.sorbs.net",
+    "dnsbl.sorbs.net",
+    "cbl.abuseat.org",
+    "xbl.spamhaus.org",
+    "pbl.spamhaus.org",
+    "dnsbl-1.uceprotect.net",
+    "psbl.surriel.com",
+];
+
+/// Result of a DNSBL check.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct DnsblResult {
+    /// IP address that was checked.
+    pub ip: String,
+    /// Number of DNSBL servers that list this IP.
+    pub listed_count: usize,
+    /// Names of DNSBL servers that list this IP.
+    pub listed_on: Vec<String>,
+    /// Total number of DNSBL servers checked.
+    pub total_checked: usize,
+}
+
+/// Result of a full IP reputation check.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct ReputationResult {
+    /// Reputation score: 0 (worst) to 100 (best).
+    pub score: u8,
+    /// Whether the IP is considered spam source.
+    pub is_spam: bool,
+    /// IP address that was checked.
+    pub ip: String,
+    /// DNSBL results.
+    pub dnsbl: DnsblResult,
+    /// Heuristic IP type classification.
+    pub ip_type: IpType,
+}
+
+/// Heuristic IP type classification.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum IpType {
+    Residential,
+    Datacenter,
+    Proxy,
+    Tor,
+    Vpn,
+    Unknown,
+}
+
+/// Risk level based on reputation score.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum RiskLevel {
+    /// Score < 20
+    High,
+    /// Score 20-49
+    Medium,
+    /// Score 50-79
+    Low,
+    /// Score >= 80
+    Trusted,
+}
+
+/// Get the risk level for a reputation score.
+pub fn risk_level(score: u8) -> RiskLevel {
+    match score {
+        0..=19 => RiskLevel::High,
+        20..=49 => RiskLevel::Medium,
+        50..=79 => RiskLevel::Low,
+        _ => RiskLevel::Trusted,
+    }
+}
+
+/// Check an IP against DNSBL servers.
+///
+/// * `ip` - The IP address to check (must be IPv4)
+/// * `dnsbl_servers` - DNSBL servers to query (use `DEFAULT_DNSBL_SERVERS` for defaults)
+/// * `resolver` - DNS resolver to use
+pub async fn check_dnsbl(
+    ip: IpAddr,
+    dnsbl_servers: &[&str],
+    resolver: &TokioResolver,
+) -> Result<DnsblResult> {
+    let ipv4 = match ip {
+        IpAddr::V4(v4) => v4,
+        IpAddr::V6(_) => {
+            // IPv6 DNSBL is less common; return clean result
+            return Ok(DnsblResult {
+                ip: ip.to_string(),
+                listed_count: 0,
+                listed_on: Vec::new(),
+                total_checked: 0,
+            });
+        }
+    };
+
+    let reversed = reverse_ipv4(ipv4);
+    let total = dnsbl_servers.len();
+
+    // Query all DNSBL servers in parallel
+    let mut handles = Vec::with_capacity(total);
+    for &server in dnsbl_servers {
+        let query = format!("{}.{}", reversed, server);
+        let resolver = resolver.clone();
+        let server_name = server.to_string();
+        handles.push(tokio::spawn(async move {
+            match resolver.lookup_ip(&query).await {
+                Ok(_) => Some(server_name), // IP is listed
+                Err(_) => None,             // IP is not listed (NXDOMAIN)
+            }
+        }));
+    }
+
+    let mut listed_on = Vec::new();
+    for handle in handles {
+        match handle.await {
+            Ok(Some(server)) => listed_on.push(server),
+            _ => {}
+        }
+    }
+
+    Ok(DnsblResult {
+        ip: ip.to_string(),
+        listed_count: listed_on.len(),
+        listed_on,
+        total_checked: total,
+    })
+}
+
+/// Full IP reputation check: DNSBL + heuristic classification + scoring.
+pub async fn check_reputation(
+    ip: IpAddr,
+    dnsbl_servers: &[&str],
+    resolver: &TokioResolver,
+) -> Result<ReputationResult> {
+    let dnsbl = check_dnsbl(ip, dnsbl_servers, resolver).await?;
+    let ip_type = classify_ip(ip);
+
+    // Scoring: start at 100
+    let mut score: i16 = 100;
+
+    // Subtract 10 per DNSBL listing
+    score -= (dnsbl.listed_count as i16) * 10;
+
+    // Subtract 30 for suspicious IP types
+    match ip_type {
+        IpType::Proxy | IpType::Tor | IpType::Vpn => {
+            score -= 30;
+        }
+        _ => {}
+    }
+
+    let score = score.clamp(0, 100) as u8;
+    let is_spam = score < 50;
+
+    Ok(ReputationResult {
+        score,
+        is_spam,
+        ip: ip.to_string(),
+        dnsbl,
+        ip_type,
+    })
+}
+
+/// Reverse IPv4 octets for DNSBL queries: "1.2.3.4" -> "4.3.2.1".
+fn reverse_ipv4(ip: Ipv4Addr) -> String {
+    let octets = ip.octets();
+    format!("{}.{}.{}.{}", octets[3], octets[2], octets[1], octets[0])
+}
+
+/// Heuristic IP type classification based on well-known prefix ranges.
+/// Same heuristics as the TypeScript IPReputationChecker.
+fn classify_ip(ip: IpAddr) -> IpType {
+    let ip_str = ip.to_string();
+
+    // Known Tor exit node prefixes
+    if ip_str.starts_with("171.25.")
+        || ip_str.starts_with("185.220.")
+        || ip_str.starts_with("95.216.")
+    {
+        return IpType::Tor;
+    }
+
+    // Known VPN provider prefixes
+    if ip_str.starts_with("185.156.") || ip_str.starts_with("37.120.") {
+        return IpType::Vpn;
+    }
+
+    // Known proxy prefixes
+    if ip_str.starts_with("34.92.") || ip_str.starts_with("34.206.") {
+        return IpType::Proxy;
+    }
+
+    // Major cloud provider prefixes (datacenter)
+    if ip_str.starts_with("13.")
+        || ip_str.starts_with("35.")
+        || ip_str.starts_with("52.")
+        || ip_str.starts_with("34.")
+        || ip_str.starts_with("104.")
+    {
+        return IpType::Datacenter;
+    }
+
+    IpType::Residential
+}
+
+/// Validate an IPv4 address string.
+pub fn is_valid_ipv4(ip: &str) -> bool {
+    ip.parse::<Ipv4Addr>().is_ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_reverse_ipv4() {
+        let ip: Ipv4Addr = "1.2.3.4".parse().unwrap();
+        assert_eq!(reverse_ipv4(ip), "4.3.2.1");
+
+        let ip: Ipv4Addr = "192.168.1.100".parse().unwrap();
+        assert_eq!(reverse_ipv4(ip), "100.1.168.192");
+    }
+
+    #[test]
+    fn test_classify_ip() {
+        assert_eq!(
+            classify_ip("171.25.193.20".parse().unwrap()),
+            IpType::Tor
+        );
+        assert_eq!(
+            classify_ip("185.156.73.1".parse().unwrap()),
+            IpType::Vpn
+        );
+        assert_eq!(
+            classify_ip("34.92.1.1".parse().unwrap()),
+            IpType::Proxy
+        );
+        assert_eq!(
+            classify_ip("52.0.0.1".parse().unwrap()),
+            IpType::Datacenter
+        );
+        assert_eq!(
+            classify_ip("203.0.113.1".parse().unwrap()),
+            IpType::Residential
+        );
+    }
+
+    #[test]
+    fn test_risk_level() {
+        assert_eq!(risk_level(10), RiskLevel::High);
+        assert_eq!(risk_level(30), RiskLevel::Medium);
+        assert_eq!(risk_level(60), RiskLevel::Low);
+        assert_eq!(risk_level(90), RiskLevel::Trusted);
+    }
+
+    #[test]
+    fn test_is_valid_ipv4() {
+        assert!(is_valid_ipv4("1.2.3.4"));
+        assert!(is_valid_ipv4("255.255.255.255"));
+        assert!(!is_valid_ipv4("999.999.999.999"));
+        assert!(!is_valid_ipv4("not-an-ip"));
+    }
+
+    #[test]
+    fn test_default_dnsbl_servers() {
+        assert_eq!(DEFAULT_DNSBL_SERVERS.len(), 10);
+        assert!(DEFAULT_DNSBL_SERVERS.contains(&"zen.spamhaus.org"));
+    }
+}

rust/crates/mailer-security/src/lib.rs

@@ -1,12 +1,39 @@
-//! mailer-security: DKIM, SPF, and DMARC verification.
+//! mailer-security: DKIM, SPF, DMARC verification, and IP reputation checking.
+
+pub mod content_scanner;
+pub mod dkim;
+pub mod dmarc;
+pub mod error;
+pub mod ip_reputation;
+pub mod spf;
+pub mod verify;
+
+// Re-exports for convenience
+pub use dkim::{dkim_dns_record_value, dkim_outputs_to_results, sign_dkim, verify_dkim, DkimVerificationResult};
+pub use dmarc::{check_dmarc, DmarcPolicy, DmarcResult};
+pub use verify::{verify_email_security, EmailSecurityResult};
+pub use error::{Result, SecurityError};
+pub use ip_reputation::{
+    check_dnsbl, check_reputation, risk_level, DnsblResult, IpType, ReputationResult, RiskLevel,
+    DEFAULT_DNSBL_SERVERS,
+};
+pub use spf::{check_spf, check_spf_ehlo, received_spf_header, SpfResult};
+
+// Re-export mail-auth's MessageAuthenticator for callers to construct
+pub use mail_auth::MessageAuthenticator;
 
 pub use mailer_core;
 
-/// Placeholder for DKIM/SPF/DMARC implementation.
+/// Crate version.
 pub fn version() -> &'static str {
     env!("CARGO_PKG_VERSION")
 }
 
+/// Create a MessageAuthenticator using Cloudflare DNS over TLS.
+pub fn default_authenticator() -> std::result::Result<MessageAuthenticator, Box<dyn std::error::Error>> {
+    Ok(MessageAuthenticator::new_cloudflare_tls()?)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;

rust/crates/mailer-security/src/spf.rs

@@ -0,0 +1,167 @@
+use mail_auth::spf::verify::SpfParameters;
+use mail_auth::{MessageAuthenticator, SpfResult as MailAuthSpfResult};
+use serde::{Deserialize, Serialize};
+use std::net::IpAddr;
+
+use crate::error::Result;
+
+/// SPF verification result.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SpfResult {
+    /// The SPF result: "pass", "fail", "softfail", "neutral", "temperror", "permerror", "none".
+    pub result: String,
+    /// The domain that was checked.
+    pub domain: String,
+    /// The IP address that was checked.
+    pub ip: String,
+    /// Optional explanation string from the SPF record.
+    pub explanation: Option<String>,
+}
+
+impl SpfResult {
+    /// Whether the SPF check passed.
+    pub fn passed(&self) -> bool {
+        self.result == "pass"
+    }
+
+    /// Create an `SpfResult` from a raw `mail-auth` `SpfOutput`.
+    ///
+    /// Used by the compound `verify_email_security` to avoid re-doing the SPF query.
+    pub fn from_output(output: &mail_auth::SpfOutput, ip: IpAddr) -> Self {
+        let result_str = match output.result() {
+            MailAuthSpfResult::Pass => "pass",
+            MailAuthSpfResult::Fail => "fail",
+            MailAuthSpfResult::SoftFail => "softfail",
+            MailAuthSpfResult::Neutral => "neutral",
+            MailAuthSpfResult::TempError => "temperror",
+            MailAuthSpfResult::PermError => "permerror",
+            MailAuthSpfResult::None => "none",
+        };
+
+        SpfResult {
+            result: result_str.to_string(),
+            domain: output.domain().to_string(),
+            ip: ip.to_string(),
+            explanation: output.explanation().map(|s| s.to_string()),
+        }
+    }
+}
+
+/// Check SPF for a given sender IP, HELO domain, and MAIL FROM address.
+///
+/// * `ip` - The connecting client's IP address
+/// * `helo_domain` - The domain from the SMTP EHLO/HELO command
+/// * `host_domain` - Your receiving server's hostname
+/// * `mail_from` - The full MAIL FROM address (e.g., "sender@example.com")
+pub async fn check_spf(
+    ip: IpAddr,
+    helo_domain: &str,
+    host_domain: &str,
+    mail_from: &str,
+    authenticator: &MessageAuthenticator,
+) -> Result<SpfResult> {
+    let output = authenticator
+        .verify_spf(SpfParameters::verify_mail_from(
+            ip,
+            helo_domain,
+            host_domain,
+            mail_from,
+        ))
+        .await;
+
+    let result_str = match output.result() {
+        MailAuthSpfResult::Pass => "pass",
+        MailAuthSpfResult::Fail => "fail",
+        MailAuthSpfResult::SoftFail => "softfail",
+        MailAuthSpfResult::Neutral => "neutral",
+        MailAuthSpfResult::TempError => "temperror",
+        MailAuthSpfResult::PermError => "permerror",
+        MailAuthSpfResult::None => "none",
+    };
+
+    Ok(SpfResult {
+        result: result_str.to_string(),
+        domain: output.domain().to_string(),
+        ip: ip.to_string(),
+        explanation: output.explanation().map(|s| s.to_string()),
+    })
+}
+
+/// Check SPF for the EHLO identity (before MAIL FROM).
+pub async fn check_spf_ehlo(
+    ip: IpAddr,
+    helo_domain: &str,
+    host_domain: &str,
+    authenticator: &MessageAuthenticator,
+) -> Result<SpfResult> {
+    let output = authenticator
+        .verify_spf(SpfParameters::verify_ehlo(ip, helo_domain, host_domain))
+        .await;
+
+    let result_str = match output.result() {
+        MailAuthSpfResult::Pass => "pass",
+        MailAuthSpfResult::Fail => "fail",
+        MailAuthSpfResult::SoftFail => "softfail",
+        MailAuthSpfResult::Neutral => "neutral",
+        MailAuthSpfResult::TempError => "temperror",
+        MailAuthSpfResult::PermError => "permerror",
+        MailAuthSpfResult::None => "none",
+    };
+
+    Ok(SpfResult {
+        result: result_str.to_string(),
+        domain: helo_domain.to_string(),
+        ip: ip.to_string(),
+        explanation: output.explanation().map(|s| s.to_string()),
+    })
+}
+
+/// Build a Received-SPF header value.
+pub fn received_spf_header(result: &SpfResult) -> String {
+    format!(
+        "{} (domain of {} designates {} as permitted sender) receiver={}; client-ip={};",
+        result.result,
+        result.domain,
+        result.ip,
+        result.domain,
+        result.ip,
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_spf_result_passed() {
+        let result = SpfResult {
+            result: "pass".to_string(),
+            domain: "example.com".to_string(),
+            ip: "1.2.3.4".to_string(),
+            explanation: None,
+        };
+        assert!(result.passed());
+
+        let result = SpfResult {
+            result: "fail".to_string(),
+            domain: "example.com".to_string(),
+            ip: "1.2.3.4".to_string(),
+            explanation: None,
+        };
+        assert!(!result.passed());
+    }
+
+    #[test]
+    fn test_received_spf_header() {
+        let result = SpfResult {
+            result: "pass".to_string(),
+            domain: "example.com".to_string(),
+            ip: "1.2.3.4".to_string(),
+            explanation: None,
+        };
+        let header = received_spf_header(&result);
+        assert!(header.contains("pass"));
+        assert!(header.contains("example.com"));
+        assert!(header.contains("1.2.3.4"));
+    }
+}

rust/crates/mailer-security/src/verify.rs

@@ -0,0 +1,115 @@
+//! Compound email security verification.
+//!
+//! Runs DKIM, SPF, and DMARC verification in a single call, avoiding multiple
+//! IPC round-trips and handling the internal `mail-auth` types that DMARC needs.
+
+use mail_auth::spf::verify::SpfParameters;
+use mail_auth::{AuthenticatedMessage, MessageAuthenticator};
+use serde::{Deserialize, Serialize};
+use std::net::IpAddr;
+
+use crate::dkim::DkimVerificationResult;
+use crate::dmarc::{check_dmarc, DmarcResult};
+use crate::error::{Result, SecurityError};
+use crate::spf::SpfResult;
+
+/// Combined result of DKIM + SPF + DMARC verification.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct EmailSecurityResult {
+    pub dkim: Vec<DkimVerificationResult>,
+    pub spf: Option<SpfResult>,
+    pub dmarc: Option<DmarcResult>,
+}
+
+/// Run all email security checks (DKIM, SPF, DMARC) in one call.
+///
+/// This is the preferred entry point for inbound email verification because:
+/// 1. DMARC requires raw `mail-auth` DKIM/SPF outputs (not our serialized types).
+/// 2. A single call avoids 3 sequential IPC round-trips.
+///
+/// # Arguments
+/// * `raw_message` - The raw RFC 5322 message bytes
+/// * `ip` - The connecting client's IP address
+/// * `helo_domain` - The domain from the SMTP EHLO/HELO command
+/// * `host_domain` - Your receiving server's hostname
+/// * `mail_from` - The full MAIL FROM address (e.g. "sender@example.com")
+/// * `authenticator` - The `MessageAuthenticator` for DNS lookups
+pub async fn verify_email_security(
+    raw_message: &[u8],
+    ip: IpAddr,
+    helo_domain: &str,
+    host_domain: &str,
+    mail_from: &str,
+    authenticator: &MessageAuthenticator,
+) -> Result<EmailSecurityResult> {
+    // Parse the message once for all checks
+    let message = AuthenticatedMessage::parse(raw_message)
+        .ok_or_else(|| SecurityError::Parse("Failed to parse email message".into()))?;
+
+    // --- DKIM verification ---
+    let dkim_outputs = authenticator.verify_dkim(&message).await;
+    let dkim_results = crate::dkim::dkim_outputs_to_results(&dkim_outputs);
+
+    // --- SPF verification ---
+    let spf_output = authenticator
+        .verify_spf(SpfParameters::verify_mail_from(
+            ip,
+            helo_domain,
+            host_domain,
+            mail_from,
+        ))
+        .await;
+
+    let spf_result = SpfResult::from_output(&spf_output, ip);
+
+    // --- DMARC verification (needs raw dkim_outputs + spf_output) ---
+    let mail_from_domain = mail_from
+        .rsplit_once('@')
+        .map(|(_, d)| d)
+        .unwrap_or(helo_domain);
+
+    let dmarc_result = check_dmarc(
+        raw_message,
+        &dkim_outputs,
+        &spf_output,
+        mail_from_domain,
+        authenticator,
+    )
+    .await
+    .ok(); // DMARC failure is non-fatal; we still return DKIM + SPF results
+
+    Ok(EmailSecurityResult {
+        dkim: dkim_results,
+        spf: Some(spf_result),
+        dmarc: dmarc_result,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_email_security_result_serialization() {
+        let result = EmailSecurityResult {
+            dkim: vec![DkimVerificationResult {
+                is_valid: false,
+                domain: None,
+                selector: None,
+                status: "none".to_string(),
+                details: Some("No DKIM signatures".to_string()),
+            }],
+            spf: Some(SpfResult {
+                result: "none".to_string(),
+                domain: "example.com".to_string(),
+                ip: "1.2.3.4".to_string(),
+                explanation: None,
+            }),
+            dmarc: None,
+        };
+        let json = serde_json::to_string(&result).unwrap();
+        assert!(json.contains("\"dkim\""));
+        assert!(json.contains("\"spf\""));
+        assert!(json.contains("\"dmarc\":null"));
+    }
+}

rust/crates/mailer-smtp/Cargo.toml

@@ -6,6 +6,7 @@ license.workspace = true
 
 [dependencies]
 mailer-core = { path = "../mailer-core" }
+mailer-security = { path = "../mailer-security" }
 tokio.workspace = true
 tokio-rustls.workspace = true
 hickory-resolver.workspace = true
@@ -14,3 +15,10 @@ thiserror.workspace = true
 tracing.workspace = true
 bytes.workspace = true
 serde.workspace = true
+serde_json = "1"
+regex = "1"
+uuid = { version = "1", features = ["v4"] }
+base64.workspace = true
+rustls-pki-types.workspace = true
+rustls = { version = "0.23", default-features = false, features = ["ring", "logging", "std", "tls12"] }
+rustls-pemfile = "2"

rust/crates/mailer-smtp/src/command.rs

@@ -0,0 +1,421 @@
+//! SMTP command parser.
+//!
+//! Parses raw SMTP command lines into structured `SmtpCommand` variants.
+
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+/// A parsed SMTP command.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum SmtpCommand {
+    /// EHLO with client hostname/IP
+    Ehlo(String),
+    /// HELO with client hostname/IP
+    Helo(String),
+    /// MAIL FROM with sender address and optional parameters (e.g. SIZE=12345)
+    MailFrom {
+        address: String,
+        params: HashMap<String, Option<String>>,
+    },
+    /// RCPT TO with recipient address and optional parameters
+    RcptTo {
+        address: String,
+        params: HashMap<String, Option<String>>,
+    },
+    /// DATA command — begin message body
+    Data,
+    /// RSET — reset current transaction
+    Rset,
+    /// NOOP — no operation
+    Noop,
+    /// QUIT — close connection
+    Quit,
+    /// STARTTLS — upgrade to TLS
+    StartTls,
+    /// AUTH with mechanism and optional initial response
+    Auth {
+        mechanism: AuthMechanism,
+        initial_response: Option<String>,
+    },
+    /// HELP with optional topic
+    Help(Option<String>),
+    /// VRFY with address or username
+    Vrfy(String),
+    /// EXPN with mailing list name
+    Expn(String),
+}
+
+/// Supported AUTH mechanisms.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum AuthMechanism {
+    Plain,
+    Login,
+}
+
+/// Errors that can occur during command parsing.
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum ParseError {
+    #[error("empty command line")]
+    Empty,
+    #[error("unrecognized command: {0}")]
+    UnrecognizedCommand(String),
+    #[error("syntax error in parameters: {0}")]
+    SyntaxError(String),
+    #[error("missing required argument for {0}")]
+    MissingArgument(String),
+}
+
+/// Parse a raw SMTP command line (without trailing CRLF) into a `SmtpCommand`.
+pub fn parse_command(line: &str) -> Result<SmtpCommand, ParseError> {
+    let line = line.trim_end_matches('\r').trim_end_matches('\n');
+    if line.is_empty() {
+        return Err(ParseError::Empty);
+    }
+
+    // Split into verb and the rest
+    let (verb, rest) = split_first_word(line);
+    let verb_upper = verb.to_ascii_uppercase();
+
+    match verb_upper.as_str() {
+        "EHLO" => {
+            let hostname = rest.trim();
+            if hostname.is_empty() {
+                return Err(ParseError::MissingArgument("EHLO".into()));
+            }
+            Ok(SmtpCommand::Ehlo(hostname.to_string()))
+        }
+        "HELO" => {
+            let hostname = rest.trim();
+            if hostname.is_empty() {
+                return Err(ParseError::MissingArgument("HELO".into()));
+            }
+            Ok(SmtpCommand::Helo(hostname.to_string()))
+        }
+        "MAIL" => parse_mail_from(rest),
+        "RCPT" => parse_rcpt_to(rest),
+        "DATA" => Ok(SmtpCommand::Data),
+        "RSET" => Ok(SmtpCommand::Rset),
+        "NOOP" => Ok(SmtpCommand::Noop),
+        "QUIT" => Ok(SmtpCommand::Quit),
+        "STARTTLS" => Ok(SmtpCommand::StartTls),
+        "AUTH" => parse_auth(rest),
+        "HELP" => {
+            let topic = rest.trim();
+            if topic.is_empty() {
+                Ok(SmtpCommand::Help(None))
+            } else {
+                Ok(SmtpCommand::Help(Some(topic.to_string())))
+            }
+        }
+        "VRFY" => {
+            let arg = rest.trim();
+            if arg.is_empty() {
+                return Err(ParseError::MissingArgument("VRFY".into()));
+            }
+            Ok(SmtpCommand::Vrfy(arg.to_string()))
+        }
+        "EXPN" => {
+            let arg = rest.trim();
+            if arg.is_empty() {
+                return Err(ParseError::MissingArgument("EXPN".into()));
+            }
+            Ok(SmtpCommand::Expn(arg.to_string()))
+        }
+        _ => Err(ParseError::UnrecognizedCommand(verb_upper)),
+    }
+}
+
+/// Parse `FROM:<addr> [PARAM=VALUE ...]` after "MAIL".
+fn parse_mail_from(rest: &str) -> Result<SmtpCommand, ParseError> {
+    // Expect "FROM:" prefix (case-insensitive, whitespace-flexible)
+    let rest = rest.trim_start();
+    let rest_upper = rest.to_ascii_uppercase();
+    if !rest_upper.starts_with("FROM") {
+        return Err(ParseError::SyntaxError(
+            "expected FROM after MAIL".into(),
+        ));
+    }
+    let rest = &rest[4..]; // skip "FROM"
+    let rest = rest.trim_start();
+    if !rest.starts_with(':') {
+        return Err(ParseError::SyntaxError(
+            "expected colon after MAIL FROM".into(),
+        ));
+    }
+    let rest = &rest[1..]; // skip ':'
+    let rest = rest.trim_start();
+
+    parse_address_and_params(rest, "MAIL FROM").map(|(address, params)| SmtpCommand::MailFrom {
+        address,
+        params,
+    })
+}
+
+/// Parse `TO:<addr> [PARAM=VALUE ...]` after "RCPT".
+fn parse_rcpt_to(rest: &str) -> Result<SmtpCommand, ParseError> {
+    let rest = rest.trim_start();
+    let rest_upper = rest.to_ascii_uppercase();
+    if !rest_upper.starts_with("TO") {
+        return Err(ParseError::SyntaxError("expected TO after RCPT".into()));
+    }
+    let rest = &rest[2..]; // skip "TO"
+    let rest = rest.trim_start();
+    if !rest.starts_with(':') {
+        return Err(ParseError::SyntaxError(
+            "expected colon after RCPT TO".into(),
+        ));
+    }
+    let rest = &rest[1..]; // skip ':'
+    let rest = rest.trim_start();
+
+    parse_address_and_params(rest, "RCPT TO").map(|(address, params)| SmtpCommand::RcptTo {
+        address,
+        params,
+    })
+}
+
+/// Parse `<address> [PARAM=VALUE ...]` from the rest of a MAIL FROM or RCPT TO line.
+fn parse_address_and_params(
+    input: &str,
+    context: &str,
+) -> Result<(String, HashMap<String, Option<String>>), ParseError> {
+    if !input.starts_with('<') {
+        return Err(ParseError::SyntaxError(format!(
+            "expected '<' in {context}"
+        )));
+    }
+    let close_bracket = input.find('>').ok_or_else(|| {
+        ParseError::SyntaxError(format!("missing '>' in {context}"))
+    })?;
+    let address = input[1..close_bracket].to_string();
+    let remainder = &input[close_bracket + 1..];
+    let params = parse_params(remainder)?;
+    Ok((address, params))
+}
+
+/// Parse SMTP extension parameters like `SIZE=12345 BODY=8BITMIME`.
+fn parse_params(input: &str) -> Result<HashMap<String, Option<String>>, ParseError> {
+    let mut params = HashMap::new();
+    for token in input.split_whitespace() {
+        if let Some(eq_pos) = token.find('=') {
+            let key = token[..eq_pos].to_ascii_uppercase();
+            let value = token[eq_pos + 1..].to_string();
+            params.insert(key, Some(value));
+        } else {
+            params.insert(token.to_ascii_uppercase(), None);
+        }
+    }
+    Ok(params)
+}
+
+/// Parse AUTH command: `AUTH <mechanism> [initial-response]`.
+fn parse_auth(rest: &str) -> Result<SmtpCommand, ParseError> {
+    let rest = rest.trim();
+    if rest.is_empty() {
+        return Err(ParseError::MissingArgument("AUTH".into()));
+    }
+    let (mech_str, initial) = split_first_word(rest);
+    let mechanism = match mech_str.to_ascii_uppercase().as_str() {
+        "PLAIN" => AuthMechanism::Plain,
+        "LOGIN" => AuthMechanism::Login,
+        other => {
+            return Err(ParseError::SyntaxError(format!(
+                "unsupported AUTH mechanism: {other}"
+            )));
+        }
+    };
+    let initial_response = {
+        let s = initial.trim();
+        if s.is_empty() { None } else { Some(s.to_string()) }
+    };
+    Ok(SmtpCommand::Auth {
+        mechanism,
+        initial_response,
+    })
+}
+
+/// Split a string into the first whitespace-delimited word and the remainder.
+fn split_first_word(s: &str) -> (&str, &str) {
+    match s.find(char::is_whitespace) {
+        Some(pos) => (&s[..pos], &s[pos + 1..]),
+        None => (s, ""),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_ehlo() {
+        let cmd = parse_command("EHLO mail.example.com").unwrap();
+        assert_eq!(cmd, SmtpCommand::Ehlo("mail.example.com".into()));
+    }
+
+    #[test]
+    fn test_ehlo_case_insensitive() {
+        let cmd = parse_command("ehlo MAIL.EXAMPLE.COM").unwrap();
+        assert_eq!(cmd, SmtpCommand::Ehlo("MAIL.EXAMPLE.COM".into()));
+    }
+
+    #[test]
+    fn test_helo() {
+        let cmd = parse_command("HELO example.com").unwrap();
+        assert_eq!(cmd, SmtpCommand::Helo("example.com".into()));
+    }
+
+    #[test]
+    fn test_ehlo_missing_arg() {
+        let err = parse_command("EHLO").unwrap_err();
+        assert!(matches!(err, ParseError::MissingArgument(_)));
+    }
+
+    #[test]
+    fn test_mail_from() {
+        let cmd = parse_command("MAIL FROM:<sender@example.com>").unwrap();
+        assert_eq!(
+            cmd,
+            SmtpCommand::MailFrom {
+                address: "sender@example.com".into(),
+                params: HashMap::new(),
+            }
+        );
+    }
+
+    #[test]
+    fn test_mail_from_with_params() {
+        let cmd = parse_command("MAIL FROM:<sender@example.com> SIZE=12345 BODY=8BITMIME").unwrap();
+        if let SmtpCommand::MailFrom { address, params } = cmd {
+            assert_eq!(address, "sender@example.com");
+            assert_eq!(params.get("SIZE"), Some(&Some("12345".into())));
+            assert_eq!(params.get("BODY"), Some(&Some("8BITMIME".into())));
+        } else {
+            panic!("expected MailFrom");
+        }
+    }
+
+    #[test]
+    fn test_mail_from_empty_address() {
+        let cmd = parse_command("MAIL FROM:<>").unwrap();
+        assert_eq!(
+            cmd,
+            SmtpCommand::MailFrom {
+                address: "".into(),
+                params: HashMap::new(),
+            }
+        );
+    }
+
+    #[test]
+    fn test_mail_from_flexible_spacing() {
+        let cmd = parse_command("MAIL FROM: <user@example.com>").unwrap();
+        if let SmtpCommand::MailFrom { address, .. } = cmd {
+            assert_eq!(address, "user@example.com");
+        } else {
+            panic!("expected MailFrom");
+        }
+    }
+
+    #[test]
+    fn test_rcpt_to() {
+        let cmd = parse_command("RCPT TO:<recipient@example.com>").unwrap();
+        assert_eq!(
+            cmd,
+            SmtpCommand::RcptTo {
+                address: "recipient@example.com".into(),
+                params: HashMap::new(),
+            }
+        );
+    }
+
+    #[test]
+    fn test_data() {
+        assert_eq!(parse_command("DATA").unwrap(), SmtpCommand::Data);
+    }
+
+    #[test]
+    fn test_rset() {
+        assert_eq!(parse_command("RSET").unwrap(), SmtpCommand::Rset);
+    }
+
+    #[test]
+    fn test_noop() {
+        assert_eq!(parse_command("NOOP").unwrap(), SmtpCommand::Noop);
+    }
+
+    #[test]
+    fn test_quit() {
+        assert_eq!(parse_command("QUIT").unwrap(), SmtpCommand::Quit);
+    }
+
+    #[test]
+    fn test_starttls() {
+        assert_eq!(parse_command("STARTTLS").unwrap(), SmtpCommand::StartTls);
+    }
+
+    #[test]
+    fn test_auth_plain() {
+        let cmd = parse_command("AUTH PLAIN dGVzdAB0ZXN0AHBhc3N3b3Jk").unwrap();
+        assert_eq!(
+            cmd,
+            SmtpCommand::Auth {
+                mechanism: AuthMechanism::Plain,
+                initial_response: Some("dGVzdAB0ZXN0AHBhc3N3b3Jk".into()),
+            }
+        );
+    }
+
+    #[test]
+    fn test_auth_login_no_initial() {
+        let cmd = parse_command("AUTH LOGIN").unwrap();
+        assert_eq!(
+            cmd,
+            SmtpCommand::Auth {
+                mechanism: AuthMechanism::Login,
+                initial_response: None,
+            }
+        );
+    }
+
+    #[test]
+    fn test_help() {
+        assert_eq!(parse_command("HELP").unwrap(), SmtpCommand::Help(None));
+        assert_eq!(
+            parse_command("HELP MAIL").unwrap(),
+            SmtpCommand::Help(Some("MAIL".into()))
+        );
+    }
+
+    #[test]
+    fn test_vrfy() {
+        assert_eq!(
+            parse_command("VRFY user@example.com").unwrap(),
+            SmtpCommand::Vrfy("user@example.com".into())
+        );
+    }
+
+    #[test]
+    fn test_expn() {
+        assert_eq!(
+            parse_command("EXPN staff").unwrap(),
+            SmtpCommand::Expn("staff".into())
+        );
+    }
+
+    #[test]
+    fn test_empty() {
+        assert!(matches!(parse_command(""), Err(ParseError::Empty)));
+    }
+
+    #[test]
+    fn test_unrecognized() {
+        let err = parse_command("FOOBAR test").unwrap_err();
+        assert!(matches!(err, ParseError::UnrecognizedCommand(_)));
+    }
+
+    #[test]
+    fn test_crlf_stripped() {
+        let cmd = parse_command("QUIT\r\n").unwrap();
+        assert_eq!(cmd, SmtpCommand::Quit);
+    }
+}

rust/crates/mailer-smtp/src/config.rs

@@ -0,0 +1,86 @@
+//! SMTP server configuration.
+
+use serde::{Deserialize, Serialize};
+
+/// Configuration for an SMTP server instance.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SmtpServerConfig {
+    /// Server hostname for greeting and EHLO responses.
+    pub hostname: String,
+    /// Ports to listen on (e.g. [25, 587]).
+    pub ports: Vec<u16>,
+    /// Port for implicit TLS (e.g. 465). None = no implicit TLS port.
+    pub secure_port: Option<u16>,
+    /// TLS certificate chain in PEM format.
+    pub tls_cert_pem: Option<String>,
+    /// TLS private key in PEM format.
+    pub tls_key_pem: Option<String>,
+    /// Maximum message size in bytes.
+    pub max_message_size: u64,
+    /// Maximum number of concurrent connections.
+    pub max_connections: u32,
+    /// Maximum recipients per message.
+    pub max_recipients: u32,
+    /// Connection timeout in seconds.
+    pub connection_timeout_secs: u64,
+    /// Data phase timeout in seconds.
+    pub data_timeout_secs: u64,
+    /// Whether authentication is available.
+    pub auth_enabled: bool,
+    /// Maximum authentication failures before disconnect.
+    pub max_auth_failures: u32,
+    /// Socket timeout in seconds (idle timeout for the entire connection).
+    pub socket_timeout_secs: u64,
+    /// Timeout in seconds waiting for TS to respond to email processing.
+    pub processing_timeout_secs: u64,
+}
+
+impl Default for SmtpServerConfig {
+    fn default() -> Self {
+        Self {
+            hostname: "mail.example.com".to_string(),
+            ports: vec![25],
+            secure_port: None,
+            tls_cert_pem: None,
+            tls_key_pem: None,
+            max_message_size: 10 * 1024 * 1024, // 10 MB
+            max_connections: 100,
+            max_recipients: 100,
+            connection_timeout_secs: 30,
+            data_timeout_secs: 60,
+            auth_enabled: false,
+            max_auth_failures: 3,
+            socket_timeout_secs: 300,
+            processing_timeout_secs: 30,
+        }
+    }
+}
+
+impl SmtpServerConfig {
+    /// Check if TLS is configured.
+    pub fn has_tls(&self) -> bool {
+        self.tls_cert_pem.is_some() && self.tls_key_pem.is_some()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_defaults() {
+        let cfg = SmtpServerConfig::default();
+        assert_eq!(cfg.max_message_size, 10 * 1024 * 1024);
+        assert_eq!(cfg.max_connections, 100);
+        assert!(!cfg.has_tls());
+    }
+
+    #[test]
+    fn test_has_tls() {
+        let mut cfg = SmtpServerConfig::default();
+        cfg.tls_cert_pem = Some("cert".into());
+        assert!(!cfg.has_tls()); // need both
+        cfg.tls_key_pem = Some("key".into());
+        assert!(cfg.has_tls());
+    }
+}

rust/crates/mailer-smtp/src/data.rs

@@ -0,0 +1,289 @@
+//! Email DATA phase processor.
+//!
+//! Handles dot-unstuffing, end-of-data detection, size enforcement,
+//! and streaming accumulation of email data.
+
+/// Result of processing a chunk of DATA input.
+#[derive(Debug, Clone, PartialEq)]
+pub enum DataAction {
+    /// More data needed — continue accumulating.
+    Continue,
+    /// End-of-data detected. The complete message body is ready.
+    Complete,
+    /// Message size limit exceeded.
+    SizeExceeded,
+}
+
+/// Streaming email data accumulator.
+///
+/// Processes incoming bytes from the DATA phase, handling:
+/// - CRLF line ending normalization
+/// - Dot-unstuffing (RFC 5321 §4.5.2)
+/// - End-of-data marker detection (`<CRLF>.<CRLF>`)
+/// - Size enforcement
+pub struct DataAccumulator {
+    /// Accumulated message bytes.
+    buffer: Vec<u8>,
+    /// Maximum allowed size in bytes. 0 = unlimited.
+    max_size: u64,
+    /// Whether we've detected end-of-data.
+    complete: bool,
+    /// Whether the current position is at the start of a line.
+    at_line_start: bool,
+    /// Partial state for cross-chunk boundary handling.
+    partial: PartialState,
+}
+
+/// Tracks partial sequences that span chunk boundaries.
+#[derive(Debug, Clone, Copy, PartialEq)]
+enum PartialState {
+    /// No partial sequence.
+    None,
+    /// Saw `\r`, waiting for `\n`.
+    Cr,
+    /// At line start, saw `.`, waiting to determine dot-stuffing vs end-of-data.
+    Dot,
+    /// At line start, saw `.\r`, waiting for `\n` (end-of-data) or other.
+    DotCr,
+}
+
+impl DataAccumulator {
+    /// Create a new accumulator with the given size limit.
+    pub fn new(max_size: u64) -> Self {
+        Self {
+            buffer: Vec::with_capacity(8192),
+            max_size,
+            complete: false,
+            at_line_start: true, // First byte is at start of first line
+            partial: PartialState::None,
+        }
+    }
+
+    /// Process a chunk of incoming data.
+    ///
+    /// Returns the action to take: continue, complete, or size exceeded.
+    pub fn process_chunk(&mut self, chunk: &[u8]) -> DataAction {
+        if self.complete {
+            return DataAction::Complete;
+        }
+
+        for &byte in chunk {
+            match self.partial {
+                PartialState::None => {
+                    if self.at_line_start && byte == b'.' {
+                        self.partial = PartialState::Dot;
+                    } else if byte == b'\r' {
+                        self.partial = PartialState::Cr;
+                    } else {
+                        self.buffer.push(byte);
+                        self.at_line_start = false;
+                    }
+                }
+                PartialState::Cr => {
+                    if byte == b'\n' {
+                        self.buffer.extend_from_slice(b"\r\n");
+                        self.at_line_start = true;
+                        self.partial = PartialState::None;
+                    } else {
+                        // Bare CR — emit it and process current byte
+                        self.buffer.push(b'\r');
+                        self.at_line_start = false;
+                        self.partial = PartialState::None;
+                        // Re-process current byte
+                        if byte == b'\r' {
+                            self.partial = PartialState::Cr;
+                        } else {
+                            self.buffer.push(byte);
+                        }
+                    }
+                }
+                PartialState::Dot => {
+                    if byte == b'\r' {
+                        self.partial = PartialState::DotCr;
+                    } else if byte == b'.' {
+                        // Dot-unstuffing: \r\n.. → \r\n.
+                        // Emit one dot, consume the other
+                        self.buffer.push(b'.');
+                        self.at_line_start = false;
+                        self.partial = PartialState::None;
+                    } else {
+                        // Dot at line start but not stuffing or end-of-data
+                        self.buffer.push(b'.');
+                        self.buffer.push(byte);
+                        self.at_line_start = false;
+                        self.partial = PartialState::None;
+                    }
+                }
+                PartialState::DotCr => {
+                    if byte == b'\n' {
+                        // End-of-data: <CRLF>.<CRLF>
+                        // Remove the trailing \r\n from the buffer
+                        // (it was part of the terminator, not the message)
+                        if self.buffer.ends_with(b"\r\n") {
+                            let new_len = self.buffer.len() - 2;
+                            self.buffer.truncate(new_len);
+                        }
+                        self.complete = true;
+                        return DataAction::Complete;
+                    } else {
+                        // Not end-of-data — emit .\r and process current byte
+                        self.buffer.push(b'.');
+                        self.buffer.push(b'\r');
+                        self.at_line_start = false;
+                        self.partial = PartialState::None;
+                        // Re-process current byte
+                        if byte == b'\r' {
+                            self.partial = PartialState::Cr;
+                        } else {
+                            self.buffer.push(byte);
+                        }
+                    }
+                }
+            }
+
+            // Check size limit
+            if self.max_size > 0 && self.buffer.len() as u64 > self.max_size {
+                return DataAction::SizeExceeded;
+            }
+        }
+
+        DataAction::Continue
+    }
+
+    /// Consume the accumulator and return the complete message data.
+    ///
+    /// Returns `None` if end-of-data has not been detected.
+    pub fn into_message(self) -> Option<Vec<u8>> {
+        if !self.complete {
+            return None;
+        }
+        Some(self.buffer)
+    }
+
+    /// Get a reference to the accumulated data so far.
+    pub fn data(&self) -> &[u8] {
+        &self.buffer
+    }
+
+    /// Get the current accumulated size.
+    pub fn size(&self) -> usize {
+        self.buffer.len()
+    }
+
+    /// Whether end-of-data has been detected.
+    pub fn is_complete(&self) -> bool {
+        self.complete
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_simple_message() {
+        let mut acc = DataAccumulator::new(0);
+        let data = b"Subject: Test\r\n\r\nHello world\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Subject: Test\r\n\r\nHello world");
+    }
+
+    #[test]
+    fn test_dot_unstuffing() {
+        let mut acc = DataAccumulator::new(0);
+        // A line starting with ".." should become "."
+        let data = b"Line 1\r\n..dot-stuffed\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Line 1\r\n.dot-stuffed");
+    }
+
+    #[test]
+    fn test_multiple_chunks() {
+        let mut acc = DataAccumulator::new(0);
+        assert_eq!(acc.process_chunk(b"Subject: Test\r\n"), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b"\r\nBody line 1\r\n"), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b"Body line 2\r\n.\r\n"), DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Subject: Test\r\n\r\nBody line 1\r\nBody line 2");
+    }
+
+    #[test]
+    fn test_end_of_data_spanning_chunks() {
+        let mut acc = DataAccumulator::new(0);
+        assert_eq!(acc.process_chunk(b"Body\r\n"), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b".\r"), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b"\n"), DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Body");
+    }
+
+    #[test]
+    fn test_size_limit() {
+        let mut acc = DataAccumulator::new(10);
+        let data = b"This is definitely more than 10 bytes\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::SizeExceeded);
+    }
+
+    #[test]
+    fn test_not_complete() {
+        let mut acc = DataAccumulator::new(0);
+        acc.process_chunk(b"partial data");
+        assert!(!acc.is_complete());
+        assert!(acc.into_message().is_none());
+    }
+
+    #[test]
+    fn test_empty_message() {
+        let mut acc = DataAccumulator::new(0);
+        let action = acc.process_chunk(b".\r\n");
+        assert_eq!(action, DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert!(msg.is_empty());
+    }
+
+    #[test]
+    fn test_dot_not_at_line_start() {
+        let mut acc = DataAccumulator::new(0);
+        let data = b"Hello.World\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Hello.World");
+    }
+
+    #[test]
+    fn test_multiple_dots_in_line() {
+        let mut acc = DataAccumulator::new(0);
+        let data = b"...\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::Complete);
+        // First dot at line start is dot-unstuffed, leaving ".."
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"..");
+    }
+
+    #[test]
+    fn test_crlf_dot_spanning_three_chunks() {
+        let mut acc = DataAccumulator::new(0);
+        assert_eq!(acc.process_chunk(b"Body\r"), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b"\n."), DataAction::Continue);
+        assert_eq!(acc.process_chunk(b"\r\n"), DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Body");
+    }
+
+    #[test]
+    fn test_bare_cr() {
+        let mut acc = DataAccumulator::new(0);
+        let data = b"Hello\rWorld\r\n.\r\n";
+        let action = acc.process_chunk(data);
+        assert_eq!(action, DataAction::Complete);
+        let msg = acc.into_message().unwrap();
+        assert_eq!(msg, b"Hello\rWorld");
+    }
+}

rust/crates/mailer-smtp/src/lib.rs

@@ -1,18 +1,39 @@
 //! mailer-smtp: SMTP protocol engine (server + client).
+//!
+//! This crate provides the SMTP protocol implementation including:
+//! - Command parsing (`command`)
+//! - State machine (`state`)
+//! - Response building (`response`)
+//! - Email data accumulation (`data`)
+//! - Per-connection session state (`session`)
+//! - Address/input validation (`validation`)
+//! - Server configuration (`config`)
+//! - Rate limiting (`rate_limiter`)
+//! - TCP/TLS server (`server`)
+//! - Connection handling (`connection`)
+
+pub mod command;
+pub mod config;
+pub mod connection;
+pub mod data;
+pub mod rate_limiter;
+pub mod response;
+pub mod server;
+pub mod session;
+pub mod state;
+pub mod validation;
 
 pub use mailer_core;
 
-/// Placeholder for the SMTP server and client implementation.
+// Re-export key types for convenience.
+pub use command::{AuthMechanism, SmtpCommand};
+pub use config::SmtpServerConfig;
+pub use data::{DataAccumulator, DataAction};
+pub use response::SmtpResponse;
+pub use session::SmtpSession;
+pub use state::SmtpState;
+
+/// Crate version.
 pub fn version() -> &'static str {
     env!("CARGO_PKG_VERSION")
 }
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_version() {
-        assert!(!version().is_empty());
-    }
-}

rust/crates/mailer-smtp/src/rate_limiter.rs

@@ -0,0 +1,198 @@
+//! In-process SMTP rate limiter.
+//!
+//! Uses DashMap for lock-free concurrent access to rate counters.
+//! Tracks connections per IP, messages per sender, and auth failures.
+
+use dashmap::DashMap;
+use serde::{Deserialize, Serialize};
+use std::time::{Duration, Instant};
+
+/// Rate limiter configuration.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct RateLimitConfig {
+    /// Maximum connections per IP per window.
+    pub max_connections_per_ip: u32,
+    /// Maximum messages per sender per window.
+    pub max_messages_per_sender: u32,
+    /// Maximum auth failures per IP per window.
+    pub max_auth_failures_per_ip: u32,
+    /// Window duration in seconds.
+    pub window_secs: u64,
+}
+
+impl Default for RateLimitConfig {
+    fn default() -> Self {
+        Self {
+            max_connections_per_ip: 50,
+            max_messages_per_sender: 100,
+            max_auth_failures_per_ip: 5,
+            window_secs: 60,
+        }
+    }
+}
+
+/// A timestamped counter entry.
+struct CounterEntry {
+    count: u32,
+    window_start: Instant,
+}
+
+/// In-process rate limiter using DashMap.
+pub struct RateLimiter {
+    config: RateLimitConfig,
+    window: Duration,
+    connections: DashMap<String, CounterEntry>,
+    messages: DashMap<String, CounterEntry>,
+    auth_failures: DashMap<String, CounterEntry>,
+}
+
+impl RateLimiter {
+    /// Create a new rate limiter with the given configuration.
+    pub fn new(config: RateLimitConfig) -> Self {
+        let window = Duration::from_secs(config.window_secs);
+        Self {
+            config,
+            window,
+            connections: DashMap::new(),
+            messages: DashMap::new(),
+            auth_failures: DashMap::new(),
+        }
+    }
+
+    /// Update the configuration at runtime.
+    pub fn update_config(&mut self, config: RateLimitConfig) {
+        self.window = Duration::from_secs(config.window_secs);
+        self.config = config;
+    }
+
+    /// Check and record a new connection from an IP.
+    /// Returns `true` if the connection should be allowed.
+    pub fn check_connection(&self, ip: &str) -> bool {
+        self.increment_and_check(
+            &self.connections,
+            ip,
+            self.config.max_connections_per_ip,
+        )
+    }
+
+    /// Check and record a message from a sender.
+    /// Returns `true` if the message should be allowed.
+    pub fn check_message(&self, sender: &str) -> bool {
+        self.increment_and_check(
+            &self.messages,
+            sender,
+            self.config.max_messages_per_sender,
+        )
+    }
+
+    /// Check and record an auth failure from an IP.
+    /// Returns `true` if more attempts should be allowed.
+    pub fn check_auth_failure(&self, ip: &str) -> bool {
+        self.increment_and_check(
+            &self.auth_failures,
+            ip,
+            self.config.max_auth_failures_per_ip,
+        )
+    }
+
+    /// Increment a counter and check against the limit.
+    /// Returns `true` if within limits.
+    fn increment_and_check(
+        &self,
+        map: &DashMap<String, CounterEntry>,
+        key: &str,
+        limit: u32,
+    ) -> bool {
+        let now = Instant::now();
+        let mut entry = map
+            .entry(key.to_string())
+            .or_insert_with(|| CounterEntry {
+                count: 0,
+                window_start: now,
+            });
+
+        // Reset window if expired
+        if now.duration_since(entry.window_start) > self.window {
+            entry.count = 0;
+            entry.window_start = now;
+        }
+
+        entry.count += 1;
+        entry.count <= limit
+    }
+
+    /// Clean up expired entries. Call periodically.
+    pub fn cleanup(&self) {
+        let now = Instant::now();
+        let window = self.window;
+        self.connections
+            .retain(|_, v| now.duration_since(v.window_start) <= window);
+        self.messages
+            .retain(|_, v| now.duration_since(v.window_start) <= window);
+        self.auth_failures
+            .retain(|_, v| now.duration_since(v.window_start) <= window);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_connection_limit() {
+        let limiter = RateLimiter::new(RateLimitConfig {
+            max_connections_per_ip: 3,
+            window_secs: 60,
+            ..Default::default()
+        });
+
+        assert!(limiter.check_connection("1.2.3.4"));
+        assert!(limiter.check_connection("1.2.3.4"));
+        assert!(limiter.check_connection("1.2.3.4"));
+        assert!(!limiter.check_connection("1.2.3.4")); // 4th = over limit
+
+        // Different IP is independent
+        assert!(limiter.check_connection("5.6.7.8"));
+    }
+
+    #[test]
+    fn test_message_limit() {
+        let limiter = RateLimiter::new(RateLimitConfig {
+            max_messages_per_sender: 2,
+            window_secs: 60,
+            ..Default::default()
+        });
+
+        assert!(limiter.check_message("sender@example.com"));
+        assert!(limiter.check_message("sender@example.com"));
+        assert!(!limiter.check_message("sender@example.com"));
+    }
+
+    #[test]
+    fn test_auth_failure_limit() {
+        let limiter = RateLimiter::new(RateLimitConfig {
+            max_auth_failures_per_ip: 2,
+            window_secs: 60,
+            ..Default::default()
+        });
+
+        assert!(limiter.check_auth_failure("1.2.3.4"));
+        assert!(limiter.check_auth_failure("1.2.3.4"));
+        assert!(!limiter.check_auth_failure("1.2.3.4"));
+    }
+
+    #[test]
+    fn test_cleanup() {
+        let limiter = RateLimiter::new(RateLimitConfig {
+            max_connections_per_ip: 1,
+            window_secs: 60,
+            ..Default::default()
+        });
+
+        limiter.check_connection("1.2.3.4");
+        assert_eq!(limiter.connections.len(), 1);
+
+        limiter.cleanup(); // entries not expired
+        assert_eq!(limiter.connections.len(), 1);
+    }
+}

rust/crates/mailer-smtp/src/response.rs

@@ -0,0 +1,284 @@
+//! SMTP response builder.
+//!
+//! Constructs properly formatted SMTP response lines with status codes,
+//! multiline support, and EHLO capability advertisement.
+
+use serde::{Deserialize, Serialize};
+
+/// An SMTP response to send to the client.
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct SmtpResponse {
+    /// 3-digit SMTP status code.
+    pub code: u16,
+    /// Response lines (without the status code prefix).
+    pub lines: Vec<String>,
+}
+
+impl SmtpResponse {
+    /// Create a single-line response.
+    pub fn new(code: u16, message: impl Into<String>) -> Self {
+        Self {
+            code,
+            lines: vec![message.into()],
+        }
+    }
+
+    /// Create a multiline response.
+    pub fn multiline(code: u16, lines: Vec<String>) -> Self {
+        Self { code, lines }
+    }
+
+    /// Format the response as bytes ready to write to the socket.
+    ///
+    /// Multiline responses use `code-text` for intermediate lines
+    /// and `code text` for the final line (RFC 5321 §4.2).
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut buf = Vec::new();
+        if self.lines.is_empty() {
+            buf.extend_from_slice(format!("{} \r\n", self.code).as_bytes());
+        } else if self.lines.len() == 1 {
+            buf.extend_from_slice(
+                format!("{} {}\r\n", self.code, self.lines[0]).as_bytes(),
+            );
+        } else {
+            for (i, line) in self.lines.iter().enumerate() {
+                if i < self.lines.len() - 1 {
+                    buf.extend_from_slice(
+                        format!("{}-{}\r\n", self.code, line).as_bytes(),
+                    );
+                } else {
+                    buf.extend_from_slice(
+                        format!("{} {}\r\n", self.code, line).as_bytes(),
+                    );
+                }
+            }
+        }
+        buf
+    }
+
+    // --- Common response constructors ---
+
+    /// 220 Service ready greeting.
+    pub fn greeting(hostname: &str) -> Self {
+        Self::new(220, format!("{hostname} ESMTP Service Ready"))
+    }
+
+    /// 221 Service closing.
+    pub fn closing(hostname: &str) -> Self {
+        Self::new(221, format!("{hostname} Service closing transmission channel"))
+    }
+
+    /// 250 OK.
+    pub fn ok(message: impl Into<String>) -> Self {
+        Self::new(250, message)
+    }
+
+    /// EHLO response with capabilities.
+    pub fn ehlo_response(hostname: &str, capabilities: &[String]) -> Self {
+        let mut lines = Vec::with_capacity(capabilities.len() + 1);
+        lines.push(format!("{hostname} greets you"));
+        for cap in capabilities {
+            lines.push(cap.clone());
+        }
+        Self::multiline(250, lines)
+    }
+
+    /// 235 Authentication successful.
+    pub fn auth_success() -> Self {
+        Self::new(235, "2.7.0 Authentication successful")
+    }
+
+    /// 334 Auth challenge (base64-encoded prompt).
+    pub fn auth_challenge(prompt: &str) -> Self {
+        Self::new(334, prompt)
+    }
+
+    /// 354 Start mail input.
+    pub fn start_data() -> Self {
+        Self::new(354, "Start mail input; end with <CRLF>.<CRLF>")
+    }
+
+    /// 421 Service not available.
+    pub fn service_unavailable(hostname: &str, reason: &str) -> Self {
+        Self::new(421, format!("{hostname} {reason}"))
+    }
+
+    /// 450 Temporary failure.
+    pub fn temp_failure(message: impl Into<String>) -> Self {
+        Self::new(450, message)
+    }
+
+    /// 451 Local error.
+    pub fn local_error(message: impl Into<String>) -> Self {
+        Self::new(451, message)
+    }
+
+    /// 500 Syntax error.
+    pub fn syntax_error() -> Self {
+        Self::new(500, "Syntax error, command unrecognized")
+    }
+
+    /// 501 Syntax error in parameters.
+    pub fn param_error(message: impl Into<String>) -> Self {
+        Self::new(501, message)
+    }
+
+    /// 502 Command not implemented.
+    pub fn not_implemented() -> Self {
+        Self::new(502, "Command not implemented")
+    }
+
+    /// 503 Bad sequence.
+    pub fn bad_sequence(message: impl Into<String>) -> Self {
+        Self::new(503, message)
+    }
+
+    /// 530 Authentication required.
+    pub fn auth_required() -> Self {
+        Self::new(530, "5.7.0 Authentication required")
+    }
+
+    /// 535 Authentication failed.
+    pub fn auth_failed() -> Self {
+        Self::new(535, "5.7.8 Authentication credentials invalid")
+    }
+
+    /// 550 Mailbox unavailable.
+    pub fn mailbox_unavailable(message: impl Into<String>) -> Self {
+        Self::new(550, message)
+    }
+
+    /// 552 Message size exceeded.
+    pub fn size_exceeded(max_size: u64) -> Self {
+        Self::new(
+            552,
+            format!("5.3.4 Message size exceeds maximum of {max_size} bytes"),
+        )
+    }
+
+    /// 554 Transaction failed.
+    pub fn transaction_failed(message: impl Into<String>) -> Self {
+        Self::new(554, message)
+    }
+
+    /// Check if this is a success response (2xx).
+    pub fn is_success(&self) -> bool {
+        self.code >= 200 && self.code < 300
+    }
+
+    /// Check if this is a temporary error (4xx).
+    pub fn is_temp_error(&self) -> bool {
+        self.code >= 400 && self.code < 500
+    }
+
+    /// Check if this is a permanent error (5xx).
+    pub fn is_perm_error(&self) -> bool {
+        self.code >= 500 && self.code < 600
+    }
+}
+
+/// Build the list of EHLO capabilities for the server.
+pub fn build_capabilities(
+    max_size: u64,
+    tls_available: bool,
+    already_secure: bool,
+    auth_available: bool,
+) -> Vec<String> {
+    let mut caps = vec![
+        format!("SIZE {max_size}"),
+        "8BITMIME".to_string(),
+        "PIPELINING".to_string(),
+        "ENHANCEDSTATUSCODES".to_string(),
+        "HELP".to_string(),
+    ];
+    // Only advertise STARTTLS if TLS is available and not already using TLS
+    if tls_available && !already_secure {
+        caps.push("STARTTLS".to_string());
+    }
+    if auth_available {
+        caps.push("AUTH PLAIN LOGIN".to_string());
+    }
+    caps
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_single_line() {
+        let resp = SmtpResponse::new(250, "OK");
+        assert_eq!(resp.to_bytes(), b"250 OK\r\n");
+    }
+
+    #[test]
+    fn test_multiline() {
+        let resp = SmtpResponse::multiline(
+            250,
+            vec![
+                "mail.example.com greets you".into(),
+                "SIZE 10485760".into(),
+                "STARTTLS".into(),
+            ],
+        );
+        let expected = b"250-mail.example.com greets you\r\n250-SIZE 10485760\r\n250 STARTTLS\r\n";
+        assert_eq!(resp.to_bytes(), expected.to_vec());
+    }
+
+    #[test]
+    fn test_greeting() {
+        let resp = SmtpResponse::greeting("mail.example.com");
+        assert_eq!(resp.code, 220);
+        assert!(resp.lines[0].contains("mail.example.com"));
+    }
+
+    #[test]
+    fn test_ehlo_response() {
+        let caps = vec!["SIZE 10485760".into(), "STARTTLS".into()];
+        let resp = SmtpResponse::ehlo_response("mail.example.com", &caps);
+        assert_eq!(resp.code, 250);
+        assert_eq!(resp.lines.len(), 3); // hostname + 2 caps
+    }
+
+    #[test]
+    fn test_status_checks() {
+        assert!(SmtpResponse::new(250, "OK").is_success());
+        assert!(SmtpResponse::new(450, "Try later").is_temp_error());
+        assert!(SmtpResponse::new(550, "No such user").is_perm_error());
+        assert!(!SmtpResponse::new(250, "OK").is_temp_error());
+    }
+
+    #[test]
+    fn test_build_capabilities() {
+        let caps = build_capabilities(10485760, true, false, true);
+        assert!(caps.contains(&"SIZE 10485760".to_string()));
+        assert!(caps.contains(&"STARTTLS".to_string()));
+        assert!(caps.contains(&"AUTH PLAIN LOGIN".to_string()));
+        assert!(caps.contains(&"PIPELINING".to_string()));
+    }
+
+    #[test]
+    fn test_build_capabilities_secure() {
+        // When already secure, STARTTLS should NOT be advertised
+        let caps = build_capabilities(10485760, true, true, false);
+        assert!(!caps.contains(&"STARTTLS".to_string()));
+        assert!(!caps.contains(&"AUTH PLAIN LOGIN".to_string()));
+    }
+
+    #[test]
+    fn test_empty_response() {
+        let resp = SmtpResponse::multiline(250, vec![]);
+        assert_eq!(resp.to_bytes(), b"250 \r\n");
+    }
+
+    #[test]
+    fn test_common_responses() {
+        assert_eq!(SmtpResponse::start_data().code, 354);
+        assert_eq!(SmtpResponse::syntax_error().code, 500);
+        assert_eq!(SmtpResponse::not_implemented().code, 502);
+        assert_eq!(SmtpResponse::bad_sequence("test").code, 503);
+        assert_eq!(SmtpResponse::auth_required().code, 530);
+        assert_eq!(SmtpResponse::auth_failed().code, 535);
+        assert_eq!(SmtpResponse::auth_success().code, 235);
+    }
+}

rust/crates/mailer-smtp/src/server.rs

@@ -0,0 +1,308 @@
+//! SMTP TCP/TLS server.
+//!
+//! Listens on configured ports, accepts connections, and dispatches
+//! them to per-connection handlers.
+
+use crate::config::SmtpServerConfig;
+use crate::connection::{
+    self, CallbackRegistry, ConnectionEvent, SmtpStream,
+};
+use crate::rate_limiter::{RateLimitConfig, RateLimiter};
+
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
+use std::io::BufReader;
+use std::sync::atomic::{AtomicBool, AtomicU32, Ordering};
+use std::sync::Arc;
+use tokio::io::BufReader as TokioBufReader;
+use tokio::net::TcpListener;
+use tokio::sync::mpsc;
+use tracing::{error, info, warn};
+
+/// Handle for a running SMTP server.
+pub struct SmtpServerHandle {
+    /// Shutdown signal.
+    shutdown: Arc<AtomicBool>,
+    /// Join handles for the listener tasks.
+    handles: Vec<tokio::task::JoinHandle<()>>,
+    /// Active connection count.
+    pub active_connections: Arc<AtomicU32>,
+}
+
+impl SmtpServerHandle {
+    /// Signal shutdown and wait for all listeners to stop.
+    pub async fn shutdown(self) {
+        self.shutdown.store(true, Ordering::SeqCst);
+        for handle in self.handles {
+            let _ = handle.await;
+        }
+        info!("SMTP server shut down");
+    }
+
+    /// Check if the server is running.
+    pub fn is_running(&self) -> bool {
+        !self.shutdown.load(Ordering::SeqCst)
+    }
+}
+
+/// Start the SMTP server with the given configuration.
+///
+/// Returns a handle that can be used to shut down the server,
+/// and an event receiver for connection events (emailReceived, authRequest).
+pub async fn start_server(
+    config: SmtpServerConfig,
+    callback_registry: Arc<dyn CallbackRegistry + Send + Sync>,
+    rate_limit_config: Option<RateLimitConfig>,
+) -> Result<(SmtpServerHandle, mpsc::Receiver<ConnectionEvent>), Box<dyn std::error::Error + Send + Sync>>
+{
+    let config = Arc::new(config);
+    let shutdown = Arc::new(AtomicBool::new(false));
+    let active_connections = Arc::new(AtomicU32::new(0));
+    let rate_limiter = Arc::new(RateLimiter::new(
+        rate_limit_config.unwrap_or_default(),
+    ));
+
+    let (event_tx, event_rx) = mpsc::channel::<ConnectionEvent>(1024);
+
+    // Build TLS acceptor if configured
+    let tls_acceptor = if config.has_tls() {
+        Some(Arc::new(build_tls_acceptor(&config)?))
+    } else {
+        None
+    };
+
+    let mut handles = Vec::new();
+
+    // Start listeners on each port
+    for &port in &config.ports {
+        let listener = TcpListener::bind(format!("0.0.0.0:{port}")).await?;
+        info!(port = port, "SMTP server listening (STARTTLS)");
+
+        let handle = tokio::spawn(accept_loop(
+            listener,
+            config.clone(),
+            shutdown.clone(),
+            active_connections.clone(),
+            rate_limiter.clone(),
+            event_tx.clone(),
+            callback_registry.clone(),
+            tls_acceptor.clone(),
+            false, // not implicit TLS
+        ));
+        handles.push(handle);
+    }
+
+    // Start implicit TLS listener if configured
+    if let Some(secure_port) = config.secure_port {
+        if tls_acceptor.is_some() {
+            let listener =
+                TcpListener::bind(format!("0.0.0.0:{secure_port}")).await?;
+            info!(port = secure_port, "SMTP server listening (implicit TLS)");
+
+            let handle = tokio::spawn(accept_loop(
+                listener,
+                config.clone(),
+                shutdown.clone(),
+                active_connections.clone(),
+                rate_limiter.clone(),
+                event_tx.clone(),
+                callback_registry.clone(),
+                tls_acceptor.clone(),
+                true, // implicit TLS
+            ));
+            handles.push(handle);
+        } else {
+            warn!("Secure port configured but TLS certificates not provided");
+        }
+    }
+
+    // Spawn periodic rate limiter cleanup
+    {
+        let rate_limiter = rate_limiter.clone();
+        let shutdown = shutdown.clone();
+        tokio::spawn(async move {
+            let mut interval =
+                tokio::time::interval(tokio::time::Duration::from_secs(60));
+            loop {
+                interval.tick().await;
+                if shutdown.load(Ordering::SeqCst) {
+                    break;
+                }
+                rate_limiter.cleanup();
+            }
+        });
+    }
+
+    Ok((
+        SmtpServerHandle {
+            shutdown,
+            handles,
+            active_connections,
+        },
+        event_rx,
+    ))
+}
+
+/// Accept loop for a single listener.
+async fn accept_loop(
+    listener: TcpListener,
+    config: Arc<SmtpServerConfig>,
+    shutdown: Arc<AtomicBool>,
+    active_connections: Arc<AtomicU32>,
+    rate_limiter: Arc<RateLimiter>,
+    event_tx: mpsc::Sender<ConnectionEvent>,
+    callback_registry: Arc<dyn CallbackRegistry + Send + Sync>,
+    tls_acceptor: Option<Arc<tokio_rustls::TlsAcceptor>>,
+    implicit_tls: bool,
+) {
+    loop {
+        if shutdown.load(Ordering::SeqCst) {
+            break;
+        }
+
+        // Use a short timeout to check shutdown periodically
+        let accept_result = tokio::time::timeout(
+            tokio::time::Duration::from_secs(1),
+            listener.accept(),
+        )
+        .await;
+
+        let (tcp_stream, peer_addr) = match accept_result {
+            Ok(Ok((stream, addr))) => (stream, addr),
+            Ok(Err(e)) => {
+                error!(error = %e, "Accept error");
+                continue;
+            }
+            Err(_) => continue, // timeout, check shutdown
+        };
+
+        // Check max connections
+        let current = active_connections.load(Ordering::SeqCst);
+        if current >= config.max_connections {
+            warn!(
+                current = current,
+                max = config.max_connections,
+                "Max connections reached, rejecting"
+            );
+            drop(tcp_stream);
+            continue;
+        }
+
+        let remote_addr = peer_addr.ip().to_string();
+        let config = config.clone();
+        let rate_limiter = rate_limiter.clone();
+        let event_tx = event_tx.clone();
+        let callback_registry = callback_registry.clone();
+        let tls_acceptor = tls_acceptor.clone();
+        let active_connections = active_connections.clone();
+
+        active_connections.fetch_add(1, Ordering::SeqCst);
+
+        tokio::spawn(async move {
+            let stream = if implicit_tls {
+                // Implicit TLS: wrap immediately
+                if let Some(acceptor) = &tls_acceptor {
+                    match acceptor.accept(tcp_stream).await {
+                        Ok(tls_stream) => {
+                            SmtpStream::Tls(TokioBufReader::new(tls_stream))
+                        }
+                        Err(e) => {
+                            warn!(
+                                remote_addr = %remote_addr,
+                                error = %e,
+                                "Implicit TLS handshake failed"
+                            );
+                            active_connections.fetch_sub(1, Ordering::SeqCst);
+                            return;
+                        }
+                    }
+                } else {
+                    active_connections.fetch_sub(1, Ordering::SeqCst);
+                    return;
+                }
+            } else {
+                SmtpStream::Plain(TokioBufReader::new(tcp_stream))
+            };
+
+            connection::handle_connection(
+                stream,
+                config,
+                rate_limiter,
+                event_tx,
+                callback_registry,
+                tls_acceptor,
+                remote_addr,
+                implicit_tls,
+            )
+            .await;
+
+            active_connections.fetch_sub(1, Ordering::SeqCst);
+        });
+    }
+}
+
+/// Build a TLS acceptor from PEM cert/key strings.
+fn build_tls_acceptor(
+    config: &SmtpServerConfig,
+) -> Result<tokio_rustls::TlsAcceptor, Box<dyn std::error::Error + Send + Sync>> {
+    let cert_pem = config
+        .tls_cert_pem
+        .as_ref()
+        .ok_or("TLS cert not configured")?;
+    let key_pem = config
+        .tls_key_pem
+        .as_ref()
+        .ok_or("TLS key not configured")?;
+
+    // Parse certificates
+    let certs: Vec<CertificateDer<'static>> = {
+        let mut reader = BufReader::new(cert_pem.as_bytes());
+        rustls_pemfile::certs(&mut reader)
+            .collect::<Result<Vec<_>, _>>()?
+    };
+
+    if certs.is_empty() {
+        return Err("No certificates found in PEM".into());
+    }
+
+    // Parse private key
+    let key: PrivateKeyDer<'static> = {
+        let mut reader = BufReader::new(key_pem.as_bytes());
+        // Try PKCS8 first, then RSA, then EC
+        let mut keys = Vec::new();
+        for item in rustls_pemfile::read_all(&mut reader) {
+            match item? {
+                rustls_pemfile::Item::Pkcs8Key(key) => {
+                    keys.push(PrivateKeyDer::Pkcs8(key));
+                }
+                rustls_pemfile::Item::Pkcs1Key(key) => {
+                    keys.push(PrivateKeyDer::Pkcs1(key));
+                }
+                rustls_pemfile::Item::Sec1Key(key) => {
+                    keys.push(PrivateKeyDer::Sec1(key));
+                }
+                _ => {}
+            }
+        }
+        keys.into_iter()
+            .next()
+            .ok_or("No private key found in PEM")?
+    };
+
+    let tls_config = rustls::ServerConfig::builder()
+        .with_no_client_auth()
+        .with_single_cert(certs, key)?;
+
+    Ok(tokio_rustls::TlsAcceptor::from(Arc::new(tls_config)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_server_config_defaults() {
+        let config = SmtpServerConfig::default();
+        assert!(!config.has_tls());
+        assert_eq!(config.ports, vec![25]);
+    }
+}

rust/crates/mailer-smtp/src/session.rs

@@ -0,0 +1,206 @@
+//! Per-connection SMTP session state.
+//!
+//! Tracks the envelope, authentication, TLS status, and counters
+//! for a single SMTP connection.
+
+use crate::state::SmtpState;
+use serde::{Deserialize, Serialize};
+use uuid::Uuid;
+
+/// Envelope accumulator for the current mail transaction.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+pub struct Envelope {
+    /// Sender address from MAIL FROM.
+    pub mail_from: String,
+    /// Recipient addresses from RCPT TO.
+    pub rcpt_to: Vec<String>,
+    /// Declared message size from MAIL FROM SIZE= param (if any).
+    pub declared_size: Option<u64>,
+    /// BODY parameter (e.g. "8BITMIME").
+    pub body_type: Option<String>,
+}
+
+/// Authentication state for the session.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub enum AuthState {
+    /// Not authenticated and not in progress.
+    None,
+    /// Waiting for AUTH credentials (LOGIN flow step).
+    WaitingForUsername,
+    /// Have username, waiting for password.
+    WaitingForPassword { username: String },
+    /// Successfully authenticated.
+    Authenticated { username: String },
+}
+
+impl Default for AuthState {
+    fn default() -> Self {
+        AuthState::None
+    }
+}
+
+/// Per-connection session state.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SmtpSession {
+    /// Unique session identifier.
+    pub id: String,
+    /// Current protocol state.
+    pub state: SmtpState,
+    /// Client's EHLO/HELO hostname.
+    pub client_hostname: Option<String>,
+    /// Whether the client used EHLO (vs HELO).
+    pub esmtp: bool,
+    /// Whether the connection is using TLS.
+    pub secure: bool,
+    /// Authentication state.
+    pub auth_state: AuthState,
+    /// Current transaction envelope.
+    pub envelope: Envelope,
+    /// Remote IP address.
+    pub remote_addr: String,
+    /// Number of messages sent in this session.
+    pub message_count: u32,
+    /// Number of failed auth attempts.
+    pub auth_failures: u32,
+    /// Number of invalid commands.
+    pub invalid_commands: u32,
+    /// Maximum allowed invalid commands before disconnect.
+    pub max_invalid_commands: u32,
+}
+
+impl SmtpSession {
+    /// Create a new session for a connection.
+    pub fn new(remote_addr: String, secure: bool) -> Self {
+        Self {
+            id: Uuid::new_v4().to_string(),
+            state: SmtpState::Connected,
+            client_hostname: None,
+            esmtp: false,
+            secure,
+            auth_state: AuthState::None,
+            envelope: Envelope::default(),
+            remote_addr,
+            message_count: 0,
+            auth_failures: 0,
+            invalid_commands: 0,
+            max_invalid_commands: 20,
+        }
+    }
+
+    /// Reset the current transaction (RSET), preserving connection state.
+    pub fn reset_transaction(&mut self) {
+        self.envelope = Envelope::default();
+        if self.state != SmtpState::Connected {
+            self.state = SmtpState::Greeted;
+        }
+    }
+
+    /// Reset session for a new EHLO (preserves counters and TLS).
+    pub fn reset_for_ehlo(&mut self, hostname: String, esmtp: bool) {
+        self.client_hostname = Some(hostname);
+        self.esmtp = esmtp;
+        self.envelope = Envelope::default();
+        self.state = SmtpState::Greeted;
+        // Auth state is reset on new EHLO per RFC
+        self.auth_state = AuthState::None;
+    }
+
+    /// Check if the client is authenticated.
+    pub fn is_authenticated(&self) -> bool {
+        matches!(self.auth_state, AuthState::Authenticated { .. })
+    }
+
+    /// Get the authenticated username, if any.
+    pub fn authenticated_user(&self) -> Option<&str> {
+        match &self.auth_state {
+            AuthState::Authenticated { username } => Some(username),
+            _ => None,
+        }
+    }
+
+    /// Record a completed message delivery.
+    pub fn record_message(&mut self) {
+        self.message_count += 1;
+    }
+
+    /// Record a failed auth attempt. Returns true if limit exceeded.
+    pub fn record_auth_failure(&mut self, max_failures: u32) -> bool {
+        self.auth_failures += 1;
+        self.auth_failures >= max_failures
+    }
+
+    /// Record an invalid command. Returns true if limit exceeded.
+    pub fn record_invalid_command(&mut self) -> bool {
+        self.invalid_commands += 1;
+        self.invalid_commands >= self.max_invalid_commands
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_new_session() {
+        let session = SmtpSession::new("127.0.0.1".into(), false);
+        assert_eq!(session.state, SmtpState::Connected);
+        assert!(!session.secure);
+        assert!(!session.is_authenticated());
+        assert!(session.client_hostname.is_none());
+    }
+
+    #[test]
+    fn test_reset_transaction() {
+        let mut session = SmtpSession::new("127.0.0.1".into(), false);
+        session.state = SmtpState::RcptTo;
+        session.envelope.mail_from = "sender@example.com".into();
+        session.envelope.rcpt_to.push("rcpt@example.com".into());
+
+        session.reset_transaction();
+
+        assert_eq!(session.state, SmtpState::Greeted);
+        assert!(session.envelope.mail_from.is_empty());
+        assert!(session.envelope.rcpt_to.is_empty());
+    }
+
+    #[test]
+    fn test_reset_for_ehlo() {
+        let mut session = SmtpSession::new("127.0.0.1".into(), true);
+        session.auth_state = AuthState::Authenticated {
+            username: "user".into(),
+        };
+
+        session.reset_for_ehlo("mail.example.com".into(), true);
+
+        assert_eq!(session.state, SmtpState::Greeted);
+        assert_eq!(session.client_hostname.as_deref(), Some("mail.example.com"));
+        assert!(session.esmtp);
+        assert!(!session.is_authenticated()); // Auth reset after EHLO
+    }
+
+    #[test]
+    fn test_auth_failures() {
+        let mut session = SmtpSession::new("127.0.0.1".into(), false);
+        assert!(!session.record_auth_failure(3));
+        assert!(!session.record_auth_failure(3));
+        assert!(session.record_auth_failure(3)); // 3rd failure -> limit
+    }
+
+    #[test]
+    fn test_invalid_commands() {
+        let mut session = SmtpSession::new("127.0.0.1".into(), false);
+        session.max_invalid_commands = 3;
+        assert!(!session.record_invalid_command());
+        assert!(!session.record_invalid_command());
+        assert!(session.record_invalid_command()); // 3rd -> limit
+    }
+
+    #[test]
+    fn test_message_count() {
+        let mut session = SmtpSession::new("127.0.0.1".into(), false);
+        assert_eq!(session.message_count, 0);
+        session.record_message();
+        session.record_message();
+        assert_eq!(session.message_count, 2);
+    }
+}

rust/crates/mailer-smtp/src/state.rs

@@ -0,0 +1,219 @@
+//! SMTP protocol state machine.
+//!
+//! Defines valid states and transitions for an SMTP session.
+
+use serde::{Deserialize, Serialize};
+
+/// SMTP session states following RFC 5321.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub enum SmtpState {
+    /// Initial state — waiting for server greeting.
+    Connected,
+    /// After successful EHLO/HELO.
+    Greeted,
+    /// After MAIL FROM accepted.
+    MailFrom,
+    /// After at least one RCPT TO accepted.
+    RcptTo,
+    /// In DATA mode — accumulating message body.
+    Data,
+    /// Transaction completed — can start a new one or QUIT.
+    Finished,
+}
+
+/// State transition errors.
+#[derive(Debug, Clone, PartialEq, thiserror::Error)]
+pub enum TransitionError {
+    #[error("cannot {action} in state {state:?}")]
+    InvalidTransition {
+        state: SmtpState,
+        action: &'static str,
+    },
+}
+
+impl SmtpState {
+    /// Check whether EHLO/HELO is valid in the current state.
+    /// EHLO/HELO can be issued at any time to reset the session.
+    pub fn can_ehlo(&self) -> bool {
+        true
+    }
+
+    /// Check whether MAIL FROM is valid in the current state.
+    pub fn can_mail_from(&self) -> bool {
+        matches!(self, SmtpState::Greeted | SmtpState::Finished)
+    }
+
+    /// Check whether RCPT TO is valid in the current state.
+    pub fn can_rcpt_to(&self) -> bool {
+        matches!(self, SmtpState::MailFrom | SmtpState::RcptTo)
+    }
+
+    /// Check whether DATA is valid in the current state.
+    pub fn can_data(&self) -> bool {
+        matches!(self, SmtpState::RcptTo)
+    }
+
+    /// Check whether STARTTLS is valid in the current state.
+    /// Only before a transaction starts.
+    pub fn can_starttls(&self) -> bool {
+        matches!(self, SmtpState::Connected | SmtpState::Greeted | SmtpState::Finished)
+    }
+
+    /// Check whether AUTH is valid in the current state.
+    /// Only after EHLO and before a transaction starts.
+    pub fn can_auth(&self) -> bool {
+        matches!(self, SmtpState::Greeted | SmtpState::Finished)
+    }
+
+    /// Transition to Greeted state (after EHLO/HELO).
+    pub fn transition_ehlo(&self) -> Result<SmtpState, TransitionError> {
+        // EHLO is always valid — it resets the session.
+        Ok(SmtpState::Greeted)
+    }
+
+    /// Transition to MailFrom state (after MAIL FROM accepted).
+    pub fn transition_mail_from(&self) -> Result<SmtpState, TransitionError> {
+        if self.can_mail_from() {
+            Ok(SmtpState::MailFrom)
+        } else {
+            Err(TransitionError::InvalidTransition {
+                state: *self,
+                action: "MAIL FROM",
+            })
+        }
+    }
+
+    /// Transition to RcptTo state (after RCPT TO accepted).
+    pub fn transition_rcpt_to(&self) -> Result<SmtpState, TransitionError> {
+        if self.can_rcpt_to() {
+            Ok(SmtpState::RcptTo)
+        } else {
+            Err(TransitionError::InvalidTransition {
+                state: *self,
+                action: "RCPT TO",
+            })
+        }
+    }
+
+    /// Transition to Data state (after DATA command accepted).
+    pub fn transition_data(&self) -> Result<SmtpState, TransitionError> {
+        if self.can_data() {
+            Ok(SmtpState::Data)
+        } else {
+            Err(TransitionError::InvalidTransition {
+                state: *self,
+                action: "DATA",
+            })
+        }
+    }
+
+    /// Transition to Finished state (after end-of-data).
+    pub fn transition_finished(&self) -> Result<SmtpState, TransitionError> {
+        if *self == SmtpState::Data {
+            Ok(SmtpState::Finished)
+        } else {
+            Err(TransitionError::InvalidTransition {
+                state: *self,
+                action: "finish DATA",
+            })
+        }
+    }
+
+    /// Reset to Greeted state (after RSET command).
+    pub fn transition_rset(&self) -> Result<SmtpState, TransitionError> {
+        match self {
+            SmtpState::Connected => Err(TransitionError::InvalidTransition {
+                state: *self,
+                action: "RSET",
+            }),
+            _ => Ok(SmtpState::Greeted),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_initial_state() {
+        let state = SmtpState::Connected;
+        assert!(!state.can_mail_from());
+        assert!(!state.can_rcpt_to());
+        assert!(!state.can_data());
+        assert!(state.can_starttls());
+        assert!(state.can_ehlo());
+    }
+
+    #[test]
+    fn test_ehlo_always_valid() {
+        for state in [
+            SmtpState::Connected,
+            SmtpState::Greeted,
+            SmtpState::MailFrom,
+            SmtpState::RcptTo,
+            SmtpState::Data,
+            SmtpState::Finished,
+        ] {
+            assert!(state.can_ehlo());
+            assert!(state.transition_ehlo().is_ok());
+        }
+    }
+
+    #[test]
+    fn test_normal_flow() {
+        let state = SmtpState::Connected;
+        let state = state.transition_ehlo().unwrap();
+        assert_eq!(state, SmtpState::Greeted);
+
+        let state = state.transition_mail_from().unwrap();
+        assert_eq!(state, SmtpState::MailFrom);
+
+        let state = state.transition_rcpt_to().unwrap();
+        assert_eq!(state, SmtpState::RcptTo);
+
+        // Multiple RCPT TO
+        let state = state.transition_rcpt_to().unwrap();
+        assert_eq!(state, SmtpState::RcptTo);
+
+        let state = state.transition_data().unwrap();
+        assert_eq!(state, SmtpState::Data);
+
+        let state = state.transition_finished().unwrap();
+        assert_eq!(state, SmtpState::Finished);
+
+        // New transaction
+        let state = state.transition_mail_from().unwrap();
+        assert_eq!(state, SmtpState::MailFrom);
+    }
+
+    #[test]
+    fn test_invalid_transitions() {
+        assert!(SmtpState::Connected.transition_mail_from().is_err());
+        assert!(SmtpState::Connected.transition_rcpt_to().is_err());
+        assert!(SmtpState::Connected.transition_data().is_err());
+        assert!(SmtpState::Greeted.transition_rcpt_to().is_err());
+        assert!(SmtpState::Greeted.transition_data().is_err());
+        assert!(SmtpState::MailFrom.transition_data().is_err());
+    }
+
+    #[test]
+    fn test_rset() {
+        let state = SmtpState::RcptTo;
+        let state = state.transition_rset().unwrap();
+        assert_eq!(state, SmtpState::Greeted);
+
+        // RSET from Connected is invalid (no EHLO yet)
+        assert!(SmtpState::Connected.transition_rset().is_err());
+    }
+
+    #[test]
+    fn test_starttls_validity() {
+        assert!(SmtpState::Connected.can_starttls());
+        assert!(SmtpState::Greeted.can_starttls());
+        assert!(!SmtpState::MailFrom.can_starttls());
+        assert!(!SmtpState::RcptTo.can_starttls());
+        assert!(!SmtpState::Data.can_starttls());
+        assert!(SmtpState::Finished.can_starttls());
+    }
+}

rust/crates/mailer-smtp/src/validation.rs

@@ -0,0 +1,169 @@
+//! SMTP-level validation utilities.
+//!
+//! Address parsing, EHLO hostname validation, and header injection detection.
+
+use regex::Regex;
+use std::sync::LazyLock;
+
+/// Regex for basic email address format validation.
+static EMAIL_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r"^[^\s@]+@[^\s@]+\.[^\s@]+$").unwrap()
+});
+
+/// Regex for valid EHLO hostname (domain name or IPv4/IPv6 literal).
+/// Currently unused in favor of a more permissive check, but available
+/// for strict validation if needed.
+#[allow(dead_code)]
+static EHLO_RE: LazyLock<Regex> = LazyLock::new(|| {
+    // Permissive: domain names, IP literals [1.2.3.4], [IPv6:...], or bare words
+    Regex::new(r"^(?:\[(?:IPv6:)?[^\]]+\]|[a-zA-Z0-9](?:[a-zA-Z0-9\-\.]*[a-zA-Z0-9])?)$").unwrap()
+});
+
+/// Validate an email address for basic SMTP format.
+///
+/// Returns `true` if the address has a valid-looking format.
+/// Empty addresses (for bounce messages, MAIL FROM:<>) return `true`.
+pub fn is_valid_smtp_address(address: &str) -> bool {
+    // Empty address is valid for MAIL FROM (bounce)
+    if address.is_empty() {
+        return true;
+    }
+    EMAIL_RE.is_match(address)
+}
+
+/// Validate an EHLO/HELO hostname.
+///
+/// Returns `true` if the hostname looks syntactically valid.
+/// We are permissive because real-world SMTP clients send all kinds of values.
+pub fn is_valid_ehlo_hostname(hostname: &str) -> bool {
+    if hostname.is_empty() {
+        return false;
+    }
+    // Be permissive — most SMTP servers accept anything non-empty.
+    // Only reject obviously malicious patterns.
+    if hostname.len() > 255 {
+        return false;
+    }
+    if contains_header_injection(hostname) {
+        return false;
+    }
+    // Must not contain null bytes
+    if hostname.contains('\0') {
+        return false;
+    }
+    true
+}
+
+/// Check for SMTP header injection attempts.
+///
+/// Returns `true` if the input contains characters that could be used
+/// for header injection (bare CR/LF).
+pub fn contains_header_injection(input: &str) -> bool {
+    input.contains('\r') || input.contains('\n')
+}
+
+/// Validate the size parameter from MAIL FROM.
+///
+/// Returns the parsed size if valid and within the max, or an error message.
+pub fn validate_size_param(value: &str, max_size: u64) -> Result<u64, String> {
+    let size: u64 = value
+        .parse()
+        .map_err(|_| format!("invalid SIZE value: {value}"))?;
+    if size > max_size {
+        return Err(format!(
+            "message size {size} exceeds maximum {max_size}"
+        ));
+    }
+    Ok(size)
+}
+
+/// Extract the domain part from an email address.
+pub fn extract_domain(address: &str) -> Option<&str> {
+    if address.is_empty() {
+        return None;
+    }
+    address.rsplit_once('@').map(|(_, domain)| domain)
+}
+
+/// Normalize an email address by lowercasing the domain part.
+pub fn normalize_address(address: &str) -> String {
+    if address.is_empty() {
+        return String::new();
+    }
+    match address.rsplit_once('@') {
+        Some((local, domain)) => format!("{local}@{}", domain.to_ascii_lowercase()),
+        None => address.to_string(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_valid_email() {
+        assert!(is_valid_smtp_address("user@example.com"));
+        assert!(is_valid_smtp_address("user+tag@sub.example.com"));
+        assert!(is_valid_smtp_address("a@b.c"));
+    }
+
+    #[test]
+    fn test_empty_address_valid() {
+        assert!(is_valid_smtp_address(""));
+    }
+
+    #[test]
+    fn test_invalid_email() {
+        assert!(!is_valid_smtp_address("no-at-sign"));
+        assert!(!is_valid_smtp_address("@no-local.com"));
+        assert!(!is_valid_smtp_address("user@"));
+        assert!(!is_valid_smtp_address("user@nodot"));
+        assert!(!is_valid_smtp_address("has space@example.com"));
+    }
+
+    #[test]
+    fn test_valid_ehlo() {
+        assert!(is_valid_ehlo_hostname("mail.example.com"));
+        assert!(is_valid_ehlo_hostname("localhost"));
+        assert!(is_valid_ehlo_hostname("[127.0.0.1]"));
+        assert!(is_valid_ehlo_hostname("[IPv6:::1]"));
+    }
+
+    #[test]
+    fn test_invalid_ehlo() {
+        assert!(!is_valid_ehlo_hostname(""));
+        assert!(!is_valid_ehlo_hostname("host\r\nname"));
+        assert!(!is_valid_ehlo_hostname(&"a".repeat(256)));
+    }
+
+    #[test]
+    fn test_header_injection() {
+        assert!(contains_header_injection("test\r\nBcc: evil@evil.com"));
+        assert!(contains_header_injection("test\ninjection"));
+        assert!(contains_header_injection("test\rinjection"));
+        assert!(!contains_header_injection("normal text"));
+    }
+
+    #[test]
+    fn test_size_param() {
+        assert_eq!(validate_size_param("12345", 1_000_000), Ok(12345));
+        assert!(validate_size_param("99999999", 1_000).is_err());
+        assert!(validate_size_param("notanumber", 1_000).is_err());
+    }
+
+    #[test]
+    fn test_extract_domain() {
+        assert_eq!(extract_domain("user@example.com"), Some("example.com"));
+        assert_eq!(extract_domain(""), None);
+        assert_eq!(extract_domain("nodomain"), None);
+    }
+
+    #[test]
+    fn test_normalize_address() {
+        assert_eq!(
+            normalize_address("User@EXAMPLE.COM"),
+            "User@example.com"
+        );
+        assert_eq!(normalize_address(""), "");
+    }
+}

test/test.bouncemanager.ts

@@ -1,6 +1,13 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { BounceManager, BounceType, BounceCategory } from '../ts/mail/core/classes.bouncemanager.js';
 import { Email } from '../ts/mail/core/classes.email.js';
+import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
+
+tap.test('setup - start Rust security bridge', async () => {
+  const bridge = RustSecurityBridge.getInstance();
+  const ok = await bridge.start();
+  expect(ok).toEqual(true);
+});
 
 /**
  * Test the BounceManager class
@@ -189,6 +196,10 @@ tap.test('BounceManager - should handle retries for soft bounces', async () => {
   expect(info.expiresAt).toBeUndefined(); // Permanent
 });
 
+tap.test('cleanup - stop Rust security bridge', async () => {
+  await RustSecurityBridge.getInstance().stop();
+});
+
 tap.test('stop', async () => {
   await tap.stopForcefully();
 });

test/test.contentscanner.ts

@@ -1,6 +1,13 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
 import { ContentScanner, ThreatCategory } from '../ts/security/classes.contentscanner.js';
 import { Email } from '../ts/mail/core/classes.email.js';
+import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
+
+tap.test('setup - start Rust security bridge', async () => {
+  const bridge = RustSecurityBridge.getInstance();
+  const ok = await bridge.start();
+  expect(ok).toEqual(true);
+});
 
 // Test instantiation
 tap.test('ContentScanner - should be instantiable', async () => {
@@ -258,6 +265,10 @@ tap.test('ContentScanner - should classify threat levels correctly', async () =>
   expect(ContentScanner.getThreatLevel(80)).toEqual('high');
 });
 
+tap.test('cleanup - stop Rust security bridge', async () => {
+  await RustSecurityBridge.getInstance().stop();
+});
+
 tap.test('stop', async () => {
   await tap.stopForcefully();
 });

test/test.ipreputationchecker.ts

@@ -1,21 +1,19 @@
 import { tap, expect } from '@git.zone/tstest/tapbundle';
-import { IPReputationChecker, ReputationThreshold, IPType } from '../ts/security/classes.ipreputationchecker.js';
+import { IPReputationChecker, ReputationThreshold } from '../ts/security/classes.ipreputationchecker.js';
-import * as plugins from '../ts/plugins.js';
+import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
 
-// Mock for dns lookup
+let bridge: RustSecurityBridge;
-const originalDnsResolve = plugins.dns.promises.resolve;
-let mockDnsResolveImpl: (hostname: string) => Promise<string[]> = async () => ['127.0.0.1'];
 
-// Setup mock DNS resolver with proper typing
+// Start the Rust bridge before tests
-(plugins.dns.promises as any).resolve = async (hostname: string) => {
+tap.test('setup - start Rust security bridge', async () => {
-  return mockDnsResolveImpl(hostname);
+  bridge = RustSecurityBridge.getInstance();
-};
+  const ok = await bridge.start();
+  expect(ok).toEqual(true);
+});
 
 // Test instantiation
 tap.test('IPReputationChecker - should be instantiable', async () => {
   const checker = IPReputationChecker.getInstance({
-    enableDNSBL: false,
-    enableIPInfo: false,
     enableLocalCache: false
   });
 
@@ -27,82 +25,51 @@ tap.test('IPReputationChecker - should use singleton pattern', async () => {
   const checker1 = IPReputationChecker.getInstance();
   const checker2 = IPReputationChecker.getInstance();
 
-  // Both instances should be the same object
   expect(checker1 === checker2).toEqual(true);
 });
 
 // Test IP validation
 tap.test('IPReputationChecker - should validate IP address format', async () => {
-  const checker = IPReputationChecker.getInstance({
+  const checker = IPReputationChecker.getInstance();
-    enableDNSBL: false,
-    enableIPInfo: false,
-    enableLocalCache: false
-  });
-  
-  // Valid IP should work
-  const result = await checker.checkReputation('192.168.1.1');
-  expect(result.score).toBeGreaterThan(0);
-  expect(result.error).toBeUndefined();
 
   // Invalid IP should fail with error
   const invalidResult = await checker.checkReputation('invalid.ip');
   expect(invalidResult.error).toBeTruthy();
 });
 
-// Test DNSBL lookups
+// Test reputation check via Rust bridge
-tap.test('IPReputationChecker - should check IP against DNSBL', async () => {
+tap.test('IPReputationChecker - should check IP reputation via Rust', async () => {
-  try {
+  const testInstance = new IPReputationChecker({
-    // Setup mock implementation for DNSBL
+    enableLocalCache: false,
-    mockDnsResolveImpl = async (hostname: string) => {
+    maxCacheSize: 10
-      // Listed in DNSBL if IP contains 2
+  });
-      if (hostname.includes('2.1.168.192') && hostname.includes('zen.spamhaus.org')) {
-        return ['127.0.0.2'];
-      }
-      throw { code: 'ENOTFOUND' };
-    };
 
-    // Create a new instance with specific settings for this test
+  // Check a public IP (Google DNS) — should get a result with a score
-    const testInstance = new IPReputationChecker({
+  const result = await testInstance.checkReputation('8.8.8.8');
-      dnsblServers: ['zen.spamhaus.org'],
+  expect(result).toBeTruthy();
-      enableIPInfo: false,
+  expect(result.score).toBeGreaterThan(0);
-      enableLocalCache: false,
+  expect(result.score).toBeLessThanOrEqual(100);
-      maxCacheSize: 1 // Small cache for testing
+  expect(typeof result.isSpam).toEqual('boolean');
-    });
+  expect(typeof result.isProxy).toEqual('boolean');
-    
+  expect(typeof result.isTor).toEqual('boolean');
-    // Clean IP should have good score
+  expect(typeof result.isVPN).toEqual('boolean');
-    const cleanResult = await testInstance.checkReputation('192.168.1.1');
+  expect(result.timestamp).toBeGreaterThan(0);
-    expect(cleanResult.isSpam).toEqual(false);
-    expect(cleanResult.score).toEqual(100);
-    
-    // Blacklisted IP should have reduced score
-    const blacklistedResult = await testInstance.checkReputation('192.168.1.2');
-    expect(blacklistedResult.isSpam).toEqual(true);
-    expect(blacklistedResult.score < 100).toEqual(true); // Less than 100
-    expect(blacklistedResult.blacklists).toBeTruthy();
-    expect((blacklistedResult.blacklists || []).length > 0).toEqual(true);
-  } catch (err) {
-    console.error('Test error:', err);
-    throw err;
-  }
 });
 
 // Test caching behavior
 tap.test('IPReputationChecker - should cache reputation results', async () => {
-  // Create a fresh instance for this test
   const testInstance = new IPReputationChecker({
-    enableIPInfo: false,
     enableLocalCache: false,
-    maxCacheSize: 10 // Small cache for testing
+    maxCacheSize: 10
   });
 
-  // Check that first look performs a lookup and second uses cache
+  const ip = '1.1.1.1';
-  const ip = '192.168.1.10';
 
   // First check should add to cache
   const result1 = await testInstance.checkReputation(ip);
   expect(result1).toBeTruthy();
 
-  // Manually verify it's in cache - access private member for testing
+  // Verify it's in cache
   const hasInCache = (testInstance as any).reputationCache.has(ip);
   expect(hasInCache).toEqual(true);
 
@@ -110,8 +77,9 @@ tap.test('IPReputationChecker - should cache reputation results', async () => {
   const result2 = await testInstance.checkReputation(ip);
   expect(result2).toBeTruthy();
 
-  // Results should be identical
+  // Results should be identical (from cache)
   expect(result1.score).toEqual(result2.score);
+  expect(result1.isSpam).toEqual(result2.isSpam);
 });
 
 // Test risk level classification
@@ -122,54 +90,23 @@ tap.test('IPReputationChecker - should classify risk levels correctly', async ()
   expect(IPReputationChecker.getRiskLevel(90)).toEqual('trusted');
 });
 
-// Test IP type detection
+// Test error handling for error result
-tap.test('IPReputationChecker - should detect special IP types', async () => {
+tap.test('IPReputationChecker - should handle errors gracefully', async () => {
   const testInstance = new IPReputationChecker({
-    enableDNSBL: false,
-    enableIPInfo: true,
     enableLocalCache: false,
-    maxCacheSize: 5 // Small cache for testing
+    maxCacheSize: 5
   });
 
-  // Test Tor exit node detection
+  // Invalid format should return error result with neutral score
-  const torResult = await testInstance.checkReputation('171.25.1.1');
+  const result = await testInstance.checkReputation('not-an-ip');
-  expect(torResult.isTor).toEqual(true);
+  expect(result.score).toEqual(50);
-  expect(torResult.score < 90).toEqual(true);
+  expect(result.error).toBeTruthy();
-  
-  // Test VPN detection
-  const vpnResult = await testInstance.checkReputation('185.156.1.1');
-  expect(vpnResult.isVPN).toEqual(true);
-  expect(vpnResult.score < 90).toEqual(true);
-  
-  // Test proxy detection
-  const proxyResult = await testInstance.checkReputation('34.92.1.1');
-  expect(proxyResult.isProxy).toEqual(true);
-  expect(proxyResult.score < 90).toEqual(true);
-});
-
-// Test error handling
-tap.test('IPReputationChecker - should handle DNS lookup errors gracefully', async () => {
-  // Setup mock implementation to simulate error
-  mockDnsResolveImpl = async () => {
-    throw new Error('DNS server error');
-  };
-
-  const checker = IPReputationChecker.getInstance({
-    dnsblServers: ['zen.spamhaus.org'],
-    enableIPInfo: false,
-    enableLocalCache: false,
-    maxCacheSize: 300 // Force new instance
-  });
-  
-  // Should return a result despite errors
-  const result = await checker.checkReputation('192.168.1.1');
-  expect(result.score).toEqual(100); // No blacklist hits found due to error
   expect(result.isSpam).toEqual(false);
 });
 
-// Restore original implementation at the end
+// Stop bridge
-tap.test('Cleanup - restore mocks', async () => {
+tap.test('cleanup - stop Rust security bridge', async () => {
-  plugins.dns.promises.resolve = originalDnsResolve;
+  await bridge.stop();
 });
 
 tap.test('stop', async () => {

test/test.rustsecuritybridge.node.ts

@@ -0,0 +1,136 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import { RustSecurityBridge } from '../ts/security/classes.rustsecuritybridge.js';
+
+let bridge: RustSecurityBridge;
+
+tap.test('RustSecurityBridge - should get singleton instance', async () => {
+  bridge = RustSecurityBridge.getInstance();
+  expect(bridge).toBeTruthy();
+  expect(bridge).toEqual(RustSecurityBridge.getInstance()); // same instance
+});
+
+tap.test('RustSecurityBridge - should start the Rust binary', async () => {
+  const ok = await bridge.start();
+  if (!ok) {
+    console.log('WARNING: Rust binary not available — skipping bridge tests');
+    console.log('Build it with: cd rust && cargo build --release');
+  }
+  // We accept both true and false — the binary may not be built yet
+  expect(typeof ok).toEqual('boolean');
+});
+
+tap.test('RustSecurityBridge - ping should return pong', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const pong = await bridge.ping();
+  expect(pong).toBeTrue();
+});
+
+tap.test('RustSecurityBridge - version should return crate versions', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const version = await bridge.getVersion();
+  expect(version.bin).toBeTruthy();
+  expect(version.core).toBeTruthy();
+  expect(version.security).toBeTruthy();
+});
+
+tap.test('RustSecurityBridge - validateEmail with valid address', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const result = await bridge.validateEmail('test@example.com');
+  expect(result.valid).toBeTrue();
+  expect(result.formatValid).toBeTrue();
+});
+
+tap.test('RustSecurityBridge - validateEmail with invalid address', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const result = await bridge.validateEmail('not-an-email');
+  expect(result.formatValid).toBeFalse();
+});
+
+tap.test('RustSecurityBridge - detectBounce with known SMTP response', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const result = await bridge.detectBounce({
+    smtpResponse: '550 5.1.1 User unknown',
+  });
+  expect(result.bounce_type).toBeTruthy();
+  expect(result.category).toBeTruthy();
+});
+
+tap.test('RustSecurityBridge - checkIpReputation', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  // Use a well-known IP that should NOT be on blacklists
+  const result = await bridge.checkIpReputation('8.8.8.8');
+  expect(result.ip).toEqual('8.8.8.8');
+  expect(typeof result.score).toEqual('number');
+  expect(result.score).toBeGreaterThan(0);
+});
+
+tap.test('RustSecurityBridge - verifyDkim with unsigned message', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const rawMessage = 'From: test@example.com\r\nTo: receiver@example.com\r\nSubject: Test\r\n\r\nHello';
+  const results = await bridge.verifyDkim(rawMessage);
+  expect(results.length).toBeGreaterThan(0);
+  expect(results[0].status).toEqual('none'); // no DKIM signature
+});
+
+tap.test('RustSecurityBridge - verifyEmail compound call', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  const rawMessage = 'From: test@example.com\r\nTo: receiver@example.com\r\nSubject: Test\r\n\r\nHello';
+  const result = await bridge.verifyEmail({
+    rawMessage,
+    ip: '93.184.216.34', // example.com IP
+    heloDomain: 'example.com',
+    hostname: 'mail.test.local',
+    mailFrom: 'test@example.com',
+  });
+  expect(result.dkim).toBeTruthy();
+  expect(result.dkim.length).toBeGreaterThan(0);
+  expect(result.spf).toBeTruthy();
+  // DMARC may or may not be present depending on DNS
+});
+
+tap.test('RustSecurityBridge - should stop gracefully', async () => {
+  if (!bridge.running) {
+    console.log('SKIP: bridge not running');
+    return;
+  }
+  await bridge.stop();
+  expect(bridge.running).toBeFalse();
+});
+
+tap.test('RustSecurityBridge - commands should fail when bridge is stopped', async () => {
+  // Bridge should not be running now
+  expect(bridge.running).toBeFalse();
+  try {
+    await bridge.ping();
+    // If we get here, the bridge auto-restarted or something unexpected
+    expect(true).toBeFalse(); // Should not reach here
+  } catch (err) {
+    expect(err).toBeTruthy(); // Expected: bridge not running error
+  }
+});
+
+export default tap.start();

ts/00_commitinfo_data.ts

@@ -2,7 +2,7 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-  name: '@serve.zone/mailer',
+  name: '@push.rocks/smartmta',
-  version: '1.3.1',
+  version: '2.2.0',
-  description: 'Enterprise mail server with SMTP, HTTP API, and DNS management - built for serve.zone infrastructure'
+  description: 'A high-performance, enterprise-grade Mail Transfer Agent (MTA) built from scratch in TypeScript with Rust acceleration.'
 }

ts/mail/core/classes.bouncemanager.ts

@@ -2,6 +2,7 @@ import * as plugins from '../../plugins.js';
 import * as paths from '../../paths.js';
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import { LRUCache } from 'lru-cache';
 import type { Email } from './classes.email.js';
 
@@ -63,112 +64,6 @@ export interface BounceRecord {
   nextRetryTime?: number;
 }
 
-/**
- * Email bounce patterns to identify bounce types in SMTP responses and bounce messages
- */
-const BOUNCE_PATTERNS = {
-  // Hard bounce patterns
-  [BounceType.INVALID_RECIPIENT]: [
-    /no such user/i,
-    /user unknown/i,
-    /does not exist/i,
-    /invalid recipient/i,
-    /unknown recipient/i,
-    /no mailbox/i,
-    /user not found/i,
-    /recipient address rejected/i,
-    /550 5\.1\.1/i
-  ],
-  [BounceType.DOMAIN_NOT_FOUND]: [
-    /domain not found/i,
-    /unknown domain/i,
-    /no such domain/i,
-    /host not found/i,
-    /domain invalid/i,
-    /550 5\.1\.2/i
-  ],
-  [BounceType.MAILBOX_FULL]: [
-    /mailbox full/i,
-    /over quota/i,
-    /quota exceeded/i,
-    /552 5\.2\.2/i
-  ],
-  [BounceType.MAILBOX_INACTIVE]: [
-    /mailbox disabled/i,
-    /mailbox inactive/i,
-    /account disabled/i,
-    /mailbox not active/i,
-    /account suspended/i
-  ],
-  [BounceType.BLOCKED]: [
-    /blocked/i,
-    /rejected/i,
-    /denied/i,
-    /blacklisted/i,
-    /prohibited/i,
-    /refused/i,
-    /550 5\.7\./i
-  ],
-  [BounceType.SPAM_RELATED]: [
-    /spam/i,
-    /bulk mail/i,
-    /content rejected/i,
-    /message rejected/i,
-    /550 5\.7\.1/i
-  ],
-  
-  // Soft bounce patterns
-  [BounceType.SERVER_UNAVAILABLE]: [
-    /server unavailable/i,
-    /service unavailable/i,
-    /try again later/i,
-    /try later/i,
-    /451 4\.3\./i,
-    /421 4\.3\./i
-  ],
-  [BounceType.TEMPORARY_FAILURE]: [
-    /temporary failure/i,
-    /temporary error/i,
-    /temporary problem/i,
-    /try again/i,
-    /451 4\./i
-  ],
-  [BounceType.QUOTA_EXCEEDED]: [
-    /quota temporarily exceeded/i,
-    /mailbox temporarily full/i,
-    /452 4\.2\.2/i
-  ],
-  [BounceType.NETWORK_ERROR]: [
-    /network error/i,
-    /connection error/i,
-    /connection timed out/i,
-    /routing error/i,
-    /421 4\.4\./i
-  ],
-  [BounceType.TIMEOUT]: [
-    /timed out/i,
-    /timeout/i,
-    /450 4\.4\.2/i
-  ],
-  
-  // Auto-responses
-  [BounceType.AUTO_RESPONSE]: [
-    /auto[- ]reply/i,
-    /auto[- ]response/i,
-    /vacation/i,
-    /out of office/i,
-    /away from office/i,
-    /on vacation/i,
-    /automatic reply/i
-  ],
-  [BounceType.CHALLENGE_RESPONSE]: [
-    /challenge[- ]response/i,
-    /verify your email/i,
-    /confirm your email/i,
-    /email verification/i
-  ]
-};
-
 /**
  * Retry strategy configuration for soft bounces
  */
@@ -269,16 +164,16 @@ export class BounceManager {
         nextRetryTime: bounceData.nextRetryTime
       };
       
-      // Determine bounce type and category if not provided
+      // Determine bounce type and category via Rust bridge if not provided
       if (!bounceData.bounceType || bounceData.bounceType === BounceType.UNKNOWN) {
-        const bounceInfo = this.detectBounceType(
+        const bridge = RustSecurityBridge.getInstance();
-          bounce.smtpResponse || '',
+        const rustResult = await bridge.detectBounce({
-          bounce.diagnosticCode || '',
+          smtpResponse: bounce.smtpResponse,
-          bounce.statusCode || ''
+          diagnosticCode: bounce.diagnosticCode,
-        );
+          statusCode: bounce.statusCode,
-        
+        });
-        bounce.bounceType = bounceInfo.type;
+        bounce.bounceType = rustResult.bounce_type as BounceType;
-        bounce.bounceCategory = bounceInfo.category;
+        bounce.bounceCategory = rustResult.category as BounceCategory;
       }
       
       // Process the bounce based on category
@@ -791,134 +686,6 @@ export class BounceManager {
     return this.bounceCache.get(email.toLowerCase()) || null;
   }
   
-  /**
-   * Analyze SMTP response and diagnostic codes to determine bounce type
-   * @param smtpResponse SMTP response string
-   * @param diagnosticCode Diagnostic code from bounce
-   * @param statusCode Status code from bounce
-   * @returns Detected bounce type and category
-   */
-  private detectBounceType(
-    smtpResponse: string,
-    diagnosticCode: string,
-    statusCode: string
-  ): {
-    type: BounceType;
-    category: BounceCategory;
-  } {
-    // Combine all text for comprehensive pattern matching
-    const fullText = `${smtpResponse} ${diagnosticCode} ${statusCode}`.toLowerCase();
-    
-    // Check for auto-responses first
-    if (this.matchesPattern(fullText, BounceType.AUTO_RESPONSE) || 
-        this.matchesPattern(fullText, BounceType.CHALLENGE_RESPONSE)) {
-      return {
-        type: BounceType.AUTO_RESPONSE,
-        category: BounceCategory.AUTO_RESPONSE
-      };
-    }
-    
-    // Check for hard bounces
-    for (const bounceType of [
-      BounceType.INVALID_RECIPIENT,
-      BounceType.DOMAIN_NOT_FOUND,
-      BounceType.MAILBOX_FULL,
-      BounceType.MAILBOX_INACTIVE,
-      BounceType.BLOCKED,
-      BounceType.SPAM_RELATED,
-      BounceType.POLICY_RELATED
-    ]) {
-      if (this.matchesPattern(fullText, bounceType)) {
-        return {
-          type: bounceType,
-          category: BounceCategory.HARD
-        };
-      }
-    }
-    
-    // Check for soft bounces
-    for (const bounceType of [
-      BounceType.SERVER_UNAVAILABLE,
-      BounceType.TEMPORARY_FAILURE,
-      BounceType.QUOTA_EXCEEDED,
-      BounceType.NETWORK_ERROR,
-      BounceType.TIMEOUT
-    ]) {
-      if (this.matchesPattern(fullText, bounceType)) {
-        return {
-          type: bounceType,
-          category: BounceCategory.SOFT
-        };
-      }
-    }
-    
-    // Handle DSN (Delivery Status Notification) status codes
-    if (statusCode) {
-      // Format: class.subject.detail
-      const parts = statusCode.split('.');
-      if (parts.length >= 2) {
-        const statusClass = parts[0];
-        const statusSubject = parts[1];
-        
-        // 5.X.X is permanent failure (hard bounce)
-        if (statusClass === '5') {
-          // Try to determine specific type based on subject
-          if (statusSubject === '1') {
-            return { type: BounceType.INVALID_RECIPIENT, category: BounceCategory.HARD };
-          } else if (statusSubject === '2') {
-            return { type: BounceType.MAILBOX_FULL, category: BounceCategory.HARD };
-          } else if (statusSubject === '7') {
-            return { type: BounceType.BLOCKED, category: BounceCategory.HARD };
-          } else {
-            return { type: BounceType.UNKNOWN, category: BounceCategory.HARD };
-          }
-        }
-        
-        // 4.X.X is temporary failure (soft bounce)
-        if (statusClass === '4') {
-          // Try to determine specific type based on subject
-          if (statusSubject === '2') {
-            return { type: BounceType.QUOTA_EXCEEDED, category: BounceCategory.SOFT };
-          } else if (statusSubject === '3') {
-            return { type: BounceType.SERVER_UNAVAILABLE, category: BounceCategory.SOFT };
-          } else if (statusSubject === '4') {
-            return { type: BounceType.NETWORK_ERROR, category: BounceCategory.SOFT };
-          } else {
-            return { type: BounceType.TEMPORARY_FAILURE, category: BounceCategory.SOFT };
-          }
-        }
-      }
-    }
-    
-    // Default to unknown
-    return {
-      type: BounceType.UNKNOWN,
-      category: BounceCategory.UNKNOWN
-    };
-  }
-  
-  /**
-   * Check if text matches any pattern for a bounce type
-   * @param text Text to check against patterns
-   * @param bounceType Bounce type to get patterns for
-   * @returns Whether the text matches any pattern
-   */
-  private matchesPattern(text: string, bounceType: BounceType): boolean {
-    const patterns = BOUNCE_PATTERNS[bounceType];
-    
-    if (!patterns) {
-      return false;
-    }
-    
-    for (const pattern of patterns) {
-      if (pattern.test(text)) {
-        return true;
-      }
-    }
-    
-    return false;
-  }
-  
   /**
    * Get all known hard bounced addresses
    * @returns Array of hard bounced email addresses

ts/mail/delivery/classes.delivery.system.ts

@@ -12,6 +12,7 @@ import { UnifiedDeliveryQueue, type IQueueItem } from './classes.delivery.queue.
 import type { Email } from '../core/classes.email.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
 import type { SmtpClient } from './smtpclient/smtp-client.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 
 /**
  * Delivery status enumeration
@@ -764,32 +765,23 @@ export class MultiModeDeliverySystem extends EventEmitter {
       // Ensure DKIM keys exist for the domain
       await this.emailServer.dkimCreator.handleDKIMKeysForDomain(domainName);
 
+      // Get the private key
+      const dkimPrivateKey = (await this.emailServer.dkimCreator.readDKIMKeys(domainName)).privateKey;
+
       // Convert Email to raw format for signing
       const rawEmail = email.toRFC822String();
 
-      // Sign the email
+      // Sign via Rust bridge
-      const dkimPrivateKey = (await this.emailServer.dkimCreator.readDKIMKeys(domainName)).privateKey;
+      const bridge = RustSecurityBridge.getInstance();
-      const signResult = await plugins.dkimSign(rawEmail, {
+      const signResult = await bridge.signDkim({
-        signingDomain: domainName,
+        rawMessage: rawEmail,
+        domain: domainName,
         selector: keySelector,
         privateKey: dkimPrivateKey,
-        canonicalization: 'relaxed/relaxed',
-        algorithm: 'rsa-sha256',
-        signTime: new Date(),
-        signatureData: [
-          {
-            signingDomain: domainName,
-            selector: keySelector,
-            privateKey: dkimPrivateKey,
-            algorithm: 'rsa-sha256',
-            canonicalization: 'relaxed/relaxed'
-          }
-        ]
       });
 
-      // Add the DKIM-Signature header to the email
+      if (signResult.header) {
-      if (signResult.signatures) {
+        email.addHeader('DKIM-Signature', signResult.header);
-        email.addHeader('DKIM-Signature', signResult.signatures);
         logger.log('info', `Successfully added DKIM signature for ${domainName}`);
       }
     } catch (error) {

ts/mail/delivery/classes.emailsignjob.ts

@@ -1,5 +1,6 @@
 import * as plugins from '../../plugins.js';
 import type { UnifiedEmailServer } from '../routing/classes.unified.email.server.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 
 interface Headers {
   [key: string]: string;
@@ -28,24 +29,13 @@ export class EmailSignJob {
 
   public async getSignatureHeader(emailMessage: string): Promise<string> {
     const privateKey = await this.loadPrivateKey();
-    const signResult = await plugins.dkimSign(emailMessage, {
+    const bridge = RustSecurityBridge.getInstance();
-      signingDomain: this.jobOptions.domain,
+    const signResult = await bridge.signDkim({
+      rawMessage: emailMessage,
+      domain: this.jobOptions.domain,
       selector: this.jobOptions.selector,
       privateKey,
-      canonicalization: 'relaxed/relaxed',
-      algorithm: 'rsa-sha256',
-      signTime: new Date(),
-      signatureData: [
-        {
-          signingDomain: this.jobOptions.domain,
-          selector: this.jobOptions.selector,
-          privateKey,
-          algorithm: 'rsa-sha256',
-          canonicalization: 'relaxed/relaxed',
-        },
-      ],
     });
-    const signature = signResult.signatures;
+    return signResult.header;
-    return signature;
   }
 }

ts/mail/delivery/classes.smtp.client.legacy.ts

@@ -5,6 +5,7 @@ import {
   SecurityLogLevel,
   SecurityEventType
 } from '../../security/index.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 
 import { 
   MtaConnectionError, 
@@ -845,39 +846,19 @@ export class SmtpClient {
     try {
       logger.log('debug', `Signing email with DKIM for domain ${this.options.dkim.domain}`);
 
-      // Format email for DKIM signing
-      const { dkimSign } = plugins;
       const emailContent = await this.getFormattedEmail(email);
 
-      // Sign email
+      // Sign via Rust bridge
-      const signOptions = {
+      const bridge = RustSecurityBridge.getInstance();
-        signingDomain: this.options.dkim.domain,
+      const signResult = await bridge.signDkim({
+        rawMessage: emailContent,
+        domain: this.options.dkim.domain,
         selector: this.options.dkim.selector,
         privateKey: this.options.dkim.privateKey,
-        canonicalization: 'relaxed/relaxed' as const,
+      });
-        algorithm: 'rsa-sha256' as const,
-        signTime: new Date(),
-        signatureData: [
-          {
-            signingDomain: this.options.dkim.domain,
-            selector: this.options.dkim.selector,
-            privateKey: this.options.dkim.privateKey,
-            algorithm: 'rsa-sha256',
-            canonicalization: 'relaxed/relaxed',
-          }
-        ]
-      };
 
-      const signResult = await dkimSign(emailContent, signOptions);
+      if (signResult.header) {
-
+        email.addHeader('DKIM-Signature', signResult.header);
-      // Add DKIM-Signature header from the signing result
-      if (signResult.signatures) {
-        const dkimHeader = signResult.signatures.split('\r\n')
-          .find(line => line.startsWith('DKIM-Signature: '));
-
-        if (dkimHeader) {
-          email.addHeader('DKIM-Signature', dkimHeader.substring('DKIM-Signature: '.length));
-        }
       }
 
       logger.log('debug', 'DKIM signature applied successfully');

ts/mail/routing/classes.unified.email.server.ts

@@ -9,6 +9,8 @@ import {
 } from '../../security/index.js';
 import { DKIMCreator } from '../security/classes.dkimcreator.js';
 import { IPReputationChecker } from '../../security/classes.ipreputationchecker.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
+import type { IEmailReceivedEvent, IAuthRequestEvent, IEmailData } from '../../security/classes.rustsecuritybridge.js';
 // Deliverability types (IPWarmupManager and SenderReputationMonitor are optional external modules)
 interface IIPWarmupConfig {
   enabled?: boolean;
@@ -192,7 +194,8 @@ export class UnifiedEmailServer extends EventEmitter {
   
   // Add components needed for sending and securing emails
   public dkimCreator: DKIMCreator;
-  private ipReputationChecker: IPReputationChecker; // TODO: Implement IP reputation checks in processEmailByMode
+  private rustBridge: RustSecurityBridge;
+  private ipReputationChecker: IPReputationChecker;
   private bounceManager: BounceManager;
   private ipWarmupManager: IPWarmupManager | null;
   private senderReputationMonitor: SenderReputationMonitor | null;
@@ -217,6 +220,9 @@ export class UnifiedEmailServer extends EventEmitter {
       socketTimeout: options.socketTimeout || 60000 // 1 minute
     };
     
+    // Initialize Rust security bridge (singleton)
+    this.rustBridge = RustSecurityBridge.getInstance();
+
     // Initialize DKIM creator with storage manager
     this.dkimCreator = new DKIMCreator(paths.keysDir, dcRouter.storageManager);
     
@@ -361,6 +367,13 @@ export class UnifiedEmailServer extends EventEmitter {
       await this.deliverySystem.start();
       logger.log('info', 'Email delivery system started');
 
+      // Start Rust security bridge — required for all security operations
+      const bridgeOk = await this.rustBridge.start();
+      if (!bridgeOk) {
+        throw new Error('Rust security bridge failed to start. The mailer-bin binary is required. Run "pnpm build" to compile it.');
+      }
+      logger.log('info', 'Rust security bridge started — Rust is the primary security backend');
+
       // Set up DKIM for all domains
       await this.setupDkimForDomains();
       logger.log('info', 'DKIM configuration completed for all domains');
@@ -389,104 +402,81 @@ export class UnifiedEmailServer extends EventEmitter {
       const hasTlsConfig = this.options.tls?.keyPath && this.options.tls?.certPath;
 
       // Prepare the certificate and key if available
-      let key: string | undefined;
+      let tlsCertPem: string | undefined;
-      let cert: string | undefined;
+      let tlsKeyPem: string | undefined;
 
       if (hasTlsConfig) {
         try {
-          key = plugins.fs.readFileSync(this.options.tls.keyPath!, 'utf8');
+          tlsKeyPem = plugins.fs.readFileSync(this.options.tls.keyPath!, 'utf8');
-          cert = plugins.fs.readFileSync(this.options.tls.certPath!, 'utf8');
+          tlsCertPem = plugins.fs.readFileSync(this.options.tls.certPath!, 'utf8');
           logger.log('info', 'TLS certificates loaded successfully');
         } catch (error) {
           logger.log('warn', `Failed to load TLS certificates: ${error.message}`);
         }
       }
 
-      // Create a SMTP server for each port
+      // --- Start Rust SMTP server ---
-      for (const port of this.options.ports as number[]) {
+      // Register event handlers for email reception and auth
-        // Create a reference object to hold the MTA service during setup
+      this.rustBridge.onEmailReceived(async (data) => {
-        const mtaRef = {
+        try {
-          config: {
+          await this.handleRustEmailReceived(data);
-            smtp: {
+        } catch (err) {
-              hostname: this.options.hostname
+          logger.log('error', `Error handling email from Rust SMTP: ${(err as Error).message}`);
-            },
+          // Send rejection back to Rust
-            security: {
+          await this.rustBridge.sendEmailProcessingResult({
-              checkIPReputation: false,
+            correlationId: data.correlationId,
-              verifyDkim: true,
+            accepted: false,
-              verifySpf: true,
+            smtpCode: 451,
-              verifyDmarc: true
+            smtpMessage: 'Internal processing error',
-            }
+          });
-          },
+        }
-          // These will be implemented in the real integration:
+      });
-          dkimVerifier: {
-            verify: async () => ({ isValid: true, domain: '' })
-          },
-          spfVerifier: {
-            verifyAndApply: async () => true
-          },
-          dmarcVerifier: {
-            verify: async () => ({}),
-            applyPolicy: () => true
-          },
-          processIncomingEmail: async (email: Email) => {
-            // Process email using the new route-based system
-            await this.processEmailByMode(email, { 
-              id: 'session-' + Math.random().toString(36).substring(2),
-              state: SmtpState.FINISHED,
-              mailFrom: email.from,
-              rcptTo: email.to,
-              emailData: email.toRFC822String(), // Use the proper method to get the full email content
-              useTLS: false,
-              connectionEnded: true,
-              remoteAddress: '127.0.0.1',
-              clientHostname: '',
-              secure: false,
-              authenticated: false,
-              envelope: {
-                mailFrom: { address: email.from, args: {} },
-                rcptTo: email.to.map(recipient => ({ address: recipient, args: {} }))
-              }
-            });
 
-            return true;
+      this.rustBridge.onAuthRequest(async (data) => {
-          }
+        try {
-        };
+          await this.handleRustAuthRequest(data);
+        } catch (err) {
+          logger.log('error', `Error handling auth from Rust SMTP: ${(err as Error).message}`);
+          await this.rustBridge.sendAuthResult({
+            correlationId: data.correlationId,
+            success: false,
+            message: 'Internal auth error',
+          });
+        }
+      });
 
-        // Create server options
+      // Determine which ports need STARTTLS and which need implicit TLS
-        const serverOptions = {
+      const smtpPorts = (this.options.ports as number[]).filter(p => p !== 465);
-          port,
+      const securePort = (this.options.ports as number[]).find(p => p === 465);
-          hostname: this.options.hostname,
-          key,
-          cert
-        };
 
-        // Create and start the SMTP server
+      const started = await this.rustBridge.startSmtpServer({
-        const smtpServer = createSmtpServer(mtaRef as any, serverOptions);
+        hostname: this.options.hostname,
-        this.servers.push(smtpServer);
+        ports: smtpPorts,
+        securePort: securePort,
+        tlsCertPem,
+        tlsKeyPem,
+        maxMessageSize: this.options.maxMessageSize || 10 * 1024 * 1024,
+        maxConnections: this.options.maxConnections || this.options.maxClients || 100,
+        maxRecipients: 100,
+        connectionTimeoutSecs: this.options.connectionTimeout ? Math.floor(this.options.connectionTimeout / 1000) : 30,
+        dataTimeoutSecs: 60,
+        authEnabled: !!this.options.auth?.required || !!(this.options.auth?.users?.length),
+        maxAuthFailures: 3,
+        socketTimeoutSecs: this.options.socketTimeout ? Math.floor(this.options.socketTimeout / 1000) : 300,
+        processingTimeoutSecs: 30,
+        rateLimits: this.options.rateLimits ? {
+          maxConnectionsPerIp: this.options.rateLimits.global?.maxConnectionsPerIP || 50,
+          maxMessagesPerSender: this.options.rateLimits.global?.maxMessagesPerMinute || 100,
+          maxAuthFailuresPerIp: this.options.rateLimits.global?.maxAuthFailuresPerIP || 5,
+          windowSecs: 60,
+        } : undefined,
+      });
 
-        // Start the server
+      if (!started) {
-        await new Promise<void>((resolve, reject) => {
+        throw new Error('Failed to start Rust SMTP server');
-          try {
-            // Leave this empty for now, smtpServer.start() is handled by the SMTPServer class internally
-            // The server is started when it's created
-            logger.log('info', `UnifiedEmailServer listening on port ${port}`);
-            
-            // Event handlers are managed internally by the SmtpServer class
-            // No need to access the private server property
-            
-            resolve();
-          } catch (err) {
-            if ((err as any).code === 'EADDRINUSE') {
-              logger.log('error', `Port ${port} is already in use`);
-              reject(new Error(`Port ${port} is already in use`));
-            } else {
-              logger.log('error', `Error starting server on port ${port}: ${err.message}`);
-              reject(err);
-            }
-          }
-        });
       }
 
+      logger.log('info', `Rust SMTP server listening on ports: ${smtpPorts.join(', ')}${securePort ? ` + ${securePort} (TLS)` : ''}`);
       logger.log('info', 'UnifiedEmailServer started successfully');
       this.emit('started');
     } catch (error) {
@@ -550,9 +540,20 @@ export class UnifiedEmailServer extends EventEmitter {
     logger.log('info', 'Stopping UnifiedEmailServer');
     
     try {
+      // Stop the Rust SMTP server first
+      try {
+        await this.rustBridge.stopSmtpServer();
+        logger.log('info', 'Rust SMTP server stopped');
+      } catch (err) {
+        logger.log('warn', `Error stopping Rust SMTP server: ${(err as Error).message}`);
+      }
+
       // Clear the servers array - servers will be garbage collected
       this.servers = [];
 
+      // Stop Rust security bridge
+      await this.rustBridge.stop();
+
       // Stop the delivery system
       if (this.deliverySystem) {
         await this.deliverySystem.stop();
@@ -584,9 +585,163 @@ export class UnifiedEmailServer extends EventEmitter {
     }
   }
 
+  // -----------------------------------------------------------------------
+  // Rust SMTP server event handlers
+  // -----------------------------------------------------------------------
 
+  /**
+   * Handle an emailReceived event from the Rust SMTP server.
+   * Decodes the email data, processes it through the routing system,
+   * and sends back the result via the correlation-ID callback.
+   */
+  private async handleRustEmailReceived(data: IEmailReceivedEvent): Promise<void> {
+    const { correlationId, mailFrom, rcptTo, remoteAddr, clientHostname, secure, authenticatedUser } = data;
 
+    logger.log('info', `Rust SMTP received email from=${mailFrom} to=${rcptTo.join(',')} remote=${remoteAddr}`);
 
+    try {
+      // Decode the email data
+      let rawMessageBuffer: Buffer;
+      if (data.data.type === 'inline' && data.data.base64) {
+        rawMessageBuffer = Buffer.from(data.data.base64, 'base64');
+      } else if (data.data.type === 'file' && data.data.path) {
+        rawMessageBuffer = plugins.fs.readFileSync(data.data.path);
+        // Clean up temp file
+        try {
+          plugins.fs.unlinkSync(data.data.path);
+        } catch {
+          // Ignore cleanup errors
+        }
+      } else {
+        throw new Error('Invalid email data transport');
+      }
+
+      // Build a session-like object for processEmailByMode
+      const session: IExtendedSmtpSession = {
+        id: data.sessionId || 'rust-' + Math.random().toString(36).substring(2),
+        state: SmtpState.FINISHED,
+        mailFrom: mailFrom,
+        rcptTo: rcptTo,
+        emailData: rawMessageBuffer.toString('utf8'),
+        useTLS: secure,
+        connectionEnded: false,
+        remoteAddress: remoteAddr,
+        clientHostname: clientHostname || '',
+        secure: secure,
+        authenticated: !!authenticatedUser,
+        envelope: {
+          mailFrom: { address: mailFrom, args: {} },
+          rcptTo: rcptTo.map(addr => ({ address: addr, args: {} })),
+        },
+      };
+
+      if (authenticatedUser) {
+        session.user = { username: authenticatedUser };
+      }
+
+      // Process the email through the routing system
+      await this.processEmailByMode(rawMessageBuffer, session);
+
+      // Send acceptance back to Rust
+      await this.rustBridge.sendEmailProcessingResult({
+        correlationId,
+        accepted: true,
+        smtpCode: 250,
+        smtpMessage: '2.0.0 Message accepted for delivery',
+      });
+    } catch (err) {
+      logger.log('error', `Failed to process email from Rust SMTP: ${(err as Error).message}`);
+      await this.rustBridge.sendEmailProcessingResult({
+        correlationId,
+        accepted: false,
+        smtpCode: 550,
+        smtpMessage: `5.0.0 Processing failed: ${(err as Error).message}`,
+      });
+    }
+  }
+
+  /**
+   * Handle an authRequest event from the Rust SMTP server.
+   * Validates credentials and sends back the result.
+   */
+  private async handleRustAuthRequest(data: IAuthRequestEvent): Promise<void> {
+    const { correlationId, username, password, remoteAddr } = data;
+
+    logger.log('info', `Rust SMTP auth request for user=${username} from=${remoteAddr}`);
+
+    // Check against configured users
+    const users = this.options.auth?.users || [];
+    const matched = users.find(
+      u => u.username === username && u.password === password
+    );
+
+    if (matched) {
+      await this.rustBridge.sendAuthResult({
+        correlationId,
+        success: true,
+      });
+    } else {
+      logger.log('warn', `Auth failed for user=${username} from=${remoteAddr}`);
+      await this.rustBridge.sendAuthResult({
+        correlationId,
+        success: false,
+        message: 'Invalid credentials',
+      });
+    }
+  }
+
+  /**
+   * Verify inbound email security (DKIM/SPF/DMARC) using the Rust bridge.
+   * Falls back gracefully if the bridge is not running.
+   */
+  private async verifyInboundSecurity(email: Email, session: IExtendedSmtpSession): Promise<void> {
+    try {
+      const rawMessage = session.emailData || email.toRFC822String();
+      const result = await this.rustBridge.verifyEmail({
+        rawMessage,
+        ip: session.remoteAddress,
+        heloDomain: session.clientHostname || '',
+        hostname: this.options.hostname,
+        mailFrom: session.envelope?.mailFrom?.address || session.mailFrom || '',
+      });
+
+      // Apply DKIM result headers
+      if (result.dkim && result.dkim.length > 0) {
+        const dkimSummary = result.dkim
+          .map(d => `${d.status}${d.domain ? ` (${d.domain})` : ''}`)
+          .join(', ');
+        email.addHeader('X-DKIM-Result', dkimSummary);
+      }
+
+      // Apply SPF result header
+      if (result.spf) {
+        email.addHeader('Received-SPF', `${result.spf.result} (domain: ${result.spf.domain}, ip: ${result.spf.ip})`);
+
+        // Mark as spam on SPF hard fail
+        if (result.spf.result === 'fail') {
+          email.mightBeSpam = true;
+          logger.log('warn', `SPF fail for ${session.remoteAddress} — marking as potential spam`);
+        }
+      }
+
+      // Apply DMARC result header and policy
+      if (result.dmarc) {
+        email.addHeader('X-DMARC-Result', `${result.dmarc.action} (policy=${result.dmarc.policy}, dkim=${result.dmarc.dkim_result}, spf=${result.dmarc.spf_result})`);
+
+        if (result.dmarc.action === 'reject') {
+          email.mightBeSpam = true;
+          logger.log('warn', `DMARC reject for domain ${result.dmarc.domain} — marking as spam`);
+        } else if (result.dmarc.action === 'quarantine') {
+          email.mightBeSpam = true;
+          logger.log('info', `DMARC quarantine for domain ${result.dmarc.domain} — marking as potential spam`);
+        }
+      }
+
+      logger.log('info', `Inbound security verified for email from ${session.remoteAddress}: DKIM=${result.dkim?.[0]?.status ?? 'none'}, SPF=${result.spf?.result ?? 'none'}, DMARC=${result.dmarc?.action ?? 'none'}`);
+    } catch (err) {
+      logger.log('warn', `Inbound security verification failed: ${(err as Error).message} — accepting email`);
+    }
+  }
 
   /**
    * Process email based on routing rules
@@ -618,6 +773,11 @@ export class UnifiedEmailServer extends EventEmitter {
       email = emailData;
     }
 
+    // Run inbound security verification (DKIM/SPF/DMARC) via Rust bridge
+    if (session.remoteAddress && session.remoteAddress !== '127.0.0.1') {
+      await this.verifyInboundSecurity(email, session);
+    }
+
     // First check if this is a bounce notification email
     // Look for common bounce notification subject patterns
     const subject = email.subject || '';
@@ -836,52 +996,10 @@ export class UnifiedEmailServer extends EventEmitter {
         
         // Apply DKIM signing if enabled
         if (options.dkimSign && options.dkimOptions) {
-          // Sign the email with DKIM
+          const dkimDomain = options.dkimOptions.domainName;
-          logger.log('info', `Signing email with DKIM for domain ${options.dkimOptions.domainName}`);
+          const dkimSelector = options.dkimOptions.keySelector || 'mta';
-          
+          logger.log('info', `Signing email with DKIM for domain ${dkimDomain}`);
-          try {
+          await this.handleDkimSigning(email, dkimDomain, dkimSelector);
-            // Ensure DKIM keys exist for the domain
-            await this.dkimCreator.handleDKIMKeysForDomain(options.dkimOptions.domainName);
-            
-            // Convert Email to raw format for signing
-            const rawEmail = email.toRFC822String();
-            
-            // Create headers object
-            const headers = {};
-            for (const [key, value] of Object.entries(email.headers)) {
-              headers[key] = value;
-            }
-            
-            // Sign the email
-            const dkimDomain = options.dkimOptions.domainName;
-            const dkimSelector = options.dkimOptions.keySelector || 'mta';
-            const dkimPrivateKey = (await this.dkimCreator.readDKIMKeys(dkimDomain)).privateKey;
-            const signResult = await plugins.dkimSign(rawEmail, {
-              signingDomain: dkimDomain,
-              selector: dkimSelector,
-              privateKey: dkimPrivateKey,
-              canonicalization: 'relaxed/relaxed',
-              algorithm: 'rsa-sha256',
-              signTime: new Date(),
-              signatureData: [
-                {
-                  signingDomain: dkimDomain,
-                  selector: dkimSelector,
-                  privateKey: dkimPrivateKey,
-                  algorithm: 'rsa-sha256',
-                  canonicalization: 'relaxed/relaxed'
-                }
-              ]
-            });
-            
-            // Add the DKIM-Signature header to the email
-            if (signResult.signatures) {
-              email.addHeader('DKIM-Signature', signResult.signatures);
-              logger.log('info', `Successfully added DKIM signature for ${options.dkimOptions.domainName}`);
-            }
-          } catch (error) {
-            logger.log('error', `Failed to sign email with DKIM: ${error.message}`);
-          }
         }
       }
       
@@ -1456,28 +1574,16 @@ export class UnifiedEmailServer extends EventEmitter {
       // Convert Email to raw format for signing
       const rawEmail = email.toRFC822String();
 
-      // Sign the email
+      // Sign the email via Rust bridge
-      const signResult = await plugins.dkimSign(rawEmail, {
+      const signResult = await this.rustBridge.signDkim({
-        signingDomain: domain,
+        rawMessage: rawEmail,
-        selector: selector,
+        domain,
-        privateKey: privateKey,
+        selector,
-        canonicalization: 'relaxed/relaxed',
+        privateKey,
-        algorithm: 'rsa-sha256',
-        signTime: new Date(),
-        signatureData: [
-          {
-            signingDomain: domain,
-            selector: selector,
-            privateKey: privateKey,
-            algorithm: 'rsa-sha256',
-            canonicalization: 'relaxed/relaxed'
-          }
-        ]
       });
 
-      // Add the DKIM-Signature header to the email
+      if (signResult.header) {
-      if (signResult.signatures) {
+        email.addHeader('DKIM-Signature', signResult.header);
-        email.addHeader('DKIM-Signature', signResult.signatures);
         logger.log('info', `Successfully added DKIM signature for ${domain}`);
       }
     } catch (error) {

ts/mail/security/classes.dkimverifier.ts

@@ -1,7 +1,6 @@
-import * as plugins from '../../plugins.js';
-// MtaService reference removed
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 
 /**
  * Result of a DKIM verification
@@ -17,23 +16,13 @@ export interface IDkimVerificationResult {
 }
 
 /**
- * Enhanced DKIM verifier using smartmail capabilities
+ * DKIM verifier — delegates to the Rust security bridge.
  */
 export class DKIMVerifier {
-  // MtaRef reference removed
+  constructor() {}
-  
-  // Cache verified results to avoid repeated verification
-  private verificationCache: Map<string, { result: IDkimVerificationResult, timestamp: number }> = new Map();
-  private cacheTtl = 30 * 60 * 1000; // 30 minutes cache
-
-  constructor() {
-  }
 
   /**
-   * Verify DKIM signature for an email
+   * Verify DKIM signature for an email via Rust bridge
-   * @param emailData The raw email data
-   * @param options Verification options
-   * @returns Verification result
    */
   public async verify(
     emailData: string,
@@ -43,232 +32,38 @@ export class DKIMVerifier {
     } = {}
   ): Promise<IDkimVerificationResult> {
     try {
-      // Generate a cache key from the first 128 bytes of the email data
+      const bridge = RustSecurityBridge.getInstance();
-      const cacheKey = emailData.slice(0, 128);
+      const results = await bridge.verifyDkim(emailData);
+      const first = results[0];
 
-      // Check cache if enabled
+      const result: IDkimVerificationResult = {
-      if (options.useCache !== false) {
+        isValid: first?.is_valid ?? false,
-        const cached = this.verificationCache.get(cacheKey);
+        domain: first?.domain ?? undefined,
+        selector: first?.selector ?? undefined,
+        status: first?.status ?? 'none',
+        details: options.returnDetails ? results : undefined,
+      };
 
-        if (cached && (Date.now() - cached.timestamp) < this.cacheTtl) {
+      SecurityLogger.getInstance().logEvent({
-          logger.log('info', 'DKIM verification result from cache');
+        level: result.isValid ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
-          return cached.result;
+        type: SecurityEventType.DKIM,
-        }
+        message: `DKIM verification ${result.isValid ? 'passed' : 'failed'} for domain ${result.domain || 'unknown'}`,
-      }
+        details: { selector: result.selector, status: result.status },
+        domain: result.domain || 'unknown',
+        success: result.isValid
+      });
 
-      // Try to verify using mailauth first
+      logger.log(result.isValid ? 'info' : 'warn',
-      try {
+        `DKIM verification: ${result.status} for domain ${result.domain || 'unknown'}`);
-        const verificationMailauth = await plugins.mailauth.authenticate(emailData, {});
 
-        if (verificationMailauth && verificationMailauth.dkim && verificationMailauth.dkim.results.length > 0) {
+      return result;
-          const dkimResult = verificationMailauth.dkim.results[0];
-          const isValid = dkimResult.status.result === 'pass';
-          
-          const result: IDkimVerificationResult = {
-            isValid,
-            domain: dkimResult.signingDomain,
-            selector: dkimResult.selector,
-            status: dkimResult.status.result,
-            signatureFields: (dkimResult as any).signature,
-            details: options.returnDetails ? verificationMailauth : undefined
-          };
-          
-          // Cache the result
-          this.verificationCache.set(cacheKey, {
-            result,
-            timestamp: Date.now()
-          });
-          
-          logger.log(isValid ? 'info' : 'warn', `DKIM Verification using mailauth: ${isValid ? 'pass' : 'fail'} for domain ${dkimResult.signingDomain}`);
-          
-          // Enhanced security logging
-          SecurityLogger.getInstance().logEvent({
-            level: isValid ? SecurityLogLevel.INFO : SecurityLogLevel.WARN,
-            type: SecurityEventType.DKIM,
-            message: `DKIM verification ${isValid ? 'passed' : 'failed'} for domain ${dkimResult.signingDomain}`,
-            details: {
-              selector: dkimResult.selector,
-              signatureFields: (dkimResult as any).signature,
-              result: dkimResult.status.result
-            },
-            domain: dkimResult.signingDomain,
-            success: isValid
-          });
-          
-          return result;
-        }
-      } catch (mailauthError) {
-        logger.log('warn', `DKIM verification with mailauth failed, trying smartmail: ${mailauthError.message}`);
-        
-        // Enhanced security logging
-        SecurityLogger.getInstance().logEvent({
-          level: SecurityLogLevel.WARN,
-          type: SecurityEventType.DKIM,
-          message: `DKIM verification with mailauth failed, trying smartmail fallback`,
-          details: { error: mailauthError.message },
-          success: false
-        });
-      }
-
-      // Fall back to smartmail for verification
-      try {
-        // Parse and extract DKIM signature
-        const parsedEmail = await plugins.mailparser.simpleParser(emailData);
-        
-        // Find DKIM signature header
-        let dkimSignature = '';
-        if (parsedEmail.headers.has('dkim-signature')) {
-          dkimSignature = parsedEmail.headers.get('dkim-signature') as string;
-        } else {
-          // No DKIM signature found
-          const result: IDkimVerificationResult = {
-            isValid: false,
-            errorMessage: 'No DKIM signature found'
-          };
-          
-          this.verificationCache.set(cacheKey, {
-            result,
-            timestamp: Date.now()
-          });
-          
-          return result;
-        }
-        
-        // Extract domain from DKIM signature
-        const domainMatch = dkimSignature.match(/d=([^;]+)/i);
-        const domain = domainMatch ? domainMatch[1].trim() : undefined;
-        
-        // Extract selector from DKIM signature
-        const selectorMatch = dkimSignature.match(/s=([^;]+)/i);
-        const selector = selectorMatch ? selectorMatch[1].trim() : undefined;
-        
-        // Parse DKIM fields
-        const signatureFields: Record<string, string> = {};
-        const fieldMatches = dkimSignature.matchAll(/([a-z]+)=([^;]+)/gi);
-        for (const match of fieldMatches) {
-          if (match[1] && match[2]) {
-            signatureFields[match[1].toLowerCase()] = match[2].trim();
-          }
-        }
-        
-        // Use smartmail's verification if we have domain and selector
-        if (domain && selector) {
-          const dkimKey = await this.fetchDkimKey(domain, selector);
-          
-          if (!dkimKey) {
-            const result: IDkimVerificationResult = {
-              isValid: false,
-              domain,
-              selector,
-              status: 'permerror',
-              errorMessage: 'DKIM public key not found',
-              signatureFields
-            };
-            
-            this.verificationCache.set(cacheKey, {
-              result,
-              timestamp: Date.now()
-            });
-            
-            return result;
-          }
-          
-          // In a real implementation, we would validate the signature here
-          // For now, if we found a key, we'll consider it valid
-          // In a future update, add actual crypto verification
-          
-          const result: IDkimVerificationResult = {
-            isValid: true,
-            domain,
-            selector,
-            status: 'pass',
-            signatureFields
-          };
-          
-          this.verificationCache.set(cacheKey, {
-            result,
-            timestamp: Date.now()
-          });
-          
-          logger.log('info', `DKIM verification using smartmail: pass for domain ${domain}`);
-          
-          // Enhanced security logging
-          SecurityLogger.getInstance().logEvent({
-            level: SecurityLogLevel.INFO,
-            type: SecurityEventType.DKIM,
-            message: `DKIM verification passed for domain ${domain} using fallback verification`,
-            details: {
-              selector,
-              signatureFields
-            },
-            domain,
-            success: true
-          });
-          
-          return result;
-        } else {
-          // Missing domain or selector
-          const result: IDkimVerificationResult = {
-            isValid: false,
-            domain,
-            selector,
-            status: 'permerror',
-            errorMessage: 'Missing domain or selector in DKIM signature',
-            signatureFields
-          };
-          
-          this.verificationCache.set(cacheKey, {
-            result,
-            timestamp: Date.now()
-          });
-          
-          logger.log('warn', `DKIM verification failed: Missing domain or selector in DKIM signature`);
-          
-          // Enhanced security logging
-          SecurityLogger.getInstance().logEvent({
-            level: SecurityLogLevel.WARN,
-            type: SecurityEventType.DKIM,
-            message: `DKIM verification failed: Missing domain or selector in signature`,
-            details: { domain, selector, signatureFields },
-            domain: domain || 'unknown',
-            success: false
-          });
-          
-          return result;
-        }
-      } catch (error) {
-        const result: IDkimVerificationResult = {
-          isValid: false,
-          status: 'temperror',
-          errorMessage: `Verification error: ${error.message}`
-        };
-        
-        this.verificationCache.set(cacheKey, {
-          result,
-          timestamp: Date.now()
-        });
-        
-        logger.log('error', `DKIM verification error: ${error.message}`);
-        
-        // Enhanced security logging
-        SecurityLogger.getInstance().logEvent({
-          level: SecurityLogLevel.ERROR,
-          type: SecurityEventType.DKIM,
-          message: `DKIM verification error during processing`,
-          details: { error: error.message },
-          success: false
-        });
-        
-        return result;
-      }
     } catch (error) {
-      logger.log('error', `DKIM verification failed with unexpected error: ${error.message}`);
+      logger.log('error', `DKIM verification failed: ${error.message}`);
 
-      // Enhanced security logging for unexpected errors
       SecurityLogger.getInstance().logEvent({
         level: SecurityLogLevel.ERROR,
         type: SecurityEventType.DKIM,
-        message: `DKIM verification failed with unexpected error`,
+        message: `DKIM verification error`,
         details: { error: error.message },
         success: false
       });
@@ -276,107 +71,16 @@ export class DKIMVerifier {
       return {
         isValid: false,
         status: 'temperror',
-        errorMessage: `Unexpected verification error: ${error.message}`
+        errorMessage: `Verification error: ${error.message}`
       };
     }
   }
 
-  /**
+  /** No-op — Rust bridge handles its own caching */
-   * Fetch DKIM public key from DNS
+  public clearCache(): void {}
-   * @param domain The domain
-   * @param selector The DKIM selector
-   * @returns The DKIM public key or null if not found
-   */
-  private async fetchDkimKey(domain: string, selector: string): Promise<string | null> {
-    try {
-      const dkimRecord = `${selector}._domainkey.${domain}`;
 
-      // Use DNS lookup from plugins
+  /** Always 0 — cache is managed by the Rust side */
-      const txtRecords = await new Promise<string[]>((resolve, reject) => {
-        plugins.dns.resolveTxt(dkimRecord, (err, records) => {
-          if (err) {
-            if (err.code === 'ENOTFOUND' || err.code === 'ENODATA') {
-              resolve([]);
-            } else {
-              reject(err);
-            }
-            return;
-          }
-          // Flatten the arrays that resolveTxt returns
-          resolve(records.map(record => record.join('')));
-        });
-      });
-      
-      if (!txtRecords || txtRecords.length === 0) {
-        logger.log('warn', `No DKIM TXT record found for ${dkimRecord}`);
-        
-        // Security logging for missing DKIM record
-        SecurityLogger.getInstance().logEvent({
-          level: SecurityLogLevel.WARN,
-          type: SecurityEventType.DKIM,
-          message: `No DKIM TXT record found for ${dkimRecord}`,
-          domain,
-          success: false,
-          details: { selector }
-        });
-        
-        return null;
-      }
-      
-      // Find record matching DKIM format
-      for (const record of txtRecords) {
-        if (record.includes('p=')) {
-          // Extract public key
-          const publicKeyMatch = record.match(/p=([^;]+)/i);
-          if (publicKeyMatch && publicKeyMatch[1]) {
-            return publicKeyMatch[1].trim();
-          }
-        }
-      }
-      
-      logger.log('warn', `No valid DKIM public key found in TXT records for ${dkimRecord}`);
-      
-      // Security logging for invalid DKIM key
-      SecurityLogger.getInstance().logEvent({
-        level: SecurityLogLevel.WARN,
-        type: SecurityEventType.DKIM,
-        message: `No valid DKIM public key found in TXT records`,
-        domain,
-        success: false,
-        details: { dkimRecord, selector }
-      });
-      
-      return null;
-    } catch (error) {
-      logger.log('error', `Error fetching DKIM key: ${error.message}`);
-      
-      // Security logging for DKIM key fetch error
-      SecurityLogger.getInstance().logEvent({
-        level: SecurityLogLevel.ERROR,
-        type: SecurityEventType.DKIM,
-        message: `Error fetching DKIM key for domain`,
-        domain,
-        success: false,
-        details: { error: error.message, selector, dkimRecord: `${selector}._domainkey.${domain}` }
-      });
-      
-      return null;
-    }
-  }
-  
-  /**
-   * Clear the verification cache
-   */
-  public clearCache(): void {
-    this.verificationCache.clear();
-    logger.log('info', 'DKIM verification cache cleared');
-  }
-  
-  /**
-   * Get the size of the verification cache
-   * @returns Number of cached items
-   */
   public getCacheSize(): number {
-    return this.verificationCache.size;
+    return 0;
   }
 }

ts/mail/security/classes.dmarcverifier.ts

@@ -1,9 +1,6 @@
-import * as plugins from '../../plugins.js';
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
-// MtaService reference removed
 import type { Email } from '../core/classes.email.js';
-import type { IDnsVerificationResult } from '../routing/classes.dnsmanager.js';
 
 /**
  * DMARC policy types

ts/mail/security/classes.spfverifier.ts

@@ -1,9 +1,8 @@
 import * as plugins from '../../plugins.js';
 import { logger } from '../../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from '../../security/index.js';
-// MtaService reference removed
+import { RustSecurityBridge } from '../../security/classes.rustsecuritybridge.js';
 import type { Email } from '../core/classes.email.js';
-import type { IDnsVerificationResult } from '../routing/classes.dnsmanager.js';
 
 /**
  * SPF result qualifiers
@@ -61,26 +60,17 @@ export interface SpfResult {
 }
 
 /**
- * Maximum lookup limit for SPF records (prevent infinite loops)
+ * Class for verifying SPF records.
- */
+ * Delegates actual SPF evaluation to the Rust security bridge.
-const MAX_SPF_LOOKUPS = 10;
+ * Retains parseSpfRecord() for lightweight local parsing.
-
-/**
- * Class for verifying SPF records
  */
 export class SpfVerifier {
-  // DNS Manager reference for verifying records
+  constructor(_dnsManager?: any) {
-  private dnsManager?: any;
+    // dnsManager is no longer needed — Rust handles DNS lookups
-  private lookupCount: number = 0;
-  
-  constructor(dnsManager?: any) {
-    this.dnsManager = dnsManager;
   }
 
   /**
-   * Parse SPF record from TXT record
+   * Parse SPF record from TXT record (pure string parsing, no DNS)
-   * @param record SPF TXT record
-   * @returns Parsed SPF record or null if invalid
    */
   public parseSpfRecord(record: string): SpfRecord | null {
     if (!record.startsWith('v=spf1')) {
@@ -94,32 +84,26 @@ export class SpfVerifier {
         modifiers: {}
       };
 
-      // Split into terms
       const terms = record.split(' ').filter(term => term.length > 0);
 
-      // Skip version term
       for (let i = 1; i < terms.length; i++) {
         const term = terms[i];
 
-        // Check if it's a modifier (name=value)
         if (term.includes('=')) {
           const [name, value] = term.split('=');
           spfRecord.modifiers[name] = value;
           continue;
         }
 
-        // Parse as mechanism
+        let qualifier = SpfQualifier.PASS;
-        let qualifier = SpfQualifier.PASS; // Default is +
         let mechanismText = term;
 
-        // Check for qualifier
         if (term.startsWith('+') || term.startsWith('-') ||
             term.startsWith('~') || term.startsWith('?')) {
           qualifier = term[0] as SpfQualifier;
           mechanismText = term.substring(1);
         }
 
-        // Parse mechanism type and value
         const colonIndex = mechanismText.indexOf(':');
         let type: SpfMechanismType;
         let value: string | undefined;
@@ -145,58 +129,7 @@ export class SpfVerifier {
   }
 
   /**
-   * Check if IP is in CIDR range
+   * Verify SPF for a given email — delegates to Rust bridge
-   * @param ip IP address to check
-   * @param cidr CIDR range
-   * @returns Whether the IP is in the CIDR range
-   */
-  private isIpInCidr(ip: string, cidr: string): boolean {
-    try {
-      const ipAddress = plugins.ip.Address4.parse(ip);
-      return ipAddress.isInSubnet(new plugins.ip.Address4(cidr));
-    } catch (error) {
-      // Try IPv6
-      try {
-        const ipAddress = plugins.ip.Address6.parse(ip);
-        return ipAddress.isInSubnet(new plugins.ip.Address6(cidr));
-      } catch (e) {
-        return false;
-      }
-    }
-  }
-  
-  /**
-   * Check if a domain has the specified IP in its A or AAAA records
-   * @param domain Domain to check
-   * @param ip IP address to check
-   * @returns Whether the domain resolves to the IP
-   */
-  private async isDomainResolvingToIp(domain: string, ip: string): Promise<boolean> {
-    try {
-      // First try IPv4
-      const ipv4Addresses = await plugins.dns.promises.resolve4(domain);
-      if (ipv4Addresses.includes(ip)) {
-        return true;
-      }
-      
-      // Then try IPv6
-      const ipv6Addresses = await plugins.dns.promises.resolve6(domain);
-      if (ipv6Addresses.includes(ip)) {
-        return true;
-      }
-      
-      return false;
-    } catch (error) {
-      return false;
-    }
-  }
-  
-  /**
-   * Verify SPF for a given email with IP and helo domain
-   * @param email Email to verify
-   * @param ip Sender IP address
-   * @param heloDomain HELO/EHLO domain used by sender
-   * @returns SPF verification result
    */
   public async verify(
     email: Email,
@@ -204,106 +137,45 @@ export class SpfVerifier {
     heloDomain: string
   ): Promise<SpfResult> {
     const securityLogger = SecurityLogger.getInstance();
-    
+    const mailFrom = email.from || '';
-    // Reset lookup count
+    const domain = mailFrom.split('@')[1] || '';
-    this.lookupCount = 0;
-    
-    // Get domain from envelope from (return-path)
-    const domain = email.getEnvelopeFrom().split('@')[1] || '';
-    
-    if (!domain) {
-      return {
-        result: 'permerror',
-        explanation: 'No envelope from domain',
-        domain: '',
-        ip
-      };
-    }
 
     try {
-      // Look up SPF record
+      const bridge = RustSecurityBridge.getInstance();
-      const spfVerificationResult = this.dnsManager ? 
+      const result = await bridge.checkSpf({
-        await this.dnsManager.verifySpfRecord(domain) :
+        ip,
-        { found: false, valid: false, error: 'DNS Manager not available' };
+        heloDomain,
+        hostname: plugins.os.hostname(),
+        mailFrom,
+      });
 
-      if (!spfVerificationResult.found) {
+      const spfResult: SpfResult = {
-        return {
+        result: result.result as SpfResult['result'],
-          result: 'none',
+        domain: result.domain,
-          explanation: 'No SPF record found',
+        ip: result.ip,
-          domain,
+        explanation: result.explanation ?? undefined,
-          ip
+      };
-        };
-      }
-      
-      if (!spfVerificationResult.valid) {
-        return {
-          result: 'permerror',
-          explanation: 'Invalid SPF record',
-          domain,
-          ip,
-          record: spfVerificationResult.value
-        };
-      }
-      
-      // Parse SPF record
-      const spfRecord = this.parseSpfRecord(spfVerificationResult.value);
-      
-      if (!spfRecord) {
-        return {
-          result: 'permerror',
-          explanation: 'Failed to parse SPF record',
-          domain,
-          ip,
-          record: spfVerificationResult.value
-        };
-      }
-      
-      // Check SPF record
-      const result = await this.checkSpfRecord(spfRecord, domain, ip);
-      
-      // Log the result
-      const spfLogLevel = result.result === 'pass' ? 
-        SecurityLogLevel.INFO : 
-        (result.result === 'fail' ? SecurityLogLevel.WARN : SecurityLogLevel.INFO);
 
       securityLogger.logEvent({
-        level: spfLogLevel,
+        level: spfResult.result === 'pass' ? SecurityLogLevel.INFO :
+               (spfResult.result === 'fail' ? SecurityLogLevel.WARN : SecurityLogLevel.INFO),
         type: SecurityEventType.SPF,
-        message: `SPF ${result.result} for ${domain} from IP ${ip}`,
+        message: `SPF ${spfResult.result} for ${spfResult.domain} from IP ${ip}`,
-        domain,
+        domain: spfResult.domain,
-        details: {
+        details: { ip, heloDomain, result: spfResult.result, explanation: spfResult.explanation },
-          ip,
+        success: spfResult.result === 'pass'
-          heloDomain,
-          result: result.result,
-          explanation: result.explanation,
-          record: spfVerificationResult.value
-        },
-        success: result.result === 'pass'
       });
 
-      return {
+      return spfResult;
-        ...result,
-        domain,
-        ip,
-        record: spfVerificationResult.value
-      };
     } catch (error) {
-      // Log error
+      logger.log('error', `SPF verification error: ${error.message}`, { domain, ip, error: error.message });
-      logger.log('error', `SPF verification error: ${error.message}`, {
-        domain,
-        ip,
-        error: error.message
-      });
 
       securityLogger.logEvent({
         level: SecurityLogLevel.ERROR,
         type: SecurityEventType.SPF,
         message: `SPF verification error for ${domain}`,
         domain,
-        details: {
+        details: { ip, error: error.message },
-          ip,
-          error: error.message
-        },
         success: false
       });
 
@@ -318,245 +190,7 @@ export class SpfVerifier {
   }
 
   /**
-   * Check SPF record against IP address
+   * Check if email passes SPF verification and apply headers
-   * @param spfRecord Parsed SPF record
-   * @param domain Domain being checked
-   * @param ip IP address to check
-   * @returns SPF result
-   */
-  private async checkSpfRecord(
-    spfRecord: SpfRecord,
-    domain: string,
-    ip: string
-  ): Promise<SpfResult> {
-    // Check for 'redirect' modifier
-    if (spfRecord.modifiers.redirect) {
-      this.lookupCount++;
-      
-      if (this.lookupCount > MAX_SPF_LOOKUPS) {
-        return {
-          result: 'permerror',
-          explanation: 'Too many DNS lookups',
-          domain,
-          ip
-        };
-      }
-      
-      // Handle redirect
-      const redirectDomain = spfRecord.modifiers.redirect;
-      const redirectResult = this.dnsManager ? 
-        await this.dnsManager.verifySpfRecord(redirectDomain) :
-        { found: false, valid: false, error: 'DNS Manager not available' };
-      
-      if (!redirectResult.found || !redirectResult.valid) {
-        return {
-          result: 'permerror',
-          explanation: `Invalid redirect to ${redirectDomain}`,
-          domain,
-          ip
-        };
-      }
-      
-      const redirectRecord = this.parseSpfRecord(redirectResult.value);
-      
-      if (!redirectRecord) {
-        return {
-          result: 'permerror',
-          explanation: `Failed to parse redirect record from ${redirectDomain}`,
-          domain,
-          ip
-        };
-      }
-      
-      return this.checkSpfRecord(redirectRecord, redirectDomain, ip);
-    }
-    
-    // Check each mechanism in order
-    for (const mechanism of spfRecord.mechanisms) {
-      let matched = false;
-      
-      switch (mechanism.type) {
-        case SpfMechanismType.ALL:
-          matched = true;
-          break;
-          
-        case SpfMechanismType.IP4:
-          if (mechanism.value) {
-            matched = this.isIpInCidr(ip, mechanism.value);
-          }
-          break;
-          
-        case SpfMechanismType.IP6:
-          if (mechanism.value) {
-            matched = this.isIpInCidr(ip, mechanism.value);
-          }
-          break;
-          
-        case SpfMechanismType.A:
-          this.lookupCount++;
-          
-          if (this.lookupCount > MAX_SPF_LOOKUPS) {
-            return {
-              result: 'permerror',
-              explanation: 'Too many DNS lookups',
-              domain,
-              ip
-            };
-          }
-          
-          // Check if domain has A/AAAA record matching IP
-          const checkDomain = mechanism.value || domain;
-          matched = await this.isDomainResolvingToIp(checkDomain, ip);
-          break;
-          
-        case SpfMechanismType.MX:
-          this.lookupCount++;
-          
-          if (this.lookupCount > MAX_SPF_LOOKUPS) {
-            return {
-              result: 'permerror',
-              explanation: 'Too many DNS lookups',
-              domain,
-              ip
-            };
-          }
-          
-          // Check MX records
-          const mxDomain = mechanism.value || domain;
-          
-          try {
-            const mxRecords = await plugins.dns.promises.resolveMx(mxDomain);
-            
-            for (const mx of mxRecords) {
-              // Check if this MX record's IP matches
-              const mxMatches = await this.isDomainResolvingToIp(mx.exchange, ip);
-              
-              if (mxMatches) {
-                matched = true;
-                break;
-              }
-            }
-          } catch (error) {
-            // No MX records or error
-            matched = false;
-          }
-          break;
-          
-        case SpfMechanismType.INCLUDE:
-          if (!mechanism.value) {
-            continue;
-          }
-          
-          this.lookupCount++;
-          
-          if (this.lookupCount > MAX_SPF_LOOKUPS) {
-            return {
-              result: 'permerror',
-              explanation: 'Too many DNS lookups',
-              domain,
-              ip
-            };
-          }
-          
-          // Check included domain's SPF record
-          const includeDomain = mechanism.value;
-          const includeResult = this.dnsManager ? 
-            await this.dnsManager.verifySpfRecord(includeDomain) :
-            { found: false, valid: false, error: 'DNS Manager not available' };
-          
-          if (!includeResult.found || !includeResult.valid) {
-            continue; // Skip this mechanism
-          }
-          
-          const includeRecord = this.parseSpfRecord(includeResult.value);
-          
-          if (!includeRecord) {
-            continue; // Skip this mechanism
-          }
-          
-          // Recursively check the included SPF record
-          const includeCheck = await this.checkSpfRecord(includeRecord, includeDomain, ip);
-          
-          // Include mechanism matches if the result is "pass"
-          matched = includeCheck.result === 'pass';
-          break;
-          
-        case SpfMechanismType.EXISTS:
-          if (!mechanism.value) {
-            continue;
-          }
-          
-          this.lookupCount++;
-          
-          if (this.lookupCount > MAX_SPF_LOOKUPS) {
-            return {
-              result: 'permerror',
-              explanation: 'Too many DNS lookups',
-              domain,
-              ip
-            };
-          }
-          
-          // Check if domain exists (has any A record)
-          try {
-            await plugins.dns.promises.resolve(mechanism.value, 'A');
-            matched = true;
-          } catch (error) {
-            matched = false;
-          }
-          break;
-      }
-      
-      // If this mechanism matched, return its result
-      if (matched) {
-        switch (mechanism.qualifier) {
-          case SpfQualifier.PASS:
-            return {
-              result: 'pass',
-              explanation: `Matched ${mechanism.type}${mechanism.value ? ':' + mechanism.value : ''}`,
-              domain,
-              ip
-            };
-          case SpfQualifier.FAIL:
-            return {
-              result: 'fail',
-              explanation: `Matched ${mechanism.type}${mechanism.value ? ':' + mechanism.value : ''}`,
-              domain,
-              ip
-            };
-          case SpfQualifier.SOFTFAIL:
-            return {
-              result: 'softfail',
-              explanation: `Matched ${mechanism.type}${mechanism.value ? ':' + mechanism.value : ''}`,
-              domain,
-              ip
-            };
-          case SpfQualifier.NEUTRAL:
-            return {
-              result: 'neutral',
-              explanation: `Matched ${mechanism.type}${mechanism.value ? ':' + mechanism.value : ''}`,
-              domain,
-              ip
-            };
-        }
-      }
-    }
-    
-    // If no mechanism matched, default to neutral
-    return {
-      result: 'neutral',
-      explanation: 'No matching mechanism found',
-      domain,
-      ip
-    };
-  }
-  
-  /**
-   * Check if email passes SPF verification
-   * @param email Email to verify
-   * @param ip Sender IP address
-   * @param heloDomain HELO/EHLO domain used by sender
-   * @returns Whether email passes SPF
    */
   public async verifyAndApply(
     email: Email,
@@ -565,37 +199,30 @@ export class SpfVerifier {
   ): Promise<boolean> {
     const result = await this.verify(email, ip, heloDomain);
 
-    // Add headers
+    email.headers['Received-SPF'] = `${result.result} (${result.domain}: ${result.explanation || ''}) client-ip=${ip}; envelope-from=${email.getEnvelopeFrom()}; helo=${heloDomain};`;
-    email.headers['Received-SPF'] = `${result.result} (${result.domain}: ${result.explanation}) client-ip=${ip}; envelope-from=${email.getEnvelopeFrom()}; helo=${heloDomain};`;
 
-    // Apply policy based on result
     switch (result.result) {
       case 'fail':
-        // Fail - mark as spam
         email.mightBeSpam = true;
         logger.log('warn', `SPF failed for ${result.domain} from ${ip}: ${result.explanation}`);
         return false;
 
       case 'softfail':
-        // Soft fail - accept but mark as suspicious
         email.mightBeSpam = true;
         logger.log('info', `SPF softfailed for ${result.domain} from ${ip}: ${result.explanation}`);
         return true;
 
       case 'neutral':
       case 'none':
-        // Neutral or none - accept but note in headers
         logger.log('info', `SPF ${result.result} for ${result.domain} from ${ip}: ${result.explanation}`);
         return true;
 
       case 'pass':
-        // Pass - accept
         logger.log('info', `SPF passed for ${result.domain} from ${ip}: ${result.explanation}`);
         return true;
 
       case 'temperror':
       case 'permerror':
-        // Temporary or permanent error - log but accept
         logger.log('error', `SPF error for ${result.domain} from ${ip}: ${result.explanation}`);
         return true;
 

ts/plugins.ts

@@ -58,12 +58,13 @@ import * as smartproxy from '@push.rocks/smartproxy';
 import * as smartpromise from '@push.rocks/smartpromise';
 import * as smartrequest from '@push.rocks/smartrequest';
 import * as smartrule from '@push.rocks/smartrule';
+import * as smartrust from '@push.rocks/smartrust';
 import * as smartrx from '@push.rocks/smartrx';
 import * as smartunique from '@push.rocks/smartunique';
 
 export const smartfs = new SmartFs(new SmartFsProviderNode());
 
-export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrx, smartunique };
+export { projectinfo, qenv, smartacme, smartdata, smartdns, smartfile, SmartFs, smartguard, smartjwt, smartlog, smartmail, smartmetrics, smartnetwork, smartpath, smartproxy, smartpromise, smartrequest, smartrule, smartrust, smartrx, smartunique };
 
 // Define SmartLog types for use in error handling
 export type TLogLevel = 'error' | 'warn' | 'info' | 'success' | 'debug';
@@ -83,16 +84,10 @@ export {
 }
 
 // third party
-import * as mailauth from 'mailauth';
-import { dkimSign } from 'mailauth/lib/dkim/sign.js';
 import mailparser from 'mailparser';
 import * as uuid from 'uuid';
-import * as ip from 'ip';
 
 export {
-  mailauth,
-  dkimSign,
   mailparser,
   uuid,
-  ip,
 }

ts/security/classes.contentscanner.ts

@@ -4,6 +4,7 @@ import { logger } from '../logger.js';
 import { Email } from '../mail/core/classes.email.js';
 import type { IAttachment } from '../mail/core/classes.email.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from './classes.securitylogger.js';
+import { RustSecurityBridge } from './classes.rustsecuritybridge.js';
 import { LRUCache } from 'lru-cache';
 
 /**
@@ -65,75 +66,6 @@ export class ContentScanner {
   private scanCache: LRUCache<string, IScanResult>;
   private options: Required<IContentScannerOptions>;
   
-  // Predefined patterns for common threats
-  private static readonly MALICIOUS_PATTERNS = {
-    // Phishing patterns
-    phishing: [
-      /(?:verify|confirm|update|login).*(?:account|password|details)/i,
-      /urgent.*(?:action|attention|required)/i,
-      /(?:paypal|apple|microsoft|amazon|google|bank).*(?:verify|confirm|suspend)/i,
-      /your.*(?:account).*(?:suspended|compromised|locked)/i,
-      /\b(?:password reset|security alert|security notice)\b/i
-    ],
-    
-    // Spam indicators
-    spam: [
-      /\b(?:viagra|cialis|enlargement|diet pill|lose weight fast|cheap meds)\b/i,
-      /\b(?:million dollars|lottery winner|prize claim|inheritance|rich widow)\b/i,
-      /\b(?:earn from home|make money fast|earn \$\d{3,}\/day)\b/i,
-      /\b(?:limited time offer|act now|exclusive deal|only \d+ left)\b/i,
-      /\b(?:forex|stock tip|investment opportunity|cryptocurrency|bitcoin)\b/i
-    ],
-    
-    // Malware indicators in text
-    malware: [
-      /(?:attached file|see attachment).*(?:invoice|receipt|statement|document)/i,
-      /open.*(?:the attached|this attachment)/i,
-      /(?:enable|allow).*(?:macros|content|editing)/i,
-      /download.*(?:attachment|file|document)/i,
-      /\b(?:ransomware protection|virus alert|malware detected)\b/i
-    ],
-    
-    // Suspicious links
-    suspiciousLinks: [
-      /https?:\/\/bit\.ly\//i,
-      /https?:\/\/goo\.gl\//i,
-      /https?:\/\/t\.co\//i,
-      /https?:\/\/tinyurl\.com\//i,
-      /https?:\/\/(?:\d{1,3}\.){3}\d{1,3}/i, // IP address URLs
-      /https?:\/\/.*\.(?:xyz|top|club|gq|cf)\//i, // Suspicious TLDs
-      /(?:login|account|signin|auth).*\.(?!gov|edu|com|org|net)\w+\.\w+/i, // Login pages on unusual domains
-    ],
-    
-    // XSS and script injection
-    scriptInjection: [
-      /<script.*>.*<\/script>/is,
-      /javascript:/i,
-      /on(?:click|load|mouse|error|focus|blur)=".*"/i,
-      /document\.(?:cookie|write|location)/i,
-      /eval\s*\(/i
-    ],
-    
-    // Sensitive data patterns
-    sensitiveData: [
-      /\b(?:\d{3}-\d{2}-\d{4}|\d{9})\b/, // SSN
-      /\b\d{13,16}\b/, // Credit card numbers
-      /\b(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=|[A-Za-z0-9+/]{4})\b/ // Possible Base64
-    ]
-  };
-  
-  // Common executable extensions
-  private static readonly EXECUTABLE_EXTENSIONS = [
-    '.exe', '.dll', '.bat', '.cmd', '.msi', '.ts', '.vbs', '.ps1', 
-    '.sh', '.jar', '.py', '.com', '.scr', '.pif', '.hta', '.cpl', 
-    '.reg', '.vba', '.lnk', '.wsf', '.msi', '.msp', '.mst'
-  ];
-  
-  // Document formats that may contain macros
-  private static readonly MACRO_DOCUMENT_EXTENSIONS = [
-    '.doc', '.docm', '.xls', '.xlsm', '.ppt', '.pptm', '.dotm', '.xlsb', '.ppam', '.potm'
-  ];
-  
   /**
    * Default options for the content scanner
    */
@@ -185,7 +117,9 @@ export class ContentScanner {
   }
   
   /**
-   * Scan an email for malicious content
+   * Scan an email for malicious content.
+   * Delegates text/subject/html/filename pattern scanning to Rust.
+   * Binary attachment scanning (PE headers, VBA macros) stays in TS.
    * @param email The email to scan
    * @returns Scan result
    */
@@ -201,42 +135,35 @@ export class ContentScanner {
         return cachedResult;
       }
 
-      // Initialize scan result
+      // Delegate text/subject/html/filename scanning to Rust
+      const bridge = RustSecurityBridge.getInstance();
+      const rustResult = await bridge.scanContent({
+        subject: this.options.scanSubject ? email.subject : undefined,
+        textBody: this.options.scanBody ? email.text : undefined,
+        htmlBody: this.options.scanBody ? email.html : undefined,
+        attachmentNames: this.options.scanAttachmentNames
+          ? email.attachments?.map(a => a.filename) ?? []
+          : [],
+      });
+
       const result: IScanResult = {
         isClean: true,
-        threatScore: 0,
+        threatScore: rustResult.threatScore,
-        scannedElements: [],
+        threatType: rustResult.threatType ?? undefined,
-        timestamp: Date.now()
+        threatDetails: rustResult.threatDetails ?? undefined,
+        scannedElements: rustResult.scannedElements,
+        timestamp: Date.now(),
       };
 
-      // List of scan promises
+      // Attachment binary scanning stays in TS (PE headers, macro detection)
-      const scanPromises: Array<Promise<void>> = [];
+      if (this.options.scanAttachments && email.attachments?.length > 0) {
-      
-      // Scan subject
-      if (this.options.scanSubject && email.subject) {
-        scanPromises.push(this.scanSubject(email.subject, result));
-      }
-      
-      // Scan body content
-      if (this.options.scanBody) {
-        if (email.text) {
-          scanPromises.push(this.scanTextContent(email.text, result));
-        }
-        
-        if (email.html) {
-          scanPromises.push(this.scanHtmlContent(email.html, result));
-        }
-      }
-      
-      // Scan attachments
-      if (this.options.scanAttachments && email.attachments && email.attachments.length > 0) {
         for (const attachment of email.attachments) {
-          scanPromises.push(this.scanAttachment(attachment, result));
+          this.scanAttachmentBinary(attachment, result);
         }
       }
 
-      // Run all scans in parallel
+      // Apply custom rules (TS-only, runtime-configured)
-      await Promise.all(scanPromises);
+      this.applyCustomRules(email, result);
 
       // Determine if the email is clean based on threat score
       result.isClean = result.threatScore < this.options.minThreatScore;
@@ -260,7 +187,7 @@ export class ContentScanner {
 
       // Return a safe default with error indication
       return {
-        isClean: true, // Let it pass if scanner fails (configure as desired)
+        isClean: true,
         threatScore: 0,
         scannedElements: ['error'],
         timestamp: Date.now(),
@@ -294,314 +221,68 @@ export class ContentScanner {
   }
 
   /**
-   * Scan email subject for threats
+   * Scan attachment binary content for PE headers and VBA macros.
-   * @param subject The subject to scan
+   * This stays in TS because it accesses raw Buffer data (too large for IPC).
-   * @param result The scan result to update
-   */
-  private async scanSubject(subject: string, result: IScanResult): Promise<void> {
-    result.scannedElements.push('subject');
-    
-    // Check against phishing patterns
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.phishing) {
-      if (pattern.test(subject)) {
-        result.threatScore += 25;
-        result.threatType = ThreatCategory.PHISHING;
-        result.threatDetails = `Subject contains potential phishing indicators: ${subject}`;
-        return;
-      }
-    }
-    
-    // Check against spam patterns
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.spam) {
-      if (pattern.test(subject)) {
-        result.threatScore += 15;
-        result.threatType = ThreatCategory.SPAM;
-        result.threatDetails = `Subject contains potential spam indicators: ${subject}`;
-        return;
-      }
-    }
-    
-    // Check custom rules
-    for (const rule of this.options.customRules) {
-      const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
-      if (pattern.test(subject)) {
-        result.threatScore += rule.score;
-        result.threatType = rule.type;
-        result.threatDetails = rule.description;
-        return;
-      }
-    }
-  }
-  
-  /**
-   * Scan plain text content for threats
-   * @param text The text content to scan
-   * @param result The scan result to update
-   */
-  private async scanTextContent(text: string, result: IScanResult): Promise<void> {
-    result.scannedElements.push('text');
-    
-    // Check suspicious links
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.suspiciousLinks) {
-      if (pattern.test(text)) {
-        result.threatScore += 20;
-        if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SUSPICIOUS_LINK ? 0 : 20)) {
-          result.threatType = ThreatCategory.SUSPICIOUS_LINK;
-          result.threatDetails = `Text contains suspicious links`;
-        }
-      }
-    }
-    
-    // Check phishing
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.phishing) {
-      if (pattern.test(text)) {
-        result.threatScore += 25;
-        if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.PHISHING ? 0 : 25)) {
-          result.threatType = ThreatCategory.PHISHING;
-          result.threatDetails = `Text contains potential phishing indicators`;
-        }
-      }
-    }
-    
-    // Check spam
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.spam) {
-      if (pattern.test(text)) {
-        result.threatScore += 15;
-        if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SPAM ? 0 : 15)) {
-          result.threatType = ThreatCategory.SPAM;
-          result.threatDetails = `Text contains potential spam indicators`;
-        }
-      }
-    }
-    
-    // Check malware indicators
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.malware) {
-      if (pattern.test(text)) {
-        result.threatScore += 30;
-        if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.MALWARE ? 0 : 30)) {
-          result.threatType = ThreatCategory.MALWARE;
-          result.threatDetails = `Text contains potential malware indicators`;
-        }
-      }
-    }
-    
-    // Check sensitive data
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.sensitiveData) {
-      if (pattern.test(text)) {
-        result.threatScore += 25;
-        if (!result.threatType || result.threatScore > (result.threatType === ThreatCategory.SENSITIVE_DATA ? 0 : 25)) {
-          result.threatType = ThreatCategory.SENSITIVE_DATA;
-          result.threatDetails = `Text contains potentially sensitive data patterns`;
-        }
-      }
-    }
-    
-    // Check custom rules
-    for (const rule of this.options.customRules) {
-      const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
-      if (pattern.test(text)) {
-        result.threatScore += rule.score;
-        if (!result.threatType || result.threatScore > 20) {
-          result.threatType = rule.type;
-          result.threatDetails = rule.description;
-        }
-      }
-    }
-  }
-  
-  /**
-   * Scan HTML content for threats
-   * @param html The HTML content to scan
-   * @param result The scan result to update
-   */
-  private async scanHtmlContent(html: string, result: IScanResult): Promise<void> {
-    result.scannedElements.push('html');
-    
-    // Check for script injection
-    for (const pattern of ContentScanner.MALICIOUS_PATTERNS.scriptInjection) {
-      if (pattern.test(html)) {
-        result.threatScore += 40;
-        if (!result.threatType || result.threatType !== ThreatCategory.XSS) {
-          result.threatType = ThreatCategory.XSS;
-          result.threatDetails = `HTML contains potentially malicious script content`;
-        }
-      }
-    }
-    
-    // Extract text content from HTML for further scanning
-    const textContent = this.extractTextFromHtml(html);
-    if (textContent) {
-      // We'll leverage the text scanning but not double-count threat score
-      const tempResult: IScanResult = {
-        isClean: true,
-        threatScore: 0,
-        scannedElements: [],
-        timestamp: Date.now()
-      };
-      
-      await this.scanTextContent(textContent, tempResult);
-      
-      // Only add additional threat types if they're more severe
-      if (tempResult.threatType && tempResult.threatScore > 0) {
-        // Add half of the text content score to avoid double counting
-        result.threatScore += Math.floor(tempResult.threatScore / 2);
-        
-        // Adopt the threat type if more severe or no existing type
-        if (!result.threatType || tempResult.threatScore > result.threatScore) {
-          result.threatType = tempResult.threatType;
-          result.threatDetails = tempResult.threatDetails;
-        }
-      }
-    }
-    
-    // Extract and check links from HTML
-    const links = this.extractLinksFromHtml(html);
-    if (links.length > 0) {
-      // Check for suspicious links
-      let suspiciousLinks = 0;
-      for (const link of links) {
-        for (const pattern of ContentScanner.MALICIOUS_PATTERNS.suspiciousLinks) {
-          if (pattern.test(link)) {
-            suspiciousLinks++;
-            break;
-          }
-        }
-      }
-      
-      if (suspiciousLinks > 0) {
-        // Add score based on percentage of suspicious links
-        const suspiciousPercentage = (suspiciousLinks / links.length) * 100;
-        const additionalScore = Math.min(40, Math.floor(suspiciousPercentage / 2.5));
-        result.threatScore += additionalScore;
-        
-        if (!result.threatType || additionalScore > 20) {
-          result.threatType = ThreatCategory.SUSPICIOUS_LINK;
-          result.threatDetails = `HTML contains ${suspiciousLinks} suspicious links out of ${links.length} total links`;
-        }
-      }
-    }
-  }
-  
-  /**
-   * Scan an attachment for threats
    * @param attachment The attachment to scan
    * @param result The scan result to update
    */
-  private async scanAttachment(attachment: IAttachment, result: IScanResult): Promise<void> {
+  private scanAttachmentBinary(attachment: IAttachment, result: IScanResult): void {
-    const filename = attachment.filename.toLowerCase();
+    if (!attachment.content) {
-    result.scannedElements.push(`attachment:${filename}`);
-    
-    // Skip large attachments if configured
-    if (attachment.content && attachment.content.length > this.options.maxAttachmentSizeToScan) {
-      logger.log('info', `Skipping scan of large attachment: ${filename} (${attachment.content.length} bytes)`);
       return;
     }
 
-    // Check filename for executable extensions
+    // Skip large attachments
-    if (this.options.blockExecutables) {
+    if (attachment.content.length > this.options.maxAttachmentSizeToScan) {
-      for (const ext of ContentScanner.EXECUTABLE_EXTENSIONS) {
+      return;
-        if (filename.endsWith(ext)) {
-          result.threatScore += 70; // High score for executable attachments
-          result.threatType = ThreatCategory.EXECUTABLE;
-          result.threatDetails = `Attachment has a potentially dangerous extension: ${filename}`;
-          return; // No need to scan contents if filename already flagged
-        }
-      }
     }
 
-    // Check for Office documents with macros
+    const filename = attachment.filename.toLowerCase();
-    if (this.options.blockMacros) {
+
-      for (const ext of ContentScanner.MACRO_DOCUMENT_EXTENSIONS) {
+    // Check for PE headers (Windows executables disguised with non-.exe extensions)
-        if (filename.endsWith(ext)) {
+    if (attachment.content.length > 64 &&
-          // For Office documents, check if they contain macros
+        attachment.content[0] === 0x4D &&
-          // This is a simplified check - a real implementation would use specialized libraries
+        attachment.content[1] === 0x5A) { // 'MZ' header
-          // to detect macros in Office documents
+      result.threatScore += 80;
-          if (attachment.content && this.likelyContainsMacros(attachment)) {
+      result.threatType = ThreatCategory.EXECUTABLE;
-            result.threatScore += 60;
+      result.threatDetails = `Attachment contains executable code: ${filename}`;
-            result.threatType = ThreatCategory.MALICIOUS_MACRO;
+      return;
-            result.threatDetails = `Attachment appears to contain macros: ${filename}`;
-            return;
-          }
-        }
-      }
     }
 
-    // Perform basic content analysis if we have content buffer
+    // Check for VBA macro indicators in Office documents
-    if (attachment.content) {
+    if (this.options.blockMacros && this.likelyContainsMacros(attachment)) {
-      // Convert to string for scanning, with a limit to prevent memory issues
+      result.threatScore += 60;
-      const textContent = this.extractTextFromBuffer(attachment.content);
+      result.threatType = ThreatCategory.MALICIOUS_MACRO;
-      
+      result.threatDetails = `Attachment appears to contain macros: ${filename}`;
-      if (textContent) {
-        // Scan for malicious patterns in attachment content
-        for (const category in ContentScanner.MALICIOUS_PATTERNS) {
-          const patterns = ContentScanner.MALICIOUS_PATTERNS[category];
-          for (const pattern of patterns) {
-            if (pattern.test(textContent)) {
-              result.threatScore += 30;
-              
-              if (!result.threatType) {
-                result.threatType = this.mapCategoryToThreatType(category);
-                result.threatDetails = `Attachment content contains suspicious patterns: ${filename}`;
-              }
-              
-              break;
-            }
-          }
-        }
-      }
-      
-      // Check for PE headers (Windows executables)
-      if (attachment.content.length > 64 && 
-          attachment.content[0] === 0x4D && 
-          attachment.content[1] === 0x5A) { // 'MZ' header
-        result.threatScore += 80;
-        result.threatType = ThreatCategory.EXECUTABLE;
-        result.threatDetails = `Attachment contains executable code: ${filename}`;
-      }
     }
   }
 
   /**
-   * Extract links from HTML content
+   * Apply custom rules (runtime-configured patterns) to the email.
-   * @param html HTML content
+   * These stay in TS because they are configured at runtime.
-   * @returns Array of extracted links
+   * @param email The email to check
+   * @param result The scan result to update
    */
-  private extractLinksFromHtml(html: string): string[] {
+  private applyCustomRules(email: Email, result: IScanResult): void {
-    const links: string[] = [];
+    if (!this.options.customRules.length) {
+      return;
+    }
 
-    // Simple regex-based extraction - a real implementation might use a proper HTML parser
+    const textsToCheck: string[] = [];
-    const matches = html.match(/href=["'](https?:\/\/[^"']+)["']/gi);
+    if (email.subject) textsToCheck.push(email.subject);
-    if (matches) {
+    if (email.text) textsToCheck.push(email.text);
-      for (const match of matches) {
+    if (email.html) textsToCheck.push(email.html);
-        const linkMatch = match.match(/href=["'](https?:\/\/[^"']+)["']/i);
+
-        if (linkMatch && linkMatch[1]) {
+    for (const rule of this.options.customRules) {
-          links.push(linkMatch[1]);
+      const pattern = rule.pattern instanceof RegExp ? rule.pattern : new RegExp(rule.pattern, 'i');
+      for (const text of textsToCheck) {
+        if (pattern.test(text)) {
+          result.threatScore += rule.score;
+          result.threatType = rule.type;
+          result.threatDetails = rule.description;
+          return;
         }
       }
     }
-    
-    return links;
-  }
-  
-  /**
-   * Extract plain text from HTML
-   * @param html HTML content
-   * @returns Extracted text
-   */
-  private extractTextFromHtml(html: string): string {
-    // Remove HTML tags and decode entities - simplified version
-    return html
-      .replace(/<style[^>]*>.*?<\/style>/gs, '')
-      .replace(/<script[^>]*>.*?<\/script>/gs, '')
-      .replace(/<[^>]+>/g, ' ')
-      .replace(/&nbsp;/g, ' ')
-      .replace(/&lt;/g, '<')
-      .replace(/&gt;/g, '>')
-      .replace(/&amp;/g, '&')
-      .replace(/&quot;/g, '"')
-      .replace(/&apos;/g, "'")
-      .replace(/\s+/g, ' ')
-      .trim();
   }
 
   /**
@@ -627,13 +308,10 @@ export class ContentScanner {
 
   /**
    * Check if an Office document likely contains macros
-   * This is a simplified check - real implementation would use specialized libraries
    * @param attachment The attachment to check
    * @returns Whether the file likely contains macros
    */
   private likelyContainsMacros(attachment: IAttachment): boolean {
-    // Simple heuristic: look for VBA/macro related strings
-    // This is a simplified approach and not comprehensive
     const content = this.extractTextFromBuffer(attachment.content);
     const macroIndicators = [
       /vbaProject\.bin/i,
@@ -657,23 +335,6 @@ export class ContentScanner {
     return false;
   }
 
-  /**
-   * Map a pattern category to a threat type
-   * @param category The pattern category
-   * @returns The corresponding threat type
-   */
-  private mapCategoryToThreatType(category: string): string {
-    switch (category) {
-      case 'phishing': return ThreatCategory.PHISHING;
-      case 'spam': return ThreatCategory.SPAM;
-      case 'malware': return ThreatCategory.MALWARE;
-      case 'suspiciousLinks': return ThreatCategory.SUSPICIOUS_LINK;
-      case 'scriptInjection': return ThreatCategory.XSS;
-      case 'sensitiveData': return ThreatCategory.SENSITIVE_DATA;
-      default: return ThreatCategory.BLACKLISTED_CONTENT;
-    }
-  }
-  
   /**
    * Log a high threat finding to the security logger
    * @param email The email containing the threat

ts/security/classes.ipreputationchecker.ts

@@ -2,6 +2,7 @@ import * as plugins from '../plugins.js';
 import * as paths from '../paths.js';
 import { logger } from '../logger.js';
 import { SecurityLogger, SecurityLogLevel, SecurityEventType } from './classes.securitylogger.js';
+import { RustSecurityBridge } from './classes.rustsecuritybridge.js';
 import { LRUCache } from 'lru-cache';
 
 /**
@@ -58,33 +59,19 @@ export interface IIPReputationOptions {
 }
 
 /**
- * Class for checking IP reputation of inbound email senders
+ * IP reputation checker — delegates DNSBL lookups to the Rust security bridge.
+ * Retains LRU caching and disk persistence in TypeScript.
  */
 export class IPReputationChecker {
   private static instance: IPReputationChecker;
   private reputationCache: LRUCache<string, IReputationResult>;
   private options: Required<IIPReputationOptions>;
-  private storageManager?: any; // StorageManager instance
+  private storageManager?: any;
 
-  // Default DNSBL servers
-  private static readonly DEFAULT_DNSBL_SERVERS = [
-    'zen.spamhaus.org',         // Spamhaus
-    'bl.spamcop.net',           // SpamCop
-    'b.barracudacentral.org',   // Barracuda
-    'spam.dnsbl.sorbs.net',     // SORBS
-    'dnsbl.sorbs.net',          // SORBS (expanded)
-    'cbl.abuseat.org',          // Composite Blocking List 
-    'xbl.spamhaus.org',         // Spamhaus XBL
-    'pbl.spamhaus.org',         // Spamhaus PBL
-    'dnsbl-1.uceprotect.net',   // UCEPROTECT
-    'psbl.surriel.com'          // PSBL
-  ];
-  
-  // Default options
   private static readonly DEFAULT_OPTIONS: Required<IIPReputationOptions> = {
     maxCacheSize: 10000,
-    cacheTTL: 24 * 60 * 60 * 1000, // 24 hours
+    cacheTTL: 24 * 60 * 60 * 1000,
-    dnsblServers: IPReputationChecker.DEFAULT_DNSBL_SERVERS,
+    dnsblServers: [],
     highRiskThreshold: ReputationThreshold.HIGH_RISK,
     mediumRiskThreshold: ReputationThreshold.MEDIUM_RISK,
     lowRiskThreshold: ReputationThreshold.LOW_RISK,
@@ -93,13 +80,7 @@ export class IPReputationChecker {
     enableIPInfo: true
   };
 
-  /**
-   * Constructor for IPReputationChecker
-   * @param options Configuration options
-   * @param storageManager Optional StorageManager instance for persistence
-   */
   constructor(options: IIPReputationOptions = {}, storageManager?: any) {
-    // Merge with default options
     this.options = {
       ...IPReputationChecker.DEFAULT_OPTIONS,
       ...options
@@ -107,36 +88,18 @@ export class IPReputationChecker {
 
     this.storageManager = storageManager;
 
-    // If no storage manager provided, log warning
-    if (!storageManager && this.options.enableLocalCache) {
-      logger.log('warn', 
-        '⚠️  WARNING: IPReputationChecker initialized without StorageManager.\n' +
-        '   IP reputation cache will only be stored to filesystem.\n' +
-        '   Consider passing a StorageManager instance for better storage flexibility.'
-      );
-    }
-    
-    // Initialize reputation cache
     this.reputationCache = new LRUCache<string, IReputationResult>({
       max: this.options.maxCacheSize,
-      ttl: this.options.cacheTTL, // Cache TTL
+      ttl: this.options.cacheTTL,
     });
 
-    // Load cache from disk if enabled
     if (this.options.enableLocalCache) {
-      // Fire and forget the load operation
       this.loadCache().catch(error => {
         logger.log('error', `Failed to load IP reputation cache during initialization: ${error.message}`);
       });
     }
   }
 
-  /**
-   * Get the singleton instance of the checker
-   * @param options Configuration options
-   * @param storageManager Optional StorageManager instance for persistence
-   * @returns Singleton instance
-   */
   public static getInstance(options: IIPReputationOptions = {}, storageManager?: any): IPReputationChecker {
     if (!IPReputationChecker.instance) {
       IPReputationChecker.instance = new IPReputationChecker(options, storageManager);
@@ -145,13 +108,10 @@ export class IPReputationChecker {
   }
 
   /**
-   * Check an IP address's reputation
+   * Check an IP address's reputation via the Rust bridge
-   * @param ip IP address to check
-   * @returns Reputation check result
    */
   public async checkReputation(ip: string): Promise<IReputationResult> {
     try {
-      // Validate IP address format
       if (!this.isValidIPAddress(ip)) {
         logger.log('warn', `Invalid IP address format: ${ip}`);
         return this.createErrorResult(ip, 'Invalid IP address format');
@@ -167,233 +127,47 @@ export class IPReputationChecker {
         return cachedResult;
       }
 
-      // Initialize empty result
+      // Delegate to Rust bridge
+      const bridge = RustSecurityBridge.getInstance();
+      const rustResult = await bridge.checkIpReputation(ip);
+
       const result: IReputationResult = {
-        score: 100, // Start with perfect score
+        score: rustResult.score,
-        isSpam: false,
+        isSpam: rustResult.listed_count > 0,
-        isProxy: false,
+        isProxy: rustResult.ip_type === 'proxy',
-        isTor: false,
+        isTor: rustResult.ip_type === 'tor',
-        isVPN: false,
+        isVPN: rustResult.ip_type === 'vpn',
-        timestamp: Date.now()
+        blacklists: rustResult.dnsbl_results
+          .filter(d => d.listed)
+          .map(d => d.server),
+        timestamp: Date.now(),
       };
 
-      // Check IP against DNS blacklists if enabled
-      if (this.options.enableDNSBL) {
-        const dnsblResult = await this.checkDNSBL(ip);
-        
-        // Update result with DNSBL information
-        result.score -= dnsblResult.listCount * 10; // Subtract 10 points per blacklist
-        result.isSpam = dnsblResult.listCount > 0;
-        result.blacklists = dnsblResult.lists;
-      }
-      
-      // Get additional IP information if enabled
-      if (this.options.enableIPInfo) {
-        const ipInfo = await this.getIPInfo(ip);
-        
-        // Update result with IP info
-        result.country = ipInfo.country;
-        result.asn = ipInfo.asn;
-        result.org = ipInfo.org;
-        
-        // Adjust score based on IP type
-        if (ipInfo.type === IPType.PROXY || ipInfo.type === IPType.TOR || ipInfo.type === IPType.VPN) {
-          result.score -= 30; // Subtract 30 points for proxies, Tor, VPNs
-          
-          // Set proxy flags
-          result.isProxy = ipInfo.type === IPType.PROXY;
-          result.isTor = ipInfo.type === IPType.TOR;
-          result.isVPN = ipInfo.type === IPType.VPN;
-        }
-      }
-      
-      // Ensure score is between 0 and 100
-      result.score = Math.max(0, Math.min(100, result.score));
-      
-      // Update cache with result
       this.reputationCache.set(ip, result);
 
-      // Save cache if enabled
       if (this.options.enableLocalCache) {
-        // Fire and forget the save operation
         this.saveCache().catch(error => {
           logger.log('error', `Failed to save IP reputation cache: ${error.message}`);
         });
       }
 
-      // Log the reputation check
       this.logReputationCheck(ip, result);
-      
       return result;
     } catch (error) {
       logger.log('error', `Error checking IP reputation for ${ip}: ${error.message}`, {
         ip,
         stack: error.stack
       });
-      
+      const errorResult = this.createErrorResult(ip, error.message);
-      return this.createErrorResult(ip, error.message);
+      // Cache error results to avoid repeated failing lookups
+      this.reputationCache.set(ip, errorResult);
+      return errorResult;
     }
   }
 
-  /**
-   * Check an IP against DNS blacklists
-   * @param ip IP address to check
-   * @returns DNSBL check results
-   */
-  private async checkDNSBL(ip: string): Promise<{
-    listCount: number;
-    lists: string[];
-  }> {
-    try {
-      // Reverse the IP for DNSBL queries
-      const reversedIP = this.reverseIP(ip);
-      
-      const results = await Promise.allSettled(
-        this.options.dnsblServers.map(async (server) => {
-          try {
-            const lookupDomain = `${reversedIP}.${server}`;
-            await plugins.dns.promises.resolve(lookupDomain);
-            return server; // IP is listed in this DNSBL
-          } catch (error) {
-            if (error.code === 'ENOTFOUND') {
-              return null; // IP is not listed in this DNSBL
-            }
-            throw error; // Other error
-          }
-        })
-      );
-      
-      // Extract successful lookups (listed in DNSBL)
-      const lists = results
-        .filter((result): result is PromiseFulfilledResult<string> => 
-          result.status === 'fulfilled' && result.value !== null
-        )
-        .map(result => result.value);
-      
-      return {
-        listCount: lists.length,
-        lists
-      };
-    } catch (error) {
-      logger.log('error', `Error checking DNSBL for ${ip}: ${error.message}`);
-      return {
-        listCount: 0,
-        lists: []
-      };
-    }
-  }
-  
-  /**
-   * Get information about an IP address
-   * @param ip IP address to check
-   * @returns IP information
-   */
-  private async getIPInfo(ip: string): Promise<{
-    country?: string;
-    asn?: string;
-    org?: string;
-    type: IPType;
-  }> {
-    try {
-      // In a real implementation, this would use an IP data service API
-      // For this implementation, we'll use a simplified approach
-      
-      // Check if it's a known Tor exit node (simplified)
-      const isTor = ip.startsWith('171.25.') || ip.startsWith('185.220.') || ip.startsWith('95.216.');
-      
-      // Check if it's a known VPN (simplified)
-      const isVPN = ip.startsWith('185.156.') || ip.startsWith('37.120.');
-      
-      // Check if it's a known proxy (simplified)
-      const isProxy = ip.startsWith('34.92.') || ip.startsWith('34.206.');
-      
-      // Determine IP type
-      let type = IPType.UNKNOWN;
-      if (isTor) {
-        type = IPType.TOR;
-      } else if (isVPN) {
-        type = IPType.VPN;
-      } else if (isProxy) {
-        type = IPType.PROXY;
-      } else {
-        // Simple datacenters detection (major cloud providers)
-        if (
-          ip.startsWith('13.') || // AWS
-          ip.startsWith('35.') || // Google Cloud
-          ip.startsWith('52.') || // AWS
-          ip.startsWith('34.') || // Google Cloud
-          ip.startsWith('104.') // Various providers
-        ) {
-          type = IPType.DATACENTER;
-        } else {
-          type = IPType.RESIDENTIAL;
-        }
-      }
-      
-      // Return the information
-      return {
-        country: this.determineCountry(ip), // Simplified, would use geolocation service
-        asn: 'AS12345', // Simplified, would look up real ASN
-        org: this.determineOrg(ip), // Simplified, would use real org data
-        type
-      };
-    } catch (error) {
-      logger.log('error', `Error getting IP info for ${ip}: ${error.message}`);
-      return {
-        type: IPType.UNKNOWN
-      };
-    }
-  }
-  
-  /**
-   * Simplified method to determine country from IP
-   * In a real implementation, this would use a geolocation database or service
-   * @param ip IP address
-   * @returns Country code
-   */
-  private determineCountry(ip: string): string {
-    // Simplified mapping for demo purposes
-    if (ip.startsWith('13.') || ip.startsWith('52.')) return 'US';
-    if (ip.startsWith('35.') || ip.startsWith('34.')) return 'US';
-    if (ip.startsWith('185.')) return 'NL';
-    if (ip.startsWith('171.')) return 'DE';
-    return 'XX'; // Unknown
-  }
-  
-  /**
-   * Simplified method to determine organization from IP
-   * In a real implementation, this would use an IP-to-org database or service
-   * @param ip IP address
-   * @returns Organization name
-   */
-  private determineOrg(ip: string): string {
-    // Simplified mapping for demo purposes
-    if (ip.startsWith('13.') || ip.startsWith('52.')) return 'Amazon AWS';
-    if (ip.startsWith('35.') || ip.startsWith('34.')) return 'Google Cloud';
-    if (ip.startsWith('185.156.')) return 'NordVPN';
-    if (ip.startsWith('37.120.')) return 'ExpressVPN';
-    if (ip.startsWith('185.220.')) return 'Tor Exit Node';
-    return 'Unknown';
-  }
-  
-  /**
-   * Reverse an IP address for DNSBL lookups (e.g., 1.2.3.4 -> 4.3.2.1)
-   * @param ip IP address to reverse
-   * @returns Reversed IP for DNSBL queries
-   */
-  private reverseIP(ip: string): string {
-    return ip.split('.').reverse().join('.');
-  }
-  
-  /**
-   * Create an error result for when reputation check fails
-   * @param ip IP address
-   * @param errorMessage Error message
-   * @returns Error result
-   */
   private createErrorResult(ip: string, errorMessage: string): IReputationResult {
     return {
-      score: 50, // Neutral score for errors
+      score: 50,
       isSpam: false,
       isProxy: false,
       isTor: false,
@@ -403,32 +177,17 @@ export class IPReputationChecker {
     };
   }
 
-  /**
-   * Validate IP address format
-   * @param ip IP address to validate
-   * @returns Whether the IP is valid
-   */
   private isValidIPAddress(ip: string): boolean {
-    // IPv4 regex pattern
     const ipv4Pattern = /^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$/;
     return ipv4Pattern.test(ip);
   }
 
-  /**
-   * Log reputation check to security logger
-   * @param ip IP address
-   * @param result Reputation result
-   */
   private logReputationCheck(ip: string, result: IReputationResult): void {
-    // Determine log level based on reputation score
     let logLevel = SecurityLogLevel.INFO;
     if (result.score < this.options.highRiskThreshold) {
       logLevel = SecurityLogLevel.WARN;
-    } else if (result.score < this.options.mediumRiskThreshold) {
-      logLevel = SecurityLogLevel.INFO;
     }
 
-    // Log the check
     SecurityLogger.getInstance().logEvent({
       level: logLevel,
       type: SecurityEventType.IP_REPUTATION,
@@ -447,36 +206,27 @@ export class IPReputationChecker {
     });
   }
 
-  /**
-   * Save cache to disk or storage manager
-   */
   private async saveCache(): Promise<void> {
     try {
-      // Convert cache entries to serializable array
       const entries = Array.from(this.reputationCache.entries()).map(([ip, data]) => ({
         ip,
         data
       }));
 
-      // Only save if we have entries
       if (entries.length === 0) {
         return;
       }
 
       const cacheData = JSON.stringify(entries);
 
-      // Save to storage manager if available
       if (this.storageManager) {
         await this.storageManager.set('/security/ip-reputation-cache.json', cacheData);
         logger.log('info', `Saved ${entries.length} IP reputation cache entries to StorageManager`);
       } else {
-        // Fall back to filesystem
         const cacheDir = plugins.path.join(paths.dataDir, 'security');
         await plugins.smartfs.directory(cacheDir).recursive().create();
-
         const cacheFile = plugins.path.join(cacheDir, 'ip_reputation_cache.json');
         await plugins.smartfs.file(cacheFile).write(cacheData);
-        
         logger.log('info', `Saved ${entries.length} IP reputation cache entries to disk`);
       }
     } catch (error) {
@@ -484,33 +234,23 @@ export class IPReputationChecker {
     }
   }
 
-  /**
-   * Load cache from disk or storage manager
-   */
   private async loadCache(): Promise<void> {
     try {
       let cacheData: string | null = null;
       let fromFilesystem = false;
 
-      // Try to load from storage manager first
       if (this.storageManager) {
         try {
           cacheData = await this.storageManager.get('/security/ip-reputation-cache.json');
 
           if (!cacheData) {
-            // Check if data exists in filesystem and migrate it
             const cacheFile = plugins.path.join(paths.dataDir, 'security', 'ip_reputation_cache.json');
-            
             if (plugins.fs.existsSync(cacheFile)) {
               logger.log('info', 'Migrating IP reputation cache from filesystem to StorageManager');
               cacheData = plugins.fs.readFileSync(cacheFile, 'utf8');
               fromFilesystem = true;
-              
-              // Migrate to storage manager
               await this.storageManager.set('/security/ip-reputation-cache.json', cacheData);
               logger.log('info', 'IP reputation cache migrated to StorageManager successfully');
-              
-              // Optionally delete the old file after successful migration
               try {
                 plugins.fs.unlinkSync(cacheFile);
                 logger.log('info', 'Old cache file removed after migration');
@@ -523,27 +263,21 @@ export class IPReputationChecker {
           logger.log('error', `Error loading from StorageManager: ${error.message}`);
         }
       } else {
-        // No storage manager, load from filesystem
         const cacheFile = plugins.path.join(paths.dataDir, 'security', 'ip_reputation_cache.json');
-        
         if (plugins.fs.existsSync(cacheFile)) {
           cacheData = plugins.fs.readFileSync(cacheFile, 'utf8');
           fromFilesystem = true;
         }
       }
 
-      // Parse and restore cache if data was found
       if (cacheData) {
         const entries = JSON.parse(cacheData);
-        
-        // Validate and filter entries
         const now = Date.now();
         const validEntries = entries.filter(entry => {
           const age = now - entry.data.timestamp;
-          return age < this.options.cacheTTL; // Only load entries that haven't expired
+          return age < this.options.cacheTTL;
         });
 
-        // Restore cache
         for (const entry of validEntries) {
           this.reputationCache.set(entry.ip, entry.data);
         }
@@ -556,11 +290,6 @@ export class IPReputationChecker {
     }
   }
 
-  /**
-   * Get the risk level for a reputation score
-   * @param score Reputation score (0-100)
-   * @returns Risk level description
-   */
   public static getRiskLevel(score: number): 'high' | 'medium' | 'low' | 'trusted' {
     if (score < ReputationThreshold.HIGH_RISK) {
       return 'high';
@@ -573,16 +302,10 @@ export class IPReputationChecker {
     }
   }
 
-  /**
-   * Update the storage manager after instantiation
-   * This is useful when the storage manager is not available at construction time
-   * @param storageManager The StorageManager instance to use
-   */
   public updateStorageManager(storageManager: any): void {
     this.storageManager = storageManager;
     logger.log('info', 'IPReputationChecker storage manager updated');
 
-    // If cache is enabled and we have entries, save them to the new storage manager
     if (this.options.enableLocalCache && this.reputationCache.size > 0) {
       this.saveCache().catch(error => {
         logger.log('error', `Failed to save cache to new storage manager: ${error.message}`);

ts/security/classes.rustsecuritybridge.ts

@@ -0,0 +1,497 @@
+import * as plugins from '../plugins.js';
+import * as paths from '../paths.js';
+import { logger } from '../logger.js';
+
+// ---------------------------------------------------------------------------
+// IPC command type map — mirrors the methods in mailer-bin's management mode
+// ---------------------------------------------------------------------------
+
+interface IDkimVerificationResult {
+  is_valid: boolean;
+  domain: string | null;
+  selector: string | null;
+  status: string;
+  details: string | null;
+}
+
+interface ISpfResult {
+  result: string;
+  domain: string;
+  ip: string;
+  explanation: string | null;
+}
+
+interface IDmarcResult {
+  passed: boolean;
+  policy: string;
+  domain: string;
+  dkim_result: string;
+  spf_result: string;
+  action: string;
+  details: string | null;
+}
+
+interface IEmailSecurityResult {
+  dkim: IDkimVerificationResult[];
+  spf: ISpfResult | null;
+  dmarc: IDmarcResult | null;
+}
+
+interface IValidationResult {
+  valid: boolean;
+  formatValid: boolean;
+  score: number;
+  error: string | null;
+}
+
+interface IBounceDetection {
+  bounce_type: string;
+  category: string;
+}
+
+interface IReputationResult {
+  ip: string;
+  score: number;
+  risk_level: string;
+  ip_type: string;
+  dnsbl_results: Array<{ server: string; listed: boolean; response: string | null }>;
+  listed_count: number;
+  total_checked: number;
+}
+
+interface IContentScanResult {
+  threatScore: number;
+  threatType: string | null;
+  threatDetails: string | null;
+  scannedElements: string[];
+}
+
+interface IVersionInfo {
+  bin: string;
+  core: string;
+  security: string;
+  smtp: string;
+}
+
+// --- SMTP Server types ---
+
+interface ISmtpServerConfig {
+  hostname: string;
+  ports: number[];
+  securePort?: number;
+  tlsCertPem?: string;
+  tlsKeyPem?: string;
+  maxMessageSize?: number;
+  maxConnections?: number;
+  maxRecipients?: number;
+  connectionTimeoutSecs?: number;
+  dataTimeoutSecs?: number;
+  authEnabled?: boolean;
+  maxAuthFailures?: number;
+  socketTimeoutSecs?: number;
+  processingTimeoutSecs?: number;
+  rateLimits?: IRateLimitConfig;
+}
+
+interface IRateLimitConfig {
+  maxConnectionsPerIp?: number;
+  maxMessagesPerSender?: number;
+  maxAuthFailuresPerIp?: number;
+  windowSecs?: number;
+}
+
+interface IEmailData {
+  type: 'inline' | 'file';
+  base64?: string;
+  path?: string;
+}
+
+interface IEmailReceivedEvent {
+  correlationId: string;
+  sessionId: string;
+  mailFrom: string;
+  rcptTo: string[];
+  data: IEmailData;
+  remoteAddr: string;
+  clientHostname: string | null;
+  secure: boolean;
+  authenticatedUser: string | null;
+  securityResults: any | null;
+}
+
+interface IAuthRequestEvent {
+  correlationId: string;
+  sessionId: string;
+  username: string;
+  password: string;
+  remoteAddr: string;
+}
+
+/**
+ * Type-safe command map for the mailer-bin IPC bridge.
+ */
+type TMailerCommands = {
+  ping: {
+    params: Record<string, never>;
+    result: { pong: boolean };
+  };
+  version: {
+    params: Record<string, never>;
+    result: IVersionInfo;
+  };
+  validateEmail: {
+    params: { email: string };
+    result: IValidationResult;
+  };
+  detectBounce: {
+    params: { smtpResponse?: string; diagnosticCode?: string; statusCode?: string };
+    result: IBounceDetection;
+  };
+  checkIpReputation: {
+    params: { ip: string };
+    result: IReputationResult;
+  };
+  verifyDkim: {
+    params: { rawMessage: string };
+    result: IDkimVerificationResult[];
+  };
+  signDkim: {
+    params: { rawMessage: string; domain: string; selector?: string; privateKey: string };
+    result: { header: string; signedMessage: string };
+  };
+  checkSpf: {
+    params: { ip: string; heloDomain: string; hostname?: string; mailFrom: string };
+    result: ISpfResult;
+  };
+  scanContent: {
+    params: {
+      subject?: string;
+      textBody?: string;
+      htmlBody?: string;
+      attachmentNames?: string[];
+    };
+    result: IContentScanResult;
+  };
+  verifyEmail: {
+    params: {
+      rawMessage: string;
+      ip: string;
+      heloDomain: string;
+      hostname?: string;
+      mailFrom: string;
+    };
+    result: IEmailSecurityResult;
+  };
+  startSmtpServer: {
+    params: ISmtpServerConfig;
+    result: { started: boolean };
+  };
+  stopSmtpServer: {
+    params: Record<string, never>;
+    result: { stopped: boolean; wasRunning?: boolean };
+  };
+  emailProcessingResult: {
+    params: {
+      correlationId: string;
+      accepted: boolean;
+      smtpCode?: number;
+      smtpMessage?: string;
+    };
+    result: { resolved: boolean };
+  };
+  authResult: {
+    params: {
+      correlationId: string;
+      success: boolean;
+      message?: string;
+    };
+    result: { resolved: boolean };
+  };
+  configureRateLimits: {
+    params: IRateLimitConfig;
+    result: { configured: boolean };
+  };
+};
+
+// ---------------------------------------------------------------------------
+// RustSecurityBridge — singleton wrapper around smartrust.RustBridge
+// ---------------------------------------------------------------------------
+
+/**
+ * Bridge between TypeScript and the Rust `mailer-bin` binary.
+ *
+ * Uses `@push.rocks/smartrust` for JSON-over-stdin/stdout IPC.
+ * Singleton — access via `RustSecurityBridge.getInstance()`.
+ */
+export class RustSecurityBridge {
+  private static instance: RustSecurityBridge | null = null;
+
+  private bridge: InstanceType<typeof plugins.smartrust.RustBridge<TMailerCommands>>;
+  private _running = false;
+
+  private constructor() {
+    this.bridge = new plugins.smartrust.RustBridge<TMailerCommands>({
+      binaryName: 'mailer-bin',
+      cliArgs: ['--management'],
+      requestTimeoutMs: 30_000,
+      readyTimeoutMs: 10_000,
+      localPaths: [
+        plugins.path.join(paths.packageDir, 'dist_rust', 'mailer-bin'),
+        plugins.path.join(paths.packageDir, 'rust', 'target', 'release', 'mailer-bin'),
+        plugins.path.join(paths.packageDir, 'rust', 'target', 'debug', 'mailer-bin'),
+      ],
+      searchSystemPath: false,
+    });
+
+    // Forward lifecycle events
+    this.bridge.on('ready', () => {
+      this._running = true;
+      logger.log('info', 'Rust security bridge is ready');
+    });
+
+    this.bridge.on('exit', (code: number | null, signal: string | null) => {
+      this._running = false;
+      logger.log('warn', `Rust security bridge exited (code=${code}, signal=${signal})`);
+    });
+
+    this.bridge.on('stderr', (line: string) => {
+      logger.log('debug', `[rust-bridge] ${line}`);
+    });
+  }
+
+  /** Get or create the singleton instance. */
+  public static getInstance(): RustSecurityBridge {
+    if (!RustSecurityBridge.instance) {
+      RustSecurityBridge.instance = new RustSecurityBridge();
+    }
+    return RustSecurityBridge.instance;
+  }
+
+  /** Whether the Rust process is currently running and accepting commands. */
+  public get running(): boolean {
+    return this._running;
+  }
+
+  // -----------------------------------------------------------------------
+  // Lifecycle
+  // -----------------------------------------------------------------------
+
+  /**
+   * Spawn the Rust binary and wait for the ready signal.
+   * @returns `true` if the binary started successfully, `false` otherwise.
+   */
+  public async start(): Promise<boolean> {
+    if (this._running) {
+      return true;
+    }
+    try {
+      const ok = await this.bridge.spawn();
+      this._running = ok;
+      if (ok) {
+        logger.log('info', 'Rust security bridge started');
+      } else {
+        logger.log('warn', 'Rust security bridge failed to start (binary not found or timeout)');
+      }
+      return ok;
+    } catch (err) {
+      logger.log('error', `Failed to start Rust security bridge: ${(err as Error).message}`);
+      return false;
+    }
+  }
+
+  /** Kill the Rust process. */
+  public async stop(): Promise<void> {
+    if (!this._running) {
+      return;
+    }
+    try {
+      this.bridge.kill();
+      this._running = false;
+      logger.log('info', 'Rust security bridge stopped');
+    } catch (err) {
+      logger.log('error', `Error stopping Rust security bridge: ${(err as Error).message}`);
+    }
+  }
+
+  // -----------------------------------------------------------------------
+  // Commands — thin typed wrappers over sendCommand
+  // -----------------------------------------------------------------------
+
+  /** Ping the Rust process. */
+  public async ping(): Promise<boolean> {
+    const res = await this.bridge.sendCommand('ping', {} as any);
+    return res?.pong === true;
+  }
+
+  /** Get version information for all Rust crates. */
+  public async getVersion(): Promise<IVersionInfo> {
+    return this.bridge.sendCommand('version', {} as any);
+  }
+
+  /** Validate an email address. */
+  public async validateEmail(email: string): Promise<IValidationResult> {
+    return this.bridge.sendCommand('validateEmail', { email });
+  }
+
+  /** Detect bounce type from SMTP response / diagnostic code. */
+  public async detectBounce(opts: {
+    smtpResponse?: string;
+    diagnosticCode?: string;
+    statusCode?: string;
+  }): Promise<IBounceDetection> {
+    return this.bridge.sendCommand('detectBounce', opts);
+  }
+
+  /** Scan email content for threats (phishing, spam, malware, etc.). */
+  public async scanContent(opts: {
+    subject?: string;
+    textBody?: string;
+    htmlBody?: string;
+    attachmentNames?: string[];
+  }): Promise<IContentScanResult> {
+    return this.bridge.sendCommand('scanContent', opts);
+  }
+
+  /** Check IP reputation via DNSBL. */
+  public async checkIpReputation(ip: string): Promise<IReputationResult> {
+    return this.bridge.sendCommand('checkIpReputation', { ip });
+  }
+
+  /** Verify DKIM signatures on a raw email message. */
+  public async verifyDkim(rawMessage: string): Promise<IDkimVerificationResult[]> {
+    return this.bridge.sendCommand('verifyDkim', { rawMessage });
+  }
+
+  /** Sign an email with DKIM. */
+  public async signDkim(opts: {
+    rawMessage: string;
+    domain: string;
+    selector?: string;
+    privateKey: string;
+  }): Promise<{ header: string; signedMessage: string }> {
+    return this.bridge.sendCommand('signDkim', opts);
+  }
+
+  /** Check SPF for a sender. */
+  public async checkSpf(opts: {
+    ip: string;
+    heloDomain: string;
+    hostname?: string;
+    mailFrom: string;
+  }): Promise<ISpfResult> {
+    return this.bridge.sendCommand('checkSpf', opts);
+  }
+
+  /**
+   * Compound email security verification: DKIM + SPF + DMARC in one IPC call.
+   *
+   * This is the preferred method for inbound email verification — it avoids
+   * 3 sequential round-trips and correctly passes raw mail-auth types internally.
+   */
+  public async verifyEmail(opts: {
+    rawMessage: string;
+    ip: string;
+    heloDomain: string;
+    hostname?: string;
+    mailFrom: string;
+  }): Promise<IEmailSecurityResult> {
+    return this.bridge.sendCommand('verifyEmail', opts);
+  }
+
+  // -----------------------------------------------------------------------
+  // SMTP Server lifecycle
+  // -----------------------------------------------------------------------
+
+  /**
+   * Start the Rust SMTP server.
+   * The server will listen on the configured ports and emit events for
+   * emailReceived and authRequest that must be handled by the caller.
+   */
+  public async startSmtpServer(config: ISmtpServerConfig): Promise<boolean> {
+    const result = await this.bridge.sendCommand('startSmtpServer', config);
+    return result?.started === true;
+  }
+
+  /** Stop the Rust SMTP server. */
+  public async stopSmtpServer(): Promise<void> {
+    await this.bridge.sendCommand('stopSmtpServer', {} as any);
+  }
+
+  /**
+   * Send the result of email processing back to the Rust SMTP server.
+   * This resolves a pending correlation-ID callback, allowing the Rust
+   * server to send the SMTP response to the client.
+   */
+  public async sendEmailProcessingResult(opts: {
+    correlationId: string;
+    accepted: boolean;
+    smtpCode?: number;
+    smtpMessage?: string;
+  }): Promise<void> {
+    await this.bridge.sendCommand('emailProcessingResult', opts);
+  }
+
+  /**
+   * Send the result of authentication validation back to the Rust SMTP server.
+   */
+  public async sendAuthResult(opts: {
+    correlationId: string;
+    success: boolean;
+    message?: string;
+  }): Promise<void> {
+    await this.bridge.sendCommand('authResult', opts);
+  }
+
+  /** Update rate limit configuration at runtime. */
+  public async configureRateLimits(config: IRateLimitConfig): Promise<void> {
+    await this.bridge.sendCommand('configureRateLimits', config);
+  }
+
+  // -----------------------------------------------------------------------
+  // Event registration — delegates to the underlying bridge EventEmitter
+  // -----------------------------------------------------------------------
+
+  /**
+   * Register a handler for emailReceived events from the Rust SMTP server.
+   * These events fire when a complete email has been received and needs processing.
+   */
+  public onEmailReceived(handler: (data: IEmailReceivedEvent) => void): void {
+    this.bridge.on('management:emailReceived', handler);
+  }
+
+  /**
+   * Register a handler for authRequest events from the Rust SMTP server.
+   * The handler must call sendAuthResult() with the correlationId.
+   */
+  public onAuthRequest(handler: (data: IAuthRequestEvent) => void): void {
+    this.bridge.on('management:authRequest', handler);
+  }
+
+  /** Remove an emailReceived event handler. */
+  public offEmailReceived(handler: (data: IEmailReceivedEvent) => void): void {
+    this.bridge.off('management:emailReceived', handler);
+  }
+
+  /** Remove an authRequest event handler. */
+  public offAuthRequest(handler: (data: IAuthRequestEvent) => void): void {
+    this.bridge.off('management:authRequest', handler);
+  }
+}
+
+// Re-export interfaces for consumers
+export type {
+  IDkimVerificationResult,
+  ISpfResult,
+  IDmarcResult,
+  IEmailSecurityResult,
+  IValidationResult,
+  IBounceDetection,
+  IContentScanResult,
+  IReputationResult as IRustReputationResult,
+  IVersionInfo,
+  ISmtpServerConfig,
+  IRateLimitConfig,
+  IEmailData,
+  IEmailReceivedEvent,
+  IAuthRequestEvent,
+};

ts/security/index.ts

@@ -19,3 +19,15 @@ export {
   type IScanResult,
   type IContentScannerOptions
 } from './classes.contentscanner.js';
+
+export {
+  RustSecurityBridge,
+  type IDkimVerificationResult,
+  type ISpfResult,
+  type IDmarcResult,
+  type IEmailSecurityResult,
+  type IValidationResult,
+  type IBounceDetection,
+  type IRustReputationResult,
+  type IVersionInfo,
+} from './classes.rustsecuritybridge.js';