Version 0.2.8
Security fixes for forged authentication results
- Authentication results are now read item by item. Text that the sender controls (such as the envelope sender address or comments) can no longer be used to inject fake "pass" results.
- Results are marked as verified only when the topmost Authentication-Results header comes from one of your trusted servers. Otherwise the banner shows "No trusted results".
- If no trusted server is configured, the SPF/DKIM/DMARC badges are now shown in gray. Click the "Unverified" badge to open the settings and enter your mail server's ID (for Gmail:
mx.google.com).