From 3c192f17fd6b39c22c8dcd582ca6a41c3862d65f Mon Sep 17 00:00:00 2001
From: Pierre-Olivier Mercier <nemunaire@nemunai.re>
Date: Wed, 25 Mar 2026 12:28:18 +0700
Subject: [PATCH] Improve DKIM summary to distinguish missing records from
 invalid signatures

Use DNS records instead of authentication results to determine DKIM
presence, enabling a three-state display: passed (green), published but
invalid signature (yellow+red), or no DKIM at all (red).
---
 web/src/lib/components/SummaryCard.svelte | 28 ++++++++++++++++++-----
 1 file changed, 22 insertions(+), 6 deletions(-)

diff --git a/web/src/lib/components/SummaryCard.svelte b/web/src/lib/components/SummaryCard.svelte
index 5d93513..518e996 100644
--- a/web/src/lib/components/SummaryCard.svelte
+++ b/web/src/lib/components/SummaryCard.svelte
@@ -25,16 +25,32 @@
 
         // Email sender information
         const mailFrom = report.header_analysis?.headers?.from?.value || "an unknown sender";
-        const hasDkim = report.authentication?.dkim && report.authentication?.dkim.length > 0;
-        const dkimPassed = hasDkim && report.authentication?.dkim?.some((d) => d.result === "pass");
+        const hasDkim =
+            report.dns_results?.dkim_records && report.dns_results?.dkim_records?.length > 0;
+        const dkimPassed =
+            report.authentication?.dkim &&
+            report.authentication?.dkim.length > 0 &&
+            report.authentication?.dkim?.some((d) => d.result === "pass");
 
         segments.push({ text: "Received a " });
         segments.push({
-            text: dkimPassed ? "DKIM-signed" : "non-DKIM-signed",
-            highlight: { color: dkimPassed ? "good" : "danger", bold: true },
-            link: "#authentication-dkim",
+            text: hasDkim ? "DKIM-signed" : "non-DKIM-signed",
+            highlight: {
+                color: hasDkim ? (dkimPassed ? "good" : "warning") : "danger",
+                bold: true,
+            },
+            link: hasDkim && dkimPassed ? "#authentication-dkim" : "#dns-details",
         });
-        segments.push({ text: " email from " });
+        segments.push({ text: " email" });
+        if (hasDkim && !dkimPassed) {
+            segments.push({ text: " with " });
+            segments.push({
+                text: "an invalid signature",
+                highlight: { color: "danger", bold: true },
+                link: "#authentication-dkim",
+            });
+        }
+        segments.push({ text: " from " });
         segments.push({
             text: mailFrom,
             highlight: { emphasis: true },