dns: add HELO/PTR consistency check

Compare the HELO/EHLO hostname announced by the sending server (first
Received hop) against the sender IP's PTR records, surfacing the same
signal as x-ptr/policy.ptr in Authentication-Results. Adds helo_hostname
and helo_ptr_match to DNSResults, applies a 15-point PTR sub-score
penalty on mismatch, and displays the result in a new HELO/PTR
Consistency card.

pkg/analyzer/authentication.go

@@ -140,6 +140,13 @@ func (a *AuthenticationAnalyzer) parseAuthenticationResultsHeader(header string,
 				results.XAlignedFrom = a.parseXAlignedFromResult(part)
 			}
 		}
+
+		// Parse x-ptr
+		if strings.HasPrefix(part, "x-ptr=") {
+			if results.XPtr == nil {
+				results.XPtr = a.parseXPtrResult(part)
+			}
+		}
 	}
 }
 

pkg/analyzer/authentication_x_ptr.go

@@ -0,0 +1,61 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"regexp"
+	"strings"
+
+	"git.happydns.org/happyDeliver/internal/model"
+	"git.happydns.org/happyDeliver/internal/utils"
+)
+
+// parseXPtrResult parses the x-ptr result from Authentication-Results.
+// Example: x-ptr=fail smtp.helo=relay.example.org policy.ptr=mail.example.com
+func (a *AuthenticationAnalyzer) parseXPtrResult(part string) *model.XPtrResult {
+	result := &model.XPtrResult{}
+
+	// Extract result (pass, fail, none, temperror, permerror)
+	re := regexp.MustCompile(`x-ptr=(\w+)`)
+	if matches := re.FindStringSubmatch(part); len(matches) > 1 {
+		resultStr := strings.ToLower(matches[1])
+		result.Result = model.XPtrResultResult(resultStr)
+	}
+
+	// Extract announced HELO hostname (smtp.helo)
+	heloRe := regexp.MustCompile(`smtp\.helo=([^\s;()]+)`)
+	if matches := heloRe.FindStringSubmatch(part); len(matches) > 1 {
+		helo := matches[1]
+		result.Helo = &helo
+	}
+
+	// Extract reverse DNS hostname (policy.ptr)
+	ptrRe := regexp.MustCompile(`policy\.ptr=([^\s;()]+)`)
+	if matches := ptrRe.FindStringSubmatch(part); len(matches) > 1 {
+		ptr := matches[1]
+		result.Ptr = &ptr
+	}
+
+	result.Details = utils.PtrTo(strings.TrimPrefix(part, "x-ptr="))
+
+	return result
+}

pkg/analyzer/authentication_x_ptr_test.go

@@ -0,0 +1,81 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"testing"
+
+	"git.happydns.org/happyDeliver/internal/model"
+	"git.happydns.org/happyDeliver/internal/utils"
+)
+
+func TestParseXPtrResult(t *testing.T) {
+	a := NewAuthenticationAnalyzer("receiver.com")
+
+	tests := []struct {
+		name           string
+		part           string
+		expectedResult model.XPtrResultResult
+		expectedHelo   *string
+		expectedPtr    *string
+	}{
+		{
+			name:           "x-ptr fail with helo and ptr",
+			part:           "x-ptr=fail smtp.helo=relay.example.org policy.ptr=mail.example.com",
+			expectedResult: model.XPtrResultResultFail,
+			expectedHelo:   utils.PtrTo("relay.example.org"),
+			expectedPtr:    utils.PtrTo("mail.example.com"),
+		},
+		{
+			name:           "x-ptr pass",
+			part:           "x-ptr=pass smtp.helo=mail.example.com policy.ptr=mail.example.com",
+			expectedResult: model.XPtrResultResultPass,
+			expectedHelo:   utils.PtrTo("mail.example.com"),
+			expectedPtr:    utils.PtrTo("mail.example.com"),
+		},
+		{
+			name:           "x-ptr none without ptr",
+			part:           "x-ptr=none smtp.helo=relay.example.org",
+			expectedResult: model.XPtrResultResultNone,
+			expectedHelo:   utils.PtrTo("relay.example.org"),
+			expectedPtr:    nil,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := a.parseXPtrResult(tt.part)
+			if result == nil {
+				t.Fatal("expected non-nil result")
+			}
+			if result.Result != tt.expectedResult {
+				t.Errorf("Result = %q, want %q", result.Result, tt.expectedResult)
+			}
+			if !equalStrPtr(result.Helo, tt.expectedHelo) {
+				t.Errorf("Helo = %v, want %v", result.Helo, tt.expectedHelo)
+			}
+			if !equalStrPtr(result.Ptr, tt.expectedPtr) {
+				t.Errorf("Ptr = %v, want %v", result.Ptr, tt.expectedPtr)
+			}
+		})
+	}
+}

pkg/analyzer/dns.go

@@ -88,6 +88,16 @@ func (d *DNSAnalyzer) AnalyzeDNS(email *EmailMessage, headersResults *model.Head
 			if len(forwardRecords) > 0 {
 				results.PtrForwardRecords = &forwardRecords
 			}
+
+			// Record the announced HELO name and whether it matches the PTR record
+			if firstHop.From != nil && *firstHop.From != "" {
+				helo := *firstHop.From
+				results.HeloHostname = &helo
+				if len(ptrRecords) > 0 {
+					match := checkHeloPtrMatch(helo, ptrRecords)
+					results.HeloPtrMatch = &match
+				}
+			}
 		}
 	}
 

pkg/analyzer/dns_fcr.go

@@ -23,6 +23,7 @@ package analyzer
 
 import (
 	"context"
+	"strings"
 
 	"git.happydns.org/happyDeliver/internal/model"
 )
@@ -62,6 +63,21 @@ func (d *DNSAnalyzer) checkPTRAndForward(ip string) ([]string, []string) {
 	return ptrNames, forwardIPs
 }
 
+// checkHeloPtrMatch reports whether the announced HELO hostname matches one of
+// the sender's PTR records (case-insensitive, trailing dot ignored).
+func checkHeloPtrMatch(helo string, ptrRecords []string) bool {
+	helo = strings.TrimSuffix(strings.ToLower(strings.TrimSpace(helo)), ".")
+	if helo == "" {
+		return false
+	}
+	for _, ptr := range ptrRecords {
+		if strings.TrimSuffix(strings.ToLower(ptr), ".") == helo {
+			return true
+		}
+	}
+	return false
+}
+
 // Proper reverse DNS (PTR) and forward-confirmed reverse DNS (FCrDNS) is important for deliverability
 func (d *DNSAnalyzer) calculatePTRScore(results *model.DNSResults, senderIP string) (score int) {
 	if results.PtrRecords != nil && len(*results.PtrRecords) > 0 {
@@ -73,6 +89,11 @@ func (d *DNSAnalyzer) calculatePTRScore(results *model.DNSResults, senderIP stri
 			score -= 15
 		}
 
+		// Penalty when the announced HELO name doesn't match the PTR hostname
+		if results.HeloPtrMatch != nil && !*results.HeloPtrMatch {
+			score -= 15
+		}
+
 		// Additional 50 points for forward-confirmed reverse DNS (FCrDNS)
 		// This means the PTR hostname resolves back to IPs that include the original sender IP
 		if results.PtrForwardRecords != nil && len(*results.PtrForwardRecords) > 0 && senderIP != "" {

pkg/analyzer/dns_fcr_test.go

@@ -0,0 +1,104 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025-2026 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"testing"
+
+	"git.happydns.org/happyDeliver/internal/model"
+)
+
+func TestCheckHeloPtrMatch(t *testing.T) {
+	tests := []struct {
+		name       string
+		helo       string
+		ptrRecords []string
+		want       bool
+	}{
+		{"exact match", "mail.example.com", []string{"mail.example.com"}, true},
+		{"case insensitive", "Mail.Example.COM", []string{"mail.example.com"}, true},
+		{"trailing dot ignored", "mail.example.com.", []string{"mail.example.com"}, true},
+		{"mismatch", "relay.example.org", []string{"mail.example.com"}, false},
+		{"match among several", "smtp.example.com", []string{"mail.example.com", "smtp.example.com"}, true},
+		{"empty helo", "", []string{"mail.example.com"}, false},
+		{"no ptr records", "mail.example.com", nil, false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := checkHeloPtrMatch(tt.helo, tt.ptrRecords); got != tt.want {
+				t.Errorf("checkHeloPtrMatch(%q, %v) = %v, want %v", tt.helo, tt.ptrRecords, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCalculatePTRScoreHeloMismatch(t *testing.T) {
+	d := NewDNSAnalyzer(0)
+	senderIP := "80.67.179.207"
+	ptr := []string{"mail.example.com"}
+	forward := []string{senderIP}
+
+	matchTrue := true
+	matchFalse := false
+
+	tests := []struct {
+		name    string
+		results *model.DNSResults
+		want    int
+	}{
+		{
+			name: "helo matches ptr - no penalty (PTR+FCrDNS)",
+			results: &model.DNSResults{
+				PtrRecords:        &ptr,
+				PtrForwardRecords: &forward,
+				HeloPtrMatch:      &matchTrue,
+			},
+			want: 100,
+		},
+		{
+			name: "helo mismatch - 15 point penalty",
+			results: &model.DNSResults{
+				PtrRecords:        &ptr,
+				PtrForwardRecords: &forward,
+				HeloPtrMatch:      &matchFalse,
+			},
+			want: 85,
+		},
+		{
+			name: "no helo info - no penalty",
+			results: &model.DNSResults{
+				PtrRecords:        &ptr,
+				PtrForwardRecords: &forward,
+			},
+			want: 100,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := d.calculatePTRScore(tt.results, senderIP); got != tt.want {
+				t.Errorf("calculatePTRScore() = %d, want %d", got, tt.want)
+			}
+		})
+	}
+}