Update dependency svelte to v5.41.0

.drone.yml

@@ -9,7 +9,7 @@ platform:
 
 steps:
 - name: frontend
-  image: node:24-alpine
+  image: node:22-alpine
   commands:
   - cd web
   - npm install --network-timeout=100000
@@ -21,7 +21,7 @@ steps:
   commands:
   - apk add --no-cache git
   - go generate ./...
-  - go build -tags netgo -ldflags '-w -X git.happydns.org/happyDeliver/internal/version.Version=${DRONE_BRANCH}-${DRONE_COMMIT} -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} ./cmd/happyDeliver
+  - go build -tags netgo -ldflags '-w -X main.Version=${DRONE_BRANCH}-${DRONE_COMMIT} -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} ./cmd/happyDeliver
   - ln happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} happydeliver
   environment:
     CGO_ENABLED: 0
@@ -35,7 +35,7 @@ steps:
   commands:
   - apk add --no-cache git
   - go generate ./...
-  - go build -tags netgo -ldflags '-w -X git.happydns.org/happyDeliver/internal/version.Version=${DRONE_TAG##v} -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
+  - go build -tags netgo -ldflags '-w -X main.Version=${DRONE_TAG##v} -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
   - ln happydeliver-${DRONE_STAGE_OS}-${DRONE_STAGE_ARCH} happydeliver
   environment:
     CGO_ENABLED: 0
@@ -47,7 +47,7 @@ steps:
   image: golang:1-alpine
   commands:
   - apk add --no-cache git
-  - go build -tags netgo -ldflags '-w -X "git.happydns.org/happyDeliver/internal/version.Version=${DRONE_BRANCH}-${DRONE_COMMIT}" -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-darwin-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
+  - go build -tags netgo -ldflags '-w -X "main.Version=${DRONE_BRANCH}-${DRONE_COMMIT}" -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-darwin-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
   environment:
     CGO_ENABLED: 0
     GOOS: darwin
@@ -61,7 +61,7 @@ steps:
   image: golang:1-alpine
   commands:
   - apk add --no-cache git
-  - go build -tags netgo -ldflags '-w -X "git.happydns.org/happyDeliver/internal/version.Version=${DRONE_TAG##v}" -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-darwin-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
+  - go build -tags netgo -ldflags '-w -X "main.Version=${DRONE_TAG##v}" -X main.build=${DRONE_BUILD_NUMBER}' -o happydeliver-darwin-${DRONE_STAGE_ARCH} ./cmd/happyDeliver/
   environment:
     CGO_ENABLED: 0
     GOOS: darwin

.gitignore

@@ -26,5 +26,5 @@ logs/
 *.sqlite3
 
 # OpenAPI generated files
-internal/api/server.gen.go
-internal/model/types.gen.go
+internal/api/models.gen.go
+internal/api/server.gen.go

Dockerfile

@@ -1,6 +1,6 @@
 # Multi-stage Dockerfile for happyDeliver with integrated MTA
 # Stage 1: Build the Svelte application
-FROM node:24-alpine AS nodebuild
+FROM node:22-alpine AS nodebuild
 
 WORKDIR /build
 
@@ -31,100 +31,19 @@ COPY --from=nodebuild /build/web/build/ ./web/build/
 RUN go generate ./... && \
     CGO_ENABLED=1 GOOS=linux go build -a -installsuffix cgo -ldflags="-w -s" -o happyDeliver ./cmd/happyDeliver
 
-# Stage 3: Prepare perl and spamass-milt
-FROM alpine:3 AS pl
-
-RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories && \
-    apk add --no-cache \
-    build-base \
-    libmilter-dev \
-    musl-obstack-dev \
-    openssl \
-    openssl-dev \
-    perl-app-cpanminus \
-    perl-alien-libxml2 \
-    perl-class-load-xs \
-    perl-cpanel-json-xs \
-    perl-crypt-openssl-rsa \
-    perl-crypt-openssl-random \
-    perl-crypt-openssl-verify \
-    perl-crypt-openssl-x509 \
-    perl-cryptx \
-    perl-dbd-sqlite \
-    perl-dbi \
-    perl-email-address-xs \
-    perl-json-xs \
-    perl-list-moreutils \
-    perl-moose \
-    perl-net-idn-encode@edge \
-    perl-net-ssleay \
-    perl-netaddr-ip \
-    perl-package-stash \
-    perl-params-util \
-    perl-params-validate \
-    perl-proc-processtable \
-    perl-sereal-decoder \
-    perl-sereal-encoder \
-    perl-socket6 \
-    perl-sub-identify \
-    perl-variable-magic \
-    perl-xml-libxml \
-    perl-dev \
-    spamassassin-client \
-    zlib-dev \
-    && \
-    ln -s /usr/bin/ld /bin/ld
-
-RUN cpanm --notest Mail::SPF && \
-    cpanm --notest Mail::DKIM && \
-    cpanm --notest Mail::Milter::Authentication
-
-RUN wget https://download.savannah.nongnu.org/releases/spamass-milt/spamass-milter-0.4.0.tar.gz && \
-    tar xzf spamass-milter-0.4.0.tar.gz && \
-    cd spamass-milter-0.4.0 && \
-    ./configure && make install
-
-# Stage 4: Runtime image with Postfix and all filters
+# Stage 3: Runtime image with Postfix and all filters
 FROM alpine:3
 
 # Install all required packages
-RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/apk/repositories && \
-    apk add --no-cache \
+RUN apk add --no-cache \
     bash \
     ca-certificates \
-    libmilter \
-    openssl \
-    perl \
-    perl-alien-libxml2 \
-    perl-class-load-xs \
-    perl-cpanel-json-xs \
-    perl-crypt-openssl-rsa \
-    perl-crypt-openssl-random \
-    perl-crypt-openssl-verify \
-    perl-crypt-openssl-x509 \
-    perl-cryptx \
-    perl-dbd-sqlite \
-    perl-dbi \
-    perl-email-address-xs \
-    perl-json-xs \
-    perl-list-moreutils \
-    perl-moose \
-    perl-net-idn-encode@edge \
-    perl-net-ssleay \
-    perl-netaddr-ip \
-    perl-package-stash \
-    perl-params-util \
-    perl-params-validate \
-    perl-proc-processtable \
-    perl-sereal-decoder \
-    perl-sereal-encoder \
-    perl-socket6 \
-    perl-sub-identify \
-    perl-variable-magic \
-    perl-xml-libxml \
+    opendkim \
+    opendkim-utils \
+    opendmarc \
     postfix \
     postfix-pcre \
-    rspamd \
+    postfix-policyd-spf-perl \
     spamassassin \
     spamassassin-client \
     supervisor \
@@ -132,8 +51,8 @@ RUN echo "@edge https://dl-cdn.alpinelinux.org/alpine/edge/community" >> /etc/ap
     tzdata \
     && rm -rf /var/cache/apk/*
 
-# Copy Mail::Milter::Authentication and its dependancies
-COPY --from=pl /usr/local/ /usr/local/
+# Get test-only version of postfix-policyd-spf-perl
+ADD https://git.nemunai.re/happyDomain/postfix-policyd-spf-perl/raw/branch/master/postfix-policyd-spf-perl  /usr/bin/postfix-policyd-spf-perl
 
 # Create happydeliver user and group
 RUN addgroup -g 1000 happydeliver && \
@@ -143,15 +62,12 @@ RUN addgroup -g 1000 happydeliver && \
 RUN mkdir -p /etc/happydeliver \
     /var/lib/happydeliver \
     /var/log/happydeliver \
-    /var/cache/authentication_milter \
-    /var/lib/authentication_milter \
-    /var/spool/postfix/authentication_milter \
-    /var/spool/postfix/spamassassin \
-    /var/spool/postfix/rspamd \
+    /var/spool/postfix/opendkim \
+    /var/spool/postfix/opendmarc \
+    /etc/opendkim/keys \
     && chown -R happydeliver:happydeliver /var/lib/happydeliver /var/log/happydeliver \
-    && chown -R mail:mail /var/spool/postfix/authentication_milter /var/spool/postfix/spamassassin \
-    && chown rspamd:mail /var/spool/postfix/rspamd \
-    && chmod 750 /var/spool/postfix/rspamd
+    && chown -R opendkim:postfix /var/spool/postfix/opendkim \
+    && chown -R opendmarc:postfix /var/spool/postfix/opendmarc
 
 # Copy the built application
 COPY --from=builder /build/happyDeliver /usr/local/bin/happyDeliver
@@ -159,9 +75,9 @@ RUN chmod +x /usr/local/bin/happyDeliver
 
 # Copy configuration files
 COPY docker/postfix/ /etc/postfix/
-COPY docker/authentication_milter/authentication_milter.json /etc/authentication_milter.json
+COPY docker/opendkim/ /etc/opendkim/
+COPY docker/opendmarc/ /etc/opendmarc/
 COPY docker/spamassassin/ /etc/mail/spamassassin/
-COPY docker/rspamd/local.d/ /etc/rspamd/local.d/
 COPY docker/supervisor/ /etc/supervisor/
 COPY docker/entrypoint.sh /entrypoint.sh
 
@@ -173,21 +89,11 @@ RUN chmod +x /entrypoint.sh
 EXPOSE 25 8080
 
 # Default configuration
-ENV HAPPYDELIVER_DATABASE_TYPE=sqlite \
-    HAPPYDELIVER_DATABASE_DSN=/var/lib/happydeliver/happydeliver.db \
-    HAPPYDELIVER_DOMAIN=happydeliver.local \
-    HAPPYDELIVER_ADDRESS_PREFIX=test- \
-    HAPPYDELIVER_DNS_TIMEOUT=5s \
-    HAPPYDELIVER_HTTP_TIMEOUT=10s \
-    HAPPYDELIVER_RSPAMD_API_URL=http://127.0.0.1:11334
+ENV HAPPYDELIVER_DATABASE_TYPE=sqlite HAPPYDELIVER_DATABASE_DSN=/var/lib/happydeliver/happydeliver.db HAPPYDELIVER_DOMAIN=happydeliver.local HAPPYDELIVER_ADDRESS_PREFIX=test- HAPPYDELIVER_DNS_TIMEOUT=5s HAPPYDELIVER_HTTP_TIMEOUT=10s HAPPYDELIVER_RBL=zen.spamhaus.org,bl.spamcop.net,b.barracudacentral.org,dnsbl.sorbs.net,dnsbl-1.uceprotect.net,bl.mailspike.net
 
 # Volume for persistent data
 VOLUME ["/var/lib/happydeliver", "/var/log/happydeliver"]
 
-# Health check
-HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
-    CMD wget --quiet --tries=1 --spider http://localhost:8080/api/status || exit 1
-
 # Set entrypoint
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["supervisord", "-c", "/etc/supervisor/supervisord.conf"]

README.md

@@ -1,32 +1,28 @@
-# happyDeliver - Email Deliverability Tester
-
-![banner](banner.webp)
+# happyDeliver
 
 An open-source email deliverability testing platform that analyzes test emails and provides detailed deliverability reports with scoring.
 
 ## Features
 
-- **Complete Email Analysis**: Analyzes SPF, DKIM, DMARC, BIMI, ARC, SpamAssassin and rspamd scores, DNS records, blacklist status, content quality, and more
+- **Complete Email Analysis**: Analyzes SPF, DKIM, DMARC, SpamAssassin scores, DNS records, blacklist status, content quality, and more
 - **REST API**: Full-featured API for creating tests and retrieving reports
 - **LMTP Server**: Built-in LMTP server for seamless MTA integration
-- **Scoring System**: Gives A to F grades and scoring with weighted factors across dns, authentication, spam, blacklists, content, and headers
+- **Scoring System**: 0-10 scoring with weighted factors across authentication, spam, blacklists, content, and headers
 - **Database Storage**: SQLite or PostgreSQL support
 - **Configurable**: via environment or config file for all settings
 
-![A sample deliverability report](web/static/img/report.webp)
-
 ## Quick Start
 
 ### With Docker (Recommended)
 
-The easiest way to run happyDeliver is using the all-in-one Docker container that includes Postfix, authentication_milter, SpamAssassin, and the happyDeliver application.
+The easiest way to run happyDeliver is using the all-in-one Docker container that includes Postfix, OpenDKIM, OpenDMARC, SpamAssassin, and the happyDeliver application.
 
 #### What's included in the Docker container:
 
 - **Postfix MTA**: Receives emails on port 25
-- **authentication_milter**: Entreprise grade email authentication
+- **OpenDKIM**: DKIM signature verification
+- **OpenDMARC**: DMARC policy validation
 - **SpamAssassin**: Spam scoring and analysis
-- **rspamd**: Second spam filter for cross-validated scoring
 - **happyDeliver API**: REST API server on port 8080
 - **SQLite Database**: Persistent storage for tests and reports
 
@@ -38,7 +34,7 @@ git clone https://git.nemunai.re/happyDomain/happyDeliver.git
 cd happydeliver
 
 # Edit docker-compose.yml to set your domain
-# Change HAPPYDELIVER_DOMAIN environment variable and hostname
+# Change HAPPYDELIVER_DOMAIN and HOSTNAME environment variables
 
 # Build and start
 docker-compose up -d
@@ -64,86 +60,12 @@ docker run -d \
   -p 25:25 \
   -p 8080:8080 \
   -e HAPPYDELIVER_DOMAIN=yourdomain.com \
-  --hostname mail.yourdomain.com \
+  -e HOSTNAME=mail.yourdomain.com \
   -v $(pwd)/data:/var/lib/happydeliver \
   -v $(pwd)/logs:/var/log/happydeliver \
   happydeliver:latest
 ```
 
-#### 3. Configure TLS Certificates (Optional but Recommended)
-
-To enable TLS encryption for incoming SMTP connections, you can configure Postfix to use your SSL/TLS certificates. This is highly recommended for production deployments.
-
-##### Using docker-compose
-
-Add the certificate paths to your `docker-compose.yml`:
-
-```yaml
-environment:
-  - POSTFIX_CERT_FILE=/etc/ssl/certs/mail.yourdomain.com.crt
-  - POSTFIX_KEY_FILE=/etc/ssl/private/mail.yourdomain.com.key
-volumes:
-  - /path/to/your/certificate.crt:/etc/ssl/certs/mail.yourdomain.com.crt:ro
-  - /path/to/your/private.key:/etc/ssl/private/mail.yourdomain.com.key:ro
-```
-
-##### Using docker run
-
-```bash
-docker run -d \
-  --name happydeliver \
-  -p 25:25 \
-  -p 8080:8080 \
-  -e HAPPYDELIVER_DOMAIN=yourdomain.com \
-  -e POSTFIX_CERT_FILE=/etc/ssl/certs/mail.yourdomain.com.crt \
-  -e POSTFIX_KEY_FILE=/etc/ssl/private/mail.yourdomain.com.key \
-  --hostname mail.yourdomain.com \
-  -v /path/to/your/certificate.crt:/etc/ssl/certs/mail.yourdomain.com.crt:ro \
-  -v /path/to/your/private.key:/etc/ssl/private/mail.yourdomain.com.key:ro \
-  -v $(pwd)/data:/var/lib/happydeliver \
-  -v $(pwd)/logs:/var/log/happydeliver \
-  happydeliver:latest
-```
-
-**Notes:**
-- The certificate file should contain the full certificate chain (certificate + intermediate CAs)
-- The private key file must be readable by the postfix user inside the container
-- TLS is configured with `smtpd_tls_security_level = may`, which means it's opportunistic (STARTTLS supported but not required)
-- If both environment variables are not set, Postfix will run without TLS support
-
-#### 4. Configure Network and DNS
-
-##### Open SMTP Port
-
-Port 25 (SMTP) must be accessible from the internet to receive test emails:
-
-```bash
-# Check if port 25 is listening
-netstat -ln | grep :25
-
-# Allow port 25 through firewall (example with ufw)
-sudo ufw allow 25/tcp
-
-# For iptables
-sudo iptables -A INPUT -p tcp --dport 25 -j ACCEPT
-```
-
-**Note:** Many ISPs and cloud providers block port 25 by default to prevent spam. You may need to request port 25 to be unblocked through your provider's support.
-
-##### Configure DNS Records
-
-Point your domain to the server's IP address.
-
-```
-yourdomain.com.  IN  A     203.0.113.10
-yourdomain.com.  IN  AAAA  2001:db8::10
-```
-
-Replace `yourdomain.com` with the value you set for `HAPPYDELIVER_DOMAIN` and IPs accordingly.
-
-There is no need for an MX record here since the same host will serve both HTTP and SMTP.
-
-
 ### Manual Build
 
 #### 1. Build
@@ -163,27 +85,10 @@ The server will start on `http://localhost:8080` by default.
 
 #### 3. Integrate with your existing e-mail setup
 
-It is expected your setup annotate the email with eg. opendkim, spamassassin, rspamd, ...
+It is expected your setup annotate the email with eg. opendkim, spamassassin, ...
 happyDeliver will not perform thoses checks, it relies instead on standard software to have real world annotations.
 
-#### Receiver Hostname
-
-happyDeliver filters `Authentication-Results` headers by hostname to only trust headers added by your MTA (and not headers that may have been injected by the sender). By default, it uses the system hostname (`os.Hostname()`).
-
-If your MTA's `authserv-id` (the hostname at the beginning of `Authentication-Results` headers) differs from the machine running happyDeliver, you must set it explicitly:
-
-```bash
-./happyDeliver server -receiver-hostname mail.example.com
-```
-
-Or via environment variable:
-```bash
-HAPPYDELIVER_RECEIVER_HOSTNAME=mail.example.com ./happyDeliver server
-```
-
-**How to find the correct value:** look at the `Authentication-Results` headers in a received email. They start with the authserv-id, e.g. `Authentication-Results: mail.example.com; spf=pass ...` — in this case, use `mail.example.com`.
-
-If the value is misconfigured, happyDeliver will log a warning when the last `Received` hop doesn't match the expected hostname.
+Choose one of the following way to integrate happyDeliver in your existing setup:
 
 #### Postfix LMTP Transport
 
@@ -201,9 +106,9 @@ You'll obtain the best results with a custom [transport rule](https://www.postfi
 
   ```
   # Transport map - route test emails to happyDeliver LMTP server
-  # Pattern: test-<base32-uuid>@yourdomain.com -> LMTP on localhost:2525
+  # Pattern: test-<uuid>@yourdomain.com -> LMTP on localhost:2525
 
-  /^test-[a-zA-Z2-7-]{26,30}@yourdomain\.com$/  lmtp:inet:127.0.0.1:2525
+  /^test-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}@yourdomain\.com$/  lmtp:inet:127.0.0.1:2525
   ```
 
 3. Append the created file to `transport_maps` in your `main.cf`:
@@ -237,7 +142,7 @@ Response:
 ```json
 {
   "id": "550e8400-e29b-41d4-a716-446655440000",
-  "email": "test-kfauqaao-ukj2if3n-fgrfkiafaa@localhost",
+  "email": "test-550e8400@localhost",
   "status": "pending",
   "message": "Send your test email to the address above"
 }
@@ -279,43 +184,22 @@ cat email.eml | ./happyDeliver analyze -recipient test-uuid@yourdomain.com
 
 **Note:** In production, emails are delivered via LMTP (see integration instructions above).
 
-## Use with happyDomain
-
-happyDeliver can be driven by [happyDomain](https://happydomain.org) through
-the [`checker-happydeliver`](https://git.nemunai.re/happyDomain/checker-happydeliver)
-plugin, so the deliverability of a domain you manage is monitored alongside
-its DNS and inbound SMTP posture.
-
-How it works:
-
-1. Attach the **Outbound deliverability** checker to the mail service of a zone
-   in happyDomain. Point it at a happyDeliver instance via `happydeliver_url`;
-   operators can configure a default instance globally.
-2. On each run, the checker calls `POST /api/test` to allocate a fresh
-   recipient address, prompts the user (or an automated sender) to mail it from
-   the tested domain, then polls `GET /api/test/{id}` until the report is
-   ready.
-3. The structured report from `GET /api/report/{id}` is translated into
-   happyDomain rule states: CRIT/WARN/INFO on SPF, DKIM, DMARC, alignment, spam
-   score, blacklists and headers, plus an overall score threshold
-   (`min_score`/`warn_score`).
-4. Runs repeat on a configurable interval so a regression in deliverability (a
-   new RBL listing, a DKIM key rotation gone wrong, a broken SPF include, ...)
-   surfaces as a domain-level alert in happyDomain.
-
-See the [`checker-happydeliver` repository](https://git.nemunai.re/happyDomain/checker-happydeliver)
-for build instructions and the full list of run options.
-
 ## Scoring System
 
-The deliverability score is calculated from A to F based on:
+The deliverability score is calculated from 0 to 10 based on:
 
-- **DNS**: Step-by-step analysis of PTR, Forward-Confirmed Reverse DNS, MX, SPF, DKIM, DMARC and BIMI records
-- **Authentication**: IPRev, SPF, DKIM, DMARC, BIMI and ARC validation
-- **Blacklist**: RBL/DNSBL checks
-- **Headers**: Required headers, MIME structure, Domain alignment
-- **Spam**: SpamAssassin and rspamd scores (combined 50/50)
-- **Content**: HTML quality, links, images, unsubscribe
+- **Authentication (3 pts)**: SPF, DKIM, DMARC validation
+- **Spam (2 pts)**: SpamAssassin score
+- **Blacklist (2 pts)**: RBL/DNSBL checks
+- **Content (2 pts)**: HTML quality, links, images, unsubscribe
+- **Headers (1 pt)**: Required headers, MIME structure
+
+**Ratings:**
+- 9-10: Excellent
+- 7-8.9: Good
+- 5-6.9: Fair
+- 3-4.9: Poor
+- 0-2.9: Critical
 
 ## Funding
 

api/config-models.yaml

@@ -1,9 +1,5 @@
-package: model
+package: api
 generate:
   models: true
-  embedded-spec: true
-output: internal/model/types.gen.go
-output-options:
-  skip-prune: true
-import-mapping:
-  ./schemas.yaml: "-"
+  embedded-spec: false
+output: internal/api/models.gen.go

api/config-server.yaml

@@ -1,8 +1,5 @@
 package: api
 generate:
   gin-server: true
-  models: true
   embedded-spec: true
 output: internal/api/server.gen.go
-import-mapping:
-  ./schemas.yaml: git.happydns.org/happyDeliver/internal/model

api/openapi.yaml

@@ -52,7 +52,7 @@ paths:
       tags:
         - tests
       summary: Get test status
-      description: Check if a report exists for the given test ID (base32-encoded). Returns pending if no report exists, analyzed if a report is available.
+      description: Check if a report exists for the given test ID. Returns pending if no report exists, analyzed if a report is available.
       operationId: getTest
       parameters:
         - name: id
@@ -60,8 +60,7 @@ paths:
           required: true
           schema:
             type: string
-            pattern: '^[a-z0-9-]+$'
-            description: Base32-encoded test ID (with hyphens)
+            format: uuid
       responses:
         '200':
           description: Test status retrieved successfully
@@ -76,49 +75,6 @@ paths:
               schema:
                 $ref: '#/components/schemas/Error'
 
-  /tests:
-    get:
-      tags:
-        - tests
-      summary: List all tests
-      description: Returns a paginated list of test summaries with scores and grades. Can be disabled via server configuration.
-      operationId: listTests
-      parameters:
-        - name: offset
-          in: query
-          schema:
-            type: integer
-            minimum: 0
-            default: 0
-          description: Number of items to skip
-        - name: limit
-          in: query
-          schema:
-            type: integer
-            minimum: 1
-            maximum: 100
-            default: 20
-          description: Maximum number of items to return
-      responses:
-        '200':
-          description: List of test summaries
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/TestListResponse'
-        '403':
-          description: Test listing is disabled
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-        '500':
-          description: Internal server error
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-
   /report/{id}:
     get:
       tags:
@@ -132,8 +88,7 @@ paths:
           required: true
           schema:
             type: string
-            pattern: '^[a-z0-9-]+$'
-            description: Base32-encoded test ID (with hyphens)
+            format: uuid
       responses:
         '200':
           description: Report retrieved successfully
@@ -161,8 +116,7 @@ paths:
           required: true
           schema:
             type: string
-            pattern: '^[a-z0-9-]+$'
-            description: Base32-encoded test ID (with hyphens)
+            format: uuid
       responses:
         '200':
           description: Raw email retrieved successfully
@@ -177,107 +131,6 @@ paths:
               schema:
                 $ref: '#/components/schemas/Error'
 
-  /report/{id}/reanalyze:
-    post:
-      tags:
-        - reports
-      summary: Reanalyze email and regenerate report
-      description: Re-run the analysis on the stored raw email to regenerate the report with the latest analyzer version. This is useful after analyzer improvements or bug fixes.
-      operationId: reanalyzeReport
-      parameters:
-        - name: id
-          in: path
-          required: true
-          schema:
-            type: string
-            pattern: '^[a-z0-9-]+$'
-            description: Base32-encoded test ID (with hyphens)
-      responses:
-        '200':
-          description: Report regenerated successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Report'
-        '404':
-          description: Email not found
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-        '500':
-          description: Internal server error during reanalysis
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-
-  /domain:
-    post:
-      tags:
-        - tests
-      summary: Test a domain's email configuration
-      description: Analyzes DNS records (MX, SPF, DMARC, BIMI) for a domain without requiring an actual email to be sent. Returns results immediately.
-      operationId: testDomain
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/DomainTestRequest'
-      responses:
-        '200':
-          description: Domain test completed successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/DomainTestResponse'
-        '400':
-          description: Invalid request
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-        '500':
-          description: Internal server error
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-
-  /blacklist:
-    post:
-      tags:
-        - tests
-      summary: Check an IP address against DNS blacklists
-      description: Tests a single IP address (IPv4 or IPv6) against configured DNS-based blacklists (RBLs) without requiring an actual email to be sent. Returns results immediately.
-      operationId: checkBlacklist
-      requestBody:
-        required: true
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/BlacklistCheckRequest'
-      responses:
-        '200':
-          description: Blacklist check completed successfully
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/BlacklistCheckResponse'
-        '400':
-          description: Invalid request
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-        '500':
-          description: Internal server error
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/Error'
-
   /status:
     get:
       tags:
@@ -296,74 +149,359 @@ paths:
 components:
   schemas:
     Test:
-      $ref: './schemas.yaml#/components/schemas/Test'
+      type: object
+      required:
+        - id
+        - email
+        - status
+        - created_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          description: Unique test identifier
+          example: "550e8400-e29b-41d4-a716-446655440000"
+        email:
+          type: string
+          format: email
+          description: Unique test email address
+          example: "test-550e8400@example.com"
+        status:
+          type: string
+          enum: [pending, analyzed]
+          description: Current test status (pending = no report yet, analyzed = report available)
+          example: "analyzed"
+        created_at:
+          type: string
+          format: date-time
+          description: Test creation timestamp
+        updated_at:
+          type: string
+          format: date-time
+          description: Last update timestamp
+
     TestResponse:
-      $ref: './schemas.yaml#/components/schemas/TestResponse'
+      type: object
+      required:
+        - id
+        - email
+        - status
+      properties:
+        id:
+          type: string
+          format: uuid
+          example: "550e8400-e29b-41d4-a716-446655440000"
+        email:
+          type: string
+          format: email
+          example: "test-550e8400@example.com"
+        status:
+          type: string
+          enum: [pending]
+          example: "pending"
+        message:
+          type: string
+          example: "Send your test email to the address above"
+
     Report:
-      $ref: './schemas.yaml#/components/schemas/Report'
+      type: object
+      required:
+        - id
+        - test_id
+        - score
+        - checks
+        - created_at
+      properties:
+        id:
+          type: string
+          format: uuid
+          description: Report identifier
+        test_id:
+          type: string
+          format: uuid
+          description: Associated test ID
+        score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 10
+          description: Overall deliverability score (0-10)
+          example: 8.5
+        summary:
+          $ref: '#/components/schemas/ScoreSummary'
+        checks:
+          type: array
+          items:
+            $ref: '#/components/schemas/Check'
+        authentication:
+          $ref: '#/components/schemas/AuthenticationResults'
+        spamassassin:
+          $ref: '#/components/schemas/SpamAssassinResult'
+        dns_records:
+          type: array
+          items:
+            $ref: '#/components/schemas/DNSRecord'
+        blacklists:
+          type: array
+          items:
+            $ref: '#/components/schemas/BlacklistCheck'
+        raw_headers:
+          type: string
+          description: Raw email headers
+        created_at:
+          type: string
+          format: date-time
+
     ScoreSummary:
-      $ref: './schemas.yaml#/components/schemas/ScoreSummary'
-    ContentAnalysis:
-      $ref: './schemas.yaml#/components/schemas/ContentAnalysis'
-    ContentIssue:
-      $ref: './schemas.yaml#/components/schemas/ContentIssue'
-    LinkCheck:
-      $ref: './schemas.yaml#/components/schemas/LinkCheck'
-    ImageCheck:
-      $ref: './schemas.yaml#/components/schemas/ImageCheck'
-    HeaderAnalysis:
-      $ref: './schemas.yaml#/components/schemas/HeaderAnalysis'
-    HeaderCheck:
-      $ref: './schemas.yaml#/components/schemas/HeaderCheck'
-    ReceivedHop:
-      $ref: './schemas.yaml#/components/schemas/ReceivedHop'
-    DKIMDomainInfo:
-      $ref: './schemas.yaml#/components/schemas/DKIMDomainInfo'
-    DomainAlignment:
-      $ref: './schemas.yaml#/components/schemas/DomainAlignment'
-    HeaderIssue:
-      $ref: './schemas.yaml#/components/schemas/HeaderIssue'
+      type: object
+      required:
+        - authentication_score
+        - spam_score
+        - blacklist_score
+        - content_score
+        - header_score
+      properties:
+        authentication_score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 3
+          description: SPF/DKIM/DMARC score (max 3 pts)
+          example: 2.8
+        spam_score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 2
+          description: SpamAssassin score (max 2 pts)
+          example: 1.5
+        blacklist_score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 2
+          description: Blacklist check score (max 2 pts)
+          example: 2.0
+        content_score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 2
+          description: Content quality score (max 2 pts)
+          example: 1.8
+        header_score:
+          type: number
+          format: float
+          minimum: 0
+          maximum: 1
+          description: Header quality score (max 1 pt)
+          example: 0.9
+
+    Check:
+      type: object
+      required:
+        - category
+        - name
+        - status
+        - score
+        - message
+      properties:
+        category:
+          type: string
+          enum: [authentication, dns, content, blacklist, headers, spam]
+          description: Check category
+          example: "authentication"
+        name:
+          type: string
+          description: Check name
+          example: "DKIM Signature"
+        status:
+          type: string
+          enum: [pass, fail, warn, info, error]
+          description: Check result status
+          example: "pass"
+        score:
+          type: number
+          format: float
+          description: Points contributed to total score
+          example: 1.0
+        message:
+          type: string
+          description: Human-readable result message
+          example: "DKIM signature is valid"
+        details:
+          type: string
+          description: Additional details (may be JSON)
+        severity:
+          type: string
+          enum: [critical, high, medium, low, info]
+          description: Issue severity
+          example: "info"
+        advice:
+          type: string
+          description: Remediation advice
+          example: "Your DKIM configuration is correct"
+
     AuthenticationResults:
-      $ref: './schemas.yaml#/components/schemas/AuthenticationResults'
+      type: object
+      properties:
+        spf:
+          $ref: '#/components/schemas/AuthResult'
+        dkim:
+          type: array
+          items:
+            $ref: '#/components/schemas/AuthResult'
+        dmarc:
+          $ref: '#/components/schemas/AuthResult'
+
     AuthResult:
-      $ref: './schemas.yaml#/components/schemas/AuthResult'
-    ARCResult:
-      $ref: './schemas.yaml#/components/schemas/ARCResult'
-    IPRevResult:
-      $ref: './schemas.yaml#/components/schemas/IPRevResult'
+      type: object
+      required:
+        - result
+      properties:
+        result:
+          type: string
+          enum: [pass, fail, none, neutral, softfail, temperror, permerror]
+          description: Authentication result
+          example: "pass"
+        domain:
+          type: string
+          description: Domain being authenticated
+          example: "example.com"
+        selector:
+          type: string
+          description: DKIM selector (for DKIM only)
+          example: "default"
+        details:
+          type: string
+          description: Additional details about the result
+
     SpamAssassinResult:
-      $ref: './schemas.yaml#/components/schemas/SpamAssassinResult'
-    SpamTestDetail:
-      $ref: './schemas.yaml#/components/schemas/SpamTestDetail'
-    RspamdResult:
-      $ref: './schemas.yaml#/components/schemas/RspamdResult'
-    DNSResults:
-      $ref: './schemas.yaml#/components/schemas/DNSResults'
-    MXRecord:
-      $ref: './schemas.yaml#/components/schemas/MXRecord'
-    SPFRecord:
-      $ref: './schemas.yaml#/components/schemas/SPFRecord'
-    DKIMRecord:
-      $ref: './schemas.yaml#/components/schemas/DKIMRecord'
-    DMARCRecord:
-      $ref: './schemas.yaml#/components/schemas/DMARCRecord'
-    BIMIRecord:
-      $ref: './schemas.yaml#/components/schemas/BIMIRecord'
+      type: object
+      required:
+        - score
+        - required_score
+        - is_spam
+      properties:
+        score:
+          type: number
+          format: float
+          description: SpamAssassin spam score
+          example: 2.3
+        required_score:
+          type: number
+          format: float
+          description: Threshold for spam classification
+          example: 5.0
+        is_spam:
+          type: boolean
+          description: Whether message is classified as spam
+          example: false
+        tests:
+          type: array
+          items:
+            type: string
+          description: List of triggered SpamAssassin tests
+          example: ["BAYES_00", "DKIM_SIGNED"]
+        report:
+          type: string
+          description: Full SpamAssassin report
+
+    DNSRecord:
+      type: object
+      required:
+        - domain
+        - record_type
+        - status
+      properties:
+        domain:
+          type: string
+          description: Domain name
+          example: "example.com"
+        record_type:
+          type: string
+          enum: [MX, SPF, DKIM, DMARC]
+          description: DNS record type
+          example: "SPF"
+        status:
+          type: string
+          enum: [found, missing, invalid]
+          description: Record status
+          example: "found"
+        value:
+          type: string
+          description: Record value
+          example: "v=spf1 include:_spf.example.com ~all"
+
     BlacklistCheck:
-      $ref: './schemas.yaml#/components/schemas/BlacklistCheck'
+      type: object
+      required:
+        - ip
+        - rbl
+        - listed
+      properties:
+        ip:
+          type: string
+          description: IP address checked
+          example: "192.0.2.1"
+        rbl:
+          type: string
+          description: RBL/DNSBL name
+          example: "zen.spamhaus.org"
+        listed:
+          type: boolean
+          description: Whether IP is listed
+          example: false
+        response:
+          type: string
+          description: RBL response code or message
+          example: "127.0.0.2"
+
     Status:
-      $ref: './schemas.yaml#/components/schemas/Status'
+      type: object
+      required:
+        - status
+        - version
+      properties:
+        status:
+          type: string
+          enum: [healthy, degraded, unhealthy]
+          description: Overall service status
+          example: "healthy"
+        version:
+          type: string
+          description: Service version
+          example: "0.1.0-dev"
+        components:
+          type: object
+          properties:
+            database:
+              type: string
+              enum: [up, down]
+              example: "up"
+            mta:
+              type: string
+              enum: [up, down]
+              example: "up"
+        uptime:
+          type: integer
+          description: Service uptime in seconds
+          example: 3600
+
     Error:
-      $ref: './schemas.yaml#/components/schemas/Error'
-    DomainTestRequest:
-      $ref: './schemas.yaml#/components/schemas/DomainTestRequest'
-    DomainTestResponse:
-      $ref: './schemas.yaml#/components/schemas/DomainTestResponse'
-    BlacklistCheckRequest:
-      $ref: './schemas.yaml#/components/schemas/BlacklistCheckRequest'
-    BlacklistCheckResponse:
-      $ref: './schemas.yaml#/components/schemas/BlacklistCheckResponse'
-    TestSummary:
-      $ref: './schemas.yaml#/components/schemas/TestSummary'
-    TestListResponse:
-      $ref: './schemas.yaml#/components/schemas/TestListResponse'
+      type: object
+      required:
+        - error
+        - message
+      properties:
+        error:
+          type: string
+          description: Error code
+          example: "not_found"
+        message:
+          type: string
+          description: Human-readable error message
+          example: "Test not found"
+        details:
+          type: string
+          description: Additional error details

cmd/happyDeliver/main.go

@@ -29,12 +29,13 @@ import (
 
 	"git.happydns.org/happyDeliver/internal/app"
 	"git.happydns.org/happyDeliver/internal/config"
-	"git.happydns.org/happyDeliver/internal/version"
 )
 
+const version = "0.1.0-dev"
+
 func main() {
-	fmt.Fprintln(os.Stderr, "happyDeliver - Email Deliverability Testing Platform")
-	fmt.Fprintf(os.Stderr, "Version: %s\n", version.Version)
+	fmt.Println("happyDeliver - Email Deliverability Testing Platform")
+	fmt.Printf("Version: %s\n", version)
 
 	cfg, err := config.ConsolidateConfig()
 	if err != nil {
@@ -52,20 +53,8 @@ func main() {
 		if err := app.RunAnalyzer(cfg, flag.Args()[1:], os.Stdin, os.Stdout); err != nil {
 			log.Fatalf("Analyzer error: %v", err)
 		}
-	case "backup":
-		if err := app.RunBackup(cfg); err != nil {
-			log.Fatalf("Backup error: %v", err)
-		}
-	case "restore":
-		inputFile := ""
-		if len(flag.Args()) >= 2 {
-			inputFile = flag.Args()[1]
-		}
-		if err := app.RunRestore(cfg, inputFile); err != nil {
-			log.Fatalf("Restore error: %v", err)
-		}
 	case "version":
-		fmt.Println(version.Version)
+		fmt.Println(version)
 	default:
 		fmt.Printf("Unknown command: %s\n", command)
 		printUsage()
@@ -75,11 +64,9 @@ func main() {
 
 func printUsage() {
 	fmt.Println("\nCommand availables:")
-	fmt.Println("  happyDeliver server            - Start the API server")
-	fmt.Println("  happyDeliver analyze [-json]   - Analyze email from stdin and output results to terminal")
-	fmt.Println("  happyDeliver backup            - Backup database to stdout as JSON")
-	fmt.Println("  happyDeliver restore [file]    - Restore database from JSON file or stdin")
-	fmt.Println("  happyDeliver version           - Print version information")
+	fmt.Println("  happyDeliver server          - Start the API server")
+	fmt.Println("  happyDeliver analyze [-json] - Analyze email from stdin and output results to terminal")
+	fmt.Println("  happyDeliver version         - Print version information")
 	fmt.Println("")
 	flag.Usage()
 }

docker-compose.yml

@@ -1,30 +1,16 @@
 services:
-  unbound:
-    image: alpinelinux/unbound
-    restart: unless-stopped
-
-    configs:
-      - source: unbound_conf
-        target: /etc/unbound/unbound.conf
-        uid: "100"
-        gid: "101"
-
-    networks:
-      default:
-        ipv4_address: 172.28.0.53
-
   happydeliver:
     build:
       context: .
       dockerfile: Dockerfile
-    image: happydomain/happydeliver:latest
+    image: happydeliver:latest
     container_name: happydeliver
-    # Set a hostname
     hostname: mail.happydeliver.local
 
     environment:
-      # Set your domain
-      HAPPYDELIVER_DOMAIN: happydeliver.local
+      # Set your domain and hostname
+      DOMAIN: happydeliver.local
+      HOSTNAME: mail.happydeliver.local
 
     ports:
       # SMTP port
@@ -37,42 +23,18 @@ services:
       - ./data:/var/lib/happydeliver
       # Log files
       - ./logs:/var/log/happydeliver
+      # Optional: Override config
+      # - ./custom-config.yaml:/etc/happydeliver/config.yaml
 
-    dns:
-      - 172.28.0.53
     restart: unless-stopped
 
-configs:
-  unbound_conf:
-    content: |
-      server:
-          verbosity: 1
-          interface: 0.0.0.0
-          port: 53
-          do-ip4: yes
-          do-ip6: no
-          do-udp: yes
-          do-tcp: yes
-
-          access-control: 127.0.0.0/8 allow
-          access-control: 172.28.0.0/24 allow
-
-          # Short cache for a testing resolver
-          cache-max-ttl: 60
-
-          # Buffers: let the system decide
-          so-sndbuf: 0
-          so-rcvbuf: 0
-
-          # Trust anchor (static, ships with the image)
-          trust-anchor-file: "/etc/unbound/root.key"
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:8080/api/status"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
 
 volumes:
   data:
   logs:
-
-networks:
-  default:
-    ipam:
-      config:
-        - subnet: 172.28.0.0/24

docker/README.md

@@ -109,37 +109,12 @@ Default configuration for the Docker environment:
 
 The container accepts these environment variables:
 
-- `HAPPYDELIVER_DOMAIN`: Email domain for test addresses (default: happydeliver.local)
-- `HAPPYDELIVER_RECEIVER_HOSTNAME`: Hostname used to filter `Authentication-Results` headers (see below)
-- `POSTFIX_CERT_FILE` / `POSTFIX_KEY_FILE`: TLS certificate and key paths for Postfix SMTP
-
-### Receiver Hostname
-
-happyDeliver filters `Authentication-Results` headers by hostname to only trust results from the expected MTA. By default, it uses the system hostname (i.e., the container's `--hostname`).
-
-In the all-in-one Docker container, the container hostname is also used as the `authserv-id` in the embedded Postfix and authentication_milter, so everything matches automatically.
-
-**When bypassing the embedded Postfix** (e.g., routing emails from your own MTA via LMTP), your MTA's `authserv-id` will likely differ from the container hostname. In that case, set `HAPPYDELIVER_RECEIVER_HOSTNAME` to your MTA's hostname:
+- `DOMAIN`: Email domain for test addresses (default: happydeliver.local)
+- `HOSTNAME`: Container hostname (default: mail.happydeliver.local)
 
+Example:
 ```bash
-docker run -d \
-  -e HAPPYDELIVER_DOMAIN=example.com \
-  -e HAPPYDELIVER_RECEIVER_HOSTNAME=mail.example.com \
-  ...
-```
-
-To find the correct value, look at the `Authentication-Results` headers in a received email — they start with the authserv-id, e.g. `Authentication-Results: mail.example.com; spf=pass ...`.
-
-If the value is misconfigured, happyDeliver will log a warning when the last `Received` hop doesn't match the expected hostname.
-
-Example (all-in-one, no override needed):
-```bash
-docker run -e HAPPYDELIVER_DOMAIN=example.com --hostname mail.example.com ...
-```
-
-Example (external MTA integration):
-```bash
-docker run -e HAPPYDELIVER_DOMAIN=example.com -e HAPPYDELIVER_RECEIVER_HOSTNAME=mail.example.com ...
+docker run -e DOMAIN=example.com -e HOSTNAME=mail.example.com ...
 ```
 
 ## Volumes

docker/authentication_milter/authentication_milter.json

@@ -1,75 +0,0 @@
-{
-    "logtoerr"    : "1",
-    "error_log"   : "",
-    "connection"  : "unix:/var/spool/postfix/authentication_milter/authentication_milter.sock",
-    "umask"       : "0007",
-    "runas"       : "mail",
-    "rungroup"    : "mail",
-    "authserv_id" : "__HOSTNAME__",
-
-    "connect_timeout" : 30,
-    "command_timeout" : 30,
-    "content_timeout" : 300,
-    "dns_timeout"     : 10,
-    "dns_retry"       : 2,
-
-    "handlers" : {
-
-        "Sanitize" : {
-            "hosts_to_remove" : [
-                "__HOSTNAME__"
-            ],
-            "extra_auth_results_types" : [
-                "X-Spam-Status",
-                "X-Spam-Report",
-                "X-Spam-Level",
-                "X-Spam-Checker-Version"
-            ]
-        },
-
-        "SPF" : {
-            "hide_none" : 0
-        },
-
-        "DKIM" : {
-            "hide_none" : 0,
-        },
-
-        "XGoogleDKIM" : {
-            "hide_none" : 1,
-        },
-
-        "ARC" : {
-            "hide_none" : 0,
-        },
-
-        "DMARC" : {
-            "hide_none" : 0,
-            "detect_list_id" : "1"
-        },
-
-        "BIMI" : {},
-
-        "PTR" : {},
-
-        "SenderID" : {
-            "hide_none" : 1
-        },
-
-        "IPRev" : {},
-
-        "Auth" : {},
-
-        "AlignedFrom" : {},
-
-        "LocalIP" : {},
-
-        "TrustedIP" : {
-            "trusted_ip_list" : []
-        },
-
-        "!AddID" : {},
-
-        "ReturnOK" : {}
-    }
-}

docker/authentication_milter/mail-dmarc.ini

@@ -1,58 +0,0 @@
-; This is YOU. DMARC reports include information about the reports. Enter it here.
-[organization]
-domain             = example.com
-org_name           = My Company Limited
-email              = admin@example.com
-extra_contact_info = http://example.com
-
-; aggregate DMARC reports need to be stored somewhere. Any database
-; with a DBI module (MySQL, SQLite, DBD, etc.) should work.
-; SQLite and MySQL are tested.
-; Default is sqlite.
-[report_store]
-backend = SQL
-;dsn     = dbi:SQLite:dbname=dmarc_reports.sqlite
-dsn    = dbi:mysql:database=dmarc_reporting_database;host=localhost;port=3306
-user    = authmilterusername
-pass    = authmiltpassword
-
-; backend can be perl or libopendmarc
-[dmarc]
-backend        = perl
-
-[dns]
-timeout            = 5
-public_suffix_list = share/public_suffix_list
-
-[smtp]
-; hostname is the external FQDN of this MTA
-hostname  = mx1.example.com
-cc        = dmarc.copy@example.com
-
-; list IP addresses to whitelist (bypass DMARC reject/quarantine)
-; see sample whitelist in share/dmarc_whitelist
-whitelist = /path/to/etc/dmarc_whitelist
-
-; By default, we attempt to email directly to the report recipient.
-; Set these to relay via a SMTP smart host.
-smarthost = mx2.example.com
-smartuser = dmarccopyusername
-smartpass = dmarccopypassword
-
-[imap]
-server    = mail.example.com
-user      =
-pass      =
-; the imap folder where new dmarc messages will be found
-folder    = dmarc
-; the folders to store processed reports (a=aggregate, f=forensic)
-f_done    = dmarc.forensic
-a_done    = dmarc.aggregate
-
-[http]
-port      = 8080
-
-[https]
-port      = 8443
-ssl_crt   =
-ssl_key   =

docker/entrypoint.sh

@@ -4,42 +4,34 @@ set -e
 echo "Starting happyDeliver container..."
 
 # Get environment variables with defaults
-[ -n "${HOSTNAME}" ] || HOSTNAME=$(hostname)
+HOSTNAME="${HOSTNAME:-mail.happydeliver.local}"
 HAPPYDELIVER_DOMAIN="${HAPPYDELIVER_DOMAIN:-happydeliver.local}"
 
 echo "Hostname: $HOSTNAME"
 echo "Domain: $HAPPYDELIVER_DOMAIN"
 
-# Create socket directories
-mkdir -p /var/spool/postfix/authentication_milter
-chown mail:mail /var/spool/postfix/authentication_milter
-chmod 750 /var/spool/postfix/authentication_milter
+# Create runtime directories
+mkdir -p /var/run/opendkim /var/run/opendmarc
+chown opendkim:postfix /var/run/opendkim
+chown opendmarc:postfix /var/run/opendmarc
 
-mkdir -p /var/spool/postfix/rspamd
-chown rspamd:mail /var/spool/postfix/rspamd
-chmod 750 /var/spool/postfix/rspamd
+# Create socket directories
+mkdir -p /var/spool/postfix/opendkim /var/spool/postfix/opendmarc
+chown opendkim:postfix /var/spool/postfix/opendkim
+chown opendmarc:postfix /var/spool/postfix/opendmarc
+chmod 750 /var/spool/postfix/opendkim /var/spool/postfix/opendmarc
 
 # Create log directory
-mkdir -p /var/log/happydeliver /var/cache/authentication_milter /var/spool/authentication_milter /var/lib/authentication_milter /run/authentication_milter
+mkdir -p /var/log/happydeliver
 chown happydeliver:happydeliver /var/log/happydeliver
-chown mail:mail /var/cache/authentication_milter /run/authentication_milter /var/spool/authentication_milter /var/lib/authentication_milter
 
 # Replace placeholders in Postfix configuration
 echo "Configuring Postfix..."
 sed -i "s/__HOSTNAME__/${HOSTNAME}/g" /etc/postfix/main.cf
 sed -i "s/__DOMAIN__/${HAPPYDELIVER_DOMAIN}/g" /etc/postfix/main.cf
 
-# Add certificates to postfix
-[ -n "${POSTFIX_CERT_FILE}" ] && [ -n "${POSTFIX_KEY_FILE}" ] && {
-    cat <<EOF >> /etc/postfix/main.cf
-smtpd_tls_cert_file = ${POSTFIX_CERT_FILE}
-smtpd_tls_key_file = ${POSTFIX_KEY_FILE}
-smtpd_tls_security_level = may
-EOF
-}
-
-# Replace placeholders in configurations
-sed -i "s/__HOSTNAME__/${HOSTNAME}/g" /etc/authentication_milter.json
+# Replace placeholders in OpenDMARC configuration
+sed -i "s/__HOSTNAME__/${HOSTNAME}/g" /etc/opendmarc/opendmarc.conf
 
 # Initialize Postfix aliases
 if [ -f /etc/postfix/aliases ]; then

docker/opendkim/opendkim.conf

@@ -0,0 +1,39 @@
+# OpenDKIM configuration for happyDeliver
+# Verifies DKIM signatures on incoming emails
+
+# Log to syslog
+Syslog yes
+SyslogSuccess yes
+LogWhy yes
+
+# Run as this user and group
+UserID opendkim:mail
+
+UMask 002
+
+# Socket for Postfix communication
+Socket unix:/var/spool/postfix/opendkim/opendkim.sock
+
+# Process ID file
+PidFile /var/run/opendkim/opendkim.pid
+
+# Operating mode - verify only (not signing)
+Mode v
+
+# Canonicalization methods
+Canonicalization relaxed/simple
+
+# DNS timeout
+DNSTimeout 5
+
+# Add header for verification results
+AlwaysAddARHeader yes
+
+# Accept unsigned mail
+On-NoSignature accept
+
+# Always add Authentication-Results header
+AlwaysAddARHeader yes
+
+# Maximum verification attempts
+MaximumSignaturesToVerify 3

docker/opendmarc/opendmarc.conf

@@ -0,0 +1,41 @@
+# OpenDMARC configuration for happyDeliver
+# Verifies DMARC policies on incoming emails
+
+# Socket for Postfix communication
+Socket unix:/var/spool/postfix/opendmarc/opendmarc.sock
+
+# Process ID file
+PidFile /var/run/opendmarc/opendmarc.pid
+
+# Run as this user and group
+UserID opendmarc:mail
+
+UMask 002
+
+# Syslog configuration
+Syslog true
+SyslogFacility mail
+
+# Ignore authentication results from other hosts
+IgnoreAuthenticatedClients true
+
+# Accept mail even if DMARC fails (we're analyzing, not filtering)
+RejectFailures false
+
+# Trust Authentication-Results headers from localhost only
+TrustedAuthservIDs __HOSTNAME__
+
+# Add DMARC results to Authentication-Results header
+#AddAuthenticationResults true
+
+# DNS timeout
+DNSTimeout 5
+
+# History file (for reporting)
+# HistoryFile /var/spool/opendmarc/opendmarc.dat
+
+# Ignore hosts file
+# IgnoreHosts /etc/opendmarc/ignore.hosts
+
+# Public suffix list
+# PublicSuffixList /usr/share/publicsuffix/public_suffix_list.dat

docker/postfix/main.cf

@@ -10,7 +10,7 @@ inet_interfaces = all
 inet_protocols = ipv4
 
 # Recipient settings
-mydestination = localhost.$mydomain, localhost
+mydestination = $myhostname, localhost.$mydomain, localhost
 mynetworks = 127.0.0.0/8 [::1]/128
 
 # Relay settings - accept mail for our test domain
@@ -28,13 +28,14 @@ transport_maps = pcre:/etc/postfix/transport_maps
 # OpenDKIM for DKIM verification
 milter_default_action = accept
 milter_protocol = 6
-smtpd_milters = unix:/var/spool/postfix/authentication_milter/authentication_milter.sock unix:/var/spool/postfix/spamassassin/spamass-milter.sock unix:/var/spool/postfix/rspamd/rspamd-milter.sock
+smtpd_milters = unix:/var/spool/postfix/opendkim/opendkim.sock, unix:/var/spool/postfix/opendmarc/opendmarc.sock
 non_smtpd_milters = $smtpd_milters
 
 # SPF policy checking
 smtpd_recipient_restrictions =
     permit_mynetworks,
-    reject_unauth_destination
+    reject_unauth_destination,
+    check_policy_service unix:private/policy-spf
 
 # Logging
 debug_peer_level = 2

docker/postfix/master.cf

@@ -2,6 +2,7 @@
 
 # SMTP service
 smtp      inet  n       -       n       -       -       smtpd
+  -o content_filter=spamassassin
 
 # Pickup service
 pickup    unix  n       -       n       60      1       pickup
@@ -73,6 +74,10 @@ scache    unix  -       -       n       -       1       scache
 maildrop  unix  -       n       n       -       -       pipe
   flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient}
 
+# SPF policy service
+policy-spf unix -       n       n       -       0       spawn
+  user=nobody argv=/usr/bin/postfix-policyd-spf-perl
+
 # SpamAssassin content filter
 spamassassin unix -     n       n       -       -       pipe
   user=mail argv=/usr/bin/spamc -f -e /usr/sbin/sendmail -oi -f ${sender} ${recipient}

docker/postfix/transport_maps

@@ -1,4 +1,4 @@
 # Transport map - route test emails to happyDeliver LMTP server
-# Pattern: test-<base32-uuid>@domain.com -> LMTP on localhost:2525
+# Pattern: test-<uuid>@domain.com -> LMTP on localhost:2525
 
-/^test-[a-zA-Z2-7-]{26,30}@.*$/  lmtp:inet:127.0.0.1:2525
+/^test-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}@.*$/  lmtp:inet:127.0.0.1:2525

docker/rspamd/local.d/actions.conf

@@ -1,5 +0,0 @@
-no_action = 0;
-reject = null;
-add_header = null;
-rewrite_subject = null;
-greylist = null;

docker/rspamd/local.d/milter_headers.conf

@@ -1,5 +0,0 @@
-# Add "extended Rspamd headers"
-extended_spam_headers = true;
-
-skip_local = false;
-skip_authenticated = false;

docker/rspamd/local.d/options.inc

@@ -1,3 +0,0 @@
-# rspamd options for happyDeliver
-# Disable Bayes learning to keep the setup stateless
-use_redis = false;

docker/rspamd/local.d/worker-proxy.inc

@@ -1,6 +0,0 @@
-# Enable rspamd milter proxy worker via Unix socket for Postfix integration
-bind_socket = "/var/spool/postfix/rspamd/rspamd-milter.sock mode=0660 owner=rspamd group=mail";
-upstream "local" {
-  default = yes;
-  self_scan = yes;
-}

docker/spamassassin/local.cf

@@ -48,14 +48,3 @@ rbl_timeout 5
 # Don't use user-specific rules
 user_scores_dsn_timeout 3
 user_scores_sql_override 0
-
-# Disable Validity network rules
-dns_query_restriction deny sa-trusted.bondedsender.org
-dns_query_restriction deny sa-accredit.habeas.com
-dns_query_restriction deny bl.score.senderscore.com
-score RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0
-score RCVD_IN_VALIDITY_RPBL_BLOCKED 0
-score RCVD_IN_VALIDITY_SAFE_BLOCKED 0
-score RCVD_IN_VALIDITY_CERTIFIED 0
-score RCVD_IN_VALIDITY_RPBL 0
-score RCVD_IN_VALIDITY_SAFE 0

docker/supervisor/supervisord.conf

@@ -22,26 +22,27 @@ autostart=true
 autorestart=true
 priority=9
 
-# Authentication Milter service
-[program:authentication_milter]
-command=/usr/local/bin/authentication_milter --pidfile /run/authentication_milter/authentication_milter.pid
+# OpenDKIM service
+[program:opendkim]
+command=/usr/sbin/opendkim -f -x /etc/opendkim/opendkim.conf
 autostart=true
 autorestart=true
 priority=10
-stdout_logfile=/var/log/happydeliver/authentication_milter.log
-stderr_logfile=/var/log/happydeliver/authentication_milter.log
-user=mail
+stdout_logfile=/var/log/happydeliver/opendkim.log
+stderr_logfile=/var/log/happydeliver/opendkim_error.log
+user=opendkim
 group=mail
 
-# rspamd spam filter
-[program:rspamd]
-command=/usr/bin/rspamd -f -u rspamd -g mail
+# OpenDMARC service
+[program:opendmarc]
+command=/usr/sbin/opendmarc -f -c /etc/opendmarc/opendmarc.conf
 autostart=true
 autorestart=true
 priority=11
-stdout_logfile=/var/log/happydeliver/rspamd.log
-stderr_logfile=/var/log/happydeliver/rspamd_error.log
-user=root
+stdout_logfile=/var/log/happydeliver/opendmarc.log
+stderr_logfile=/var/log/happydeliver/opendmarc_error.log
+user=opendmarc
+group=mail
 
 # SpamAssassin daemon
 [program:spamd]
@@ -53,18 +54,6 @@ stdout_logfile=/var/log/happydeliver/spamd.log
 stderr_logfile=/var/log/happydeliver/spamd_error.log
 user=root
 
-# SpamAssassin milter
-[program:spamass_milter]
-command=/usr/local/sbin/spamass-milter -p /var/spool/postfix/spamassassin/spamass-milter.sock -m
-autostart=true
-autorestart=true
-priority=7
-stdout_logfile=/var/log/happydeliver/spamass-milter.log
-stderr_logfile=/var/log/happydeliver/spamass-milter_error.log
-user=mail
-group=mail
-umask=007
-
 # Postfix service
 [program:postfix]
 command=/usr/sbin/postfix start-fg

generate.go

@@ -21,5 +21,5 @@
 
 package main
 
-//go:generate go tool oapi-codegen -config api/config-models.yaml api/schemas.yaml
+//go:generate go tool oapi-codegen -config api/config-models.yaml api/openapi.yaml
 //go:generate go tool oapi-codegen -config api/config-server.yaml api/openapi.yaml

go.mod

@@ -1,42 +1,37 @@
 module git.happydns.org/happyDeliver
 
-go 1.25.0
+go 1.24.6
 
 require (
-	github.com/JGLTechnologies/gin-rate-limit v1.5.8
 	github.com/emersion/go-smtp v0.24.0
-	github.com/getkin/kin-openapi v0.138.0
-	github.com/gin-gonic/gin v1.12.0
+	github.com/gin-gonic/gin v1.11.0
 	github.com/google/uuid v1.6.0
-	github.com/oapi-codegen/runtime v1.4.0
-	golang.org/x/net v0.54.0
+	github.com/oapi-codegen/runtime v1.1.2
+	golang.org/x/net v0.45.0
 	gorm.io/driver/postgres v1.6.0
 	gorm.io/driver/sqlite v1.6.0
-	gorm.io/gorm v1.31.1
+	gorm.io/gorm v1.31.0
 )
 
 require (
-	github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
-	github.com/bytedance/gopkg v0.1.3 // indirect
-	github.com/bytedance/sonic v1.15.0 // indirect
-	github.com/bytedance/sonic/loader v0.5.0 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/bytedance/sonic v1.14.0 // indirect
+	github.com/bytedance/sonic/loader v0.3.0 // indirect
 	github.com/cloudwego/base64x v0.1.6 // indirect
-	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 // indirect
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.12 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/getkin/kin-openapi v0.132.0 // indirect
 	github.com/gin-contrib/sse v1.1.0 // indirect
-	github.com/go-openapi/jsonpointer v0.22.4 // indirect
-	github.com/go-openapi/swag/jsonname v0.25.4 // indirect
+	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-playground/locales v0.14.1 // indirect
 	github.com/go-playground/universal-translator v0.18.1 // indirect
-	github.com/go-playground/validator/v10 v10.30.1 // indirect
-	github.com/goccy/go-json v0.10.5 // indirect
-	github.com/goccy/go-yaml v1.19.2 // indirect
+	github.com/go-playground/validator/v10 v10.27.0 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.8.0 // indirect
+	github.com/jackc/pgx/v5 v5.7.6 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
@@ -44,38 +39,34 @@ require (
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/mailru/easyjson v0.9.1 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-sqlite3 v1.14.33 // indirect
+	github.com/mattn/go-sqlite3 v1.14.32 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
-	github.com/oapi-codegen/oapi-codegen/v2 v2.7.0 // indirect
-	github.com/oasdiff/yaml v0.0.9 // indirect
-	github.com/oasdiff/yaml3 v0.0.12 // indirect
+	github.com/oapi-codegen/oapi-codegen/v2 v2.5.0 // indirect
+	github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 // indirect
+	github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/perimeterx/marshmallow v1.1.5 // indirect
-	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.0 // indirect
-	github.com/redis/go-redis/v9 v9.18.0 // indirect
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
-	github.com/speakeasy-api/jsonpath v0.6.3 // indirect
-	github.com/speakeasy-api/openapi v1.19.2 // indirect
+	github.com/quic-go/qpack v0.5.1 // indirect
+	github.com/quic-go/quic-go v0.54.1 // indirect
+	github.com/speakeasy-api/jsonpath v0.6.0 // indirect
+	github.com/speakeasy-api/openapi-overlay v0.10.2 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	github.com/ugorji/go/codec v1.3.1 // indirect
+	github.com/ugorji/go/codec v1.3.0 // indirect
 	github.com/vmware-labs/yaml-jsonpath v0.3.2 // indirect
-	github.com/woodsbury/decimal128 v1.4.0 // indirect
-	go.mongodb.org/mongo-driver/v2 v2.5.0 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/arch v0.23.0 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
-	golang.org/x/mod v0.35.0 // indirect
-	golang.org/x/sync v0.20.0 // indirect
-	golang.org/x/sys v0.44.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
-	golang.org/x/tools v0.44.0 // indirect
-	google.golang.org/protobuf v1.36.11 // indirect
+	go.uber.org/mock v0.5.0 // indirect
+	golang.org/x/arch v0.20.0 // indirect
+	golang.org/x/crypto v0.43.0 // indirect
+	golang.org/x/mod v0.28.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/sys v0.37.0 // indirect
+	golang.org/x/text v0.30.0 // indirect
+	golang.org/x/tools v0.37.0 // indirect
+	google.golang.org/protobuf v1.36.9 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 

go.sum

@@ -1,34 +1,15 @@
-github.com/JGLTechnologies/gin-rate-limit v1.5.8 h1:KiaHIEbpYxHpDvjhpjIif8fnVmjdw/afCMdGoN1AsB0=
-github.com/JGLTechnologies/gin-rate-limit v1.5.8/go.mod h1:t9eLOUxikPI0TzKy0VYRbZJr7hBP2Qg9E3JigoxF70g=
-github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
-github.com/apapsch/go-jsonmerge/v2 v2.0.0 h1:axGnT1gRIfimI7gJifB699GoE/oq+F2MU7Dml6nw9rQ=
-github.com/apapsch/go-jsonmerge/v2 v2.0.0/go.mod h1:lvDnEdqiQrp0O42VQGgmlKpxL1AP2+08jFMw88y4klk=
-github.com/bmatcuk/doublestar v1.1.1/go.mod h1:UD6OnuiIn0yFxxA2le/rnRU1G4RaI4UvFv1sNto9p6w=
-github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
-github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
-github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
-github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
-github.com/bytedance/gopkg v0.1.3 h1:TPBSwH8RsouGCBcMBktLt1AymVo2TVsBVCY4b6TnZ/M=
-github.com/bytedance/gopkg v0.1.3/go.mod h1:576VvJ+eJgyCzdjS+c4+77QF3p7ubbtiKARP3TxducM=
-github.com/bytedance/sonic v1.15.0 h1:/PXeWFaR5ElNcVE84U0dOHjiMHQOwNIx3K4ymzh/uSE=
-github.com/bytedance/sonic v1.15.0/go.mod h1:tFkWrPz0/CUCLEF4ri4UkHekCIcdnkqXw9VduqpJh0k=
-github.com/bytedance/sonic/loader v0.5.0 h1:gXH3KVnatgY7loH5/TkeVyXPfESoqSBSBEiDd5VjlgE=
-github.com/bytedance/sonic/loader v0.5.0/go.mod h1:AR4NYCk5DdzZizZ5djGqQ92eEhCCcdf5x77udYiSJRo=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/bytedance/sonic v1.14.0 h1:/OfKt8HFw0kh2rj8N0F6C/qPGRESq0BbaNZgcNXXzQQ=
+github.com/bytedance/sonic v1.14.0/go.mod h1:WoEbx8WTcFJfzCe0hbmyTGrfjt8PzNEBdxlNUO24NhA=
+github.com/bytedance/sonic/loader v0.3.0 h1:dskwH8edlzNMctoruo8FPTJDF3vLtDT0sXZwvZJyqeA=
+github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
 github.com/cloudwego/base64x v0.1.6 h1:t11wG9AECkCDk5fMSoxmufanudBtJ+/HemLstXDLI2M=
 github.com/cloudwego/base64x v0.1.6/go.mod h1:OFcloc187FXDaYHvrNIjxSe8ncn0OOM8gEHfghB2IPU=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
-github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
-github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI=
-github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
 github.com/dprotaso/go-yit v0.0.0-20191028211022-135eb7262960/go.mod h1:9HQzr9D/0PGwMEbC3d5AB7oi67+h4TsQqItC1GVYG58=
 github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936 h1:PRxIJD8XjimM5aTknUK9w6DHLDox2r2M3DI4i2pnd3w=
 github.com/dprotaso/go-yit v0.0.0-20220510233725-9ba8df137936/go.mod h1:ttYvX5qlB+mlV1okblJqcSMtR4c52UKxDiX9GRBS8+Q=
@@ -39,35 +20,33 @@ github.com/emersion/go-smtp v0.24.0/go.mod h1:ZtRRkbTyp2XTHCA+BmyTFTrj8xY4I+b4Mc
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
 github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
-github.com/gabriel-vasile/mimetype v1.4.12 h1:e9hWvmLYvtp846tLHam2o++qitpguFiYCKbn0w9jyqw=
-github.com/gabriel-vasile/mimetype v1.4.12/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/getkin/kin-openapi v0.138.0 h1:ebfE0JAmF6AqHrNBy1KO3Fs68K9tPs48HalvLPo7Rv4=
-github.com/getkin/kin-openapi v0.138.0/go.mod h1:vUYWaKyMqj7PfTybelXtLuLN9tReS12vxnzMRK+z2GY=
+github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
+github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/getkin/kin-openapi v0.132.0 h1:3ISeLMsQzcb5v26yeJrBcdTCEQTag36ZjaGk7MIRUwk=
+github.com/getkin/kin-openapi v0.132.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
 github.com/gin-contrib/sse v1.1.0 h1:n0w2GMuUpWDVp7qSpvze6fAu9iRxJY4Hmj6AmBOU05w=
 github.com/gin-contrib/sse v1.1.0/go.mod h1:hxRZ5gVpWMT7Z0B0gSNYqqsSCNIJMjzvm6fqCz9vjwM=
-github.com/gin-gonic/gin v1.12.0 h1:b3YAbrZtnf8N//yjKeU2+MQsh2mY5htkZidOM7O0wG8=
-github.com/gin-gonic/gin v1.12.0/go.mod h1:VxccKfsSllpKshkBWgVgRniFFAzFb9csfngsqANjnLc=
-github.com/go-openapi/jsonpointer v0.22.4 h1:dZtK82WlNpVLDW2jlA1YCiVJFVqkED1MegOUy9kR5T4=
-github.com/go-openapi/jsonpointer v0.22.4/go.mod h1:elX9+UgznpFhgBuaMQ7iu4lvvX1nvNsesQ3oxmYTw80=
-github.com/go-openapi/swag/jsonname v0.25.4 h1:bZH0+MsS03MbnwBXYhuTttMOqk+5KcQ9869Vye1bNHI=
-github.com/go-openapi/swag/jsonname v0.25.4/go.mod h1:GPVEk9CWVhNvWhZgrnvRA6utbAltopbKwDu8mXNUMag=
-github.com/go-openapi/testify/v2 v2.0.2 h1:X999g3jeLcoY8qctY/c/Z8iBHTbwLz7R2WXd6Ub6wls=
-github.com/go-openapi/testify/v2 v2.0.2/go.mod h1:HCPmvFFnheKK2BuwSA0TbbdxJ3I16pjwMkYkP4Ywn54=
+github.com/gin-gonic/gin v1.11.0 h1:OW/6PLjyusp2PPXtyxKHU0RbX6I/l28FTdDlae5ueWk=
+github.com/gin-gonic/gin v1.11.0/go.mod h1:+iq/FyxlGzII0KHiBGjuNn4UNENUlKbGlNmc+W50Dls=
+github.com/go-openapi/jsonpointer v0.21.0 h1:YgdVicSA9vH5RiHs9TZW5oyafXZFc6+2Vc1rr/O9oNQ=
+github.com/go-openapi/jsonpointer v0.21.0/go.mod h1:IUyH9l/+uyhIYQ/PXVA41Rexl+kOkAPDdXEYns6fzUY=
+github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
+github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
 github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
 github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
 github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.30.1 h1:f3zDSN/zOma+w6+1Wswgd9fLkdwy06ntQJp0BBvFG0w=
-github.com/go-playground/validator/v10 v10.30.1/go.mod h1:oSuBIQzuJxL//3MelwSLD5hc2Tu889bF0Idm9Dg26cM=
+github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
+github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
 github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/goccy/go-json v0.10.5 h1:Fq85nIqj+gXn/S5ahsiTlK3TmC85qgirsdTP/+DeaC4=
-github.com/goccy/go-json v0.10.5/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/goccy/go-yaml v1.19.2 h1:PmFC1S6h8ljIz6gMRBopkjP1TVT7xuwrButHID66PoM=
-github.com/goccy/go-yaml v1.19.2/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
@@ -93,8 +72,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.8.0 h1:TYPDoleBBme0xGSAX3/+NujXXtpZn9HBONkQC7IEZSo=
-github.com/jackc/pgx/v5 v5.8.0/go.mod h1:QVeDInX2m9VyzvNeiCJVjCkNFqzsNb43204HshNSZKw=
+github.com/jackc/pgx/v5 v5.7.6 h1:rWQc5FwZSPX58r1OQmkuaNicxdmExaEz5A2DO2hUuTk=
+github.com/jackc/pgx/v5 v5.7.6/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
@@ -105,7 +84,6 @@ github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8Hm
 github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/juju/gnuflag v0.0.0-20171113085948-2ce1bb71843d/go.mod h1:2PavIy+JPciBPrBUjwbNvtwB6RQlve+hkpll6QSNmOE=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
@@ -117,12 +95,12 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
-github.com/mailru/easyjson v0.9.1 h1:LbtsOm5WAswyWbvTEOqhypdPeZzHavpZx96/n553mR8=
-github.com/mailru/easyjson v0.9.1/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-sqlite3 v1.14.33 h1:A5blZ5ulQo2AtayQ9/limgHEkFreKj1Dv226a1K73s0=
-github.com/mattn/go-sqlite3 v1.14.33/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/mattn/go-sqlite3 v1.14.32 h1:JD12Ag3oLy1zQA+BNn74xRgaBbdhbNIDYvQUEuuErjs=
+github.com/mattn/go-sqlite3 v1.14.32/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -133,14 +111,14 @@ github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwd
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
 github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
 github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
-github.com/oapi-codegen/oapi-codegen/v2 v2.7.0 h1:/8daqIYZfwnsHEAZdHUu9m0D5LA+5DoJCP7zLlT5Cs0=
-github.com/oapi-codegen/oapi-codegen/v2 v2.7.0/go.mod h1:qzFy6iuobJw/hD1aRILee4G87/ShmhR0xYCwcUtZMCw=
-github.com/oapi-codegen/runtime v1.4.0 h1:KLOSFOp7UzkbS7Cs1ms6NBEKYr0WmH2wZG0KKbd2er4=
-github.com/oapi-codegen/runtime v1.4.0/go.mod h1:5sw5fxCDmnOzKNYmkVNF8d34kyUeejJEY8HNT2WaPec=
-github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48=
-github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM=
-github.com/oasdiff/yaml3 v0.0.12 h1:75urAtPeDg2/iDEWwzNrLOWxI9N/dCh81nTTJtokt2M=
-github.com/oasdiff/yaml3 v0.0.12/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/oapi-codegen/oapi-codegen/v2 v2.5.0 h1:iJvF8SdB/3/+eGOXEpsWkD8FQAHj6mqkb6Fnsoc8MFU=
+github.com/oapi-codegen/oapi-codegen/v2 v2.5.0/go.mod h1:fwlMxUEMuQK5ih9aymrxKPQqNm2n8bdLk1ppjH+lr9w=
+github.com/oapi-codegen/runtime v1.1.2 h1:P2+CubHq8fO4Q6fV1tqDBZHCwpVpvPg7oKiYzQgXIyI=
+github.com/oapi-codegen/runtime v1.1.2/go.mod h1:SK9X900oXmPWilYR5/WKPzt3Kqxn/uS/+lbpREv+eCg=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037 h1:G7ERwszslrBzRxj//JalHPu/3yz+De2J+4aLtSRlHiY=
+github.com/oasdiff/yaml v0.0.0-20250309154309-f31be36b4037/go.mod h1:2bpvgLBZEtENV5scfDFEtB/5+1M4hkQhDQrccEJ/qGw=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90 h1:bQx3WeLcUWy+RletIKwUIt4x3t8n2SxavmoclizMb8c=
+github.com/oasdiff/yaml3 v0.0.0-20250309153720-d2182401db90/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.10.2/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
@@ -157,69 +135,51 @@ github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0
 github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/perimeterx/marshmallow v1.1.5 h1:a2LALqQ1BlHM8PZblsDdidgv1mWi1DgC2UmX50IvK2s=
 github.com/perimeterx/marshmallow v1.1.5/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
-github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.0 h1:OLJkp1Mlm/aS7dpKgTc6cnpynnD2Xg7C1pwL6vy/SAw=
-github.com/quic-go/quic-go v0.59.0/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
-github.com/redis/go-redis/v9 v9.18.0 h1:pMkxYPkEbMPwRdenAzUNyFNrDgHx9U+DrBabWNfSRQs=
-github.com/redis/go-redis/v9 v9.18.0/go.mod h1:k3ufPphLU5YXwNTUcCRXGxUoF1fqxnhFQmscfkCoDA0=
-github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
-github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ=
-github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU=
+github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
+github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
+github.com/quic-go/quic-go v0.54.1 h1:4ZAWm0AhCb6+hE+l5Q1NAL0iRn/ZrMwqHRGQiFwj2eg=
+github.com/quic-go/quic-go v0.54.1/go.mod h1:e68ZEaCdyviluZmy44P6Iey98v/Wfz6HCjQEm+l8zTY=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
 github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
 github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/speakeasy-api/jsonpath v0.6.3 h1:c+QPwzAOdrWvzycuc9HFsIZcxKIaWcNpC+xhOW9rJxU=
-github.com/speakeasy-api/jsonpath v0.6.3/go.mod h1:2cXloNuQ+RSXi5HTRaeBh7JEmjRXTiaKpFTdZiL7URI=
-github.com/speakeasy-api/openapi v1.19.2 h1:md90tE71/M8jS3cuRlsuWP5Aed4xoG5PSRvXeZgCv/M=
-github.com/speakeasy-api/openapi v1.19.2/go.mod h1:UfKa7FqE4jgexJZuj51MmdHAFGmDv0Zaw3+yOd81YKU=
-github.com/spkg/bom v0.0.0-20160624110644-59b7046e48ad/go.mod h1:qLr4V1qq6nMqFKkMo8ZTx3f+BZEkzsRUY10Xsm2mwU0=
+github.com/speakeasy-api/jsonpath v0.6.0 h1:IhtFOV9EbXplhyRqsVhHoBmmYjblIRh5D1/g8DHMXJ8=
+github.com/speakeasy-api/jsonpath v0.6.0/go.mod h1:ymb2iSkyOycmzKwbEAYPJV/yi2rSmvBCLZJcyD+VVWw=
+github.com/speakeasy-api/openapi-overlay v0.10.2 h1:VOdQ03eGKeiHnpb1boZCGm7x8Haj6gST0P3SGTX95GU=
+github.com/speakeasy-api/openapi-overlay v0.10.2/go.mod h1:n0iOU7AqKpNFfEt6tq7qYITC4f0yzVVdFw0S7hukemg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
 github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
-github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
-github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
+github.com/ugorji/go/codec v1.3.0 h1:Qd2W2sQawAfG8XSvzwhBeoGq71zXOC/Q1E9y/wUcsUA=
+github.com/ugorji/go/codec v1.3.0/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
 github.com/vmware-labs/yaml-jsonpath v0.3.2 h1:/5QKeCBGdsInyDCyVNLbXyilb61MXGi9NP674f9Hobk=
 github.com/vmware-labs/yaml-jsonpath v0.3.2/go.mod h1:U6whw1z03QyqgWdgXxvVnQ90zN1BWz5V+51Ewf8k+rQ=
-github.com/woodsbury/decimal128 v1.4.0 h1:xJATj7lLu4f2oObouMt2tgGiElE5gO6mSWUjQsBgUlc=
-github.com/woodsbury/decimal128 v1.4.0/go.mod h1:BP46FUrVjVhdTbKT+XuQh2xfQaGki9LMIRJSFuh6THU=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
-github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
-go.mongodb.org/mongo-driver/v2 v2.5.0 h1:yXUhImUjjAInNcpTcAlPHiT7bIXhshCTL3jVBkF3xaE=
-go.mongodb.org/mongo-driver/v2 v2.5.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
-go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/arch v0.23.0 h1:lKF64A2jF6Zd8L0knGltUnegD62JMFBiCPBmQpToHhg=
-golang.org/x/arch v0.23.0/go.mod h1:dNHoOeKiyja7GTvF9NJS1l3Z2yntpQNzgrjh1cU103A=
+go.uber.org/mock v0.5.0 h1:KAMbZvZPyBPWgD14IrIQ38QCyjwpvVVV6K/bHl1IwQU=
+go.uber.org/mock v0.5.0/go.mod h1:ge71pBPLYDk7QIi1LupWxdAykm7KIEFchiOqd6z7qMM=
+golang.org/x/arch v0.20.0 h1:dx1zTU0MAE98U+TQ8BLl7XsJbgze2WnNKF/8tGp/Q6c=
+golang.org/x/arch v0.20.0/go.mod h1:bdwinDaKcfZUGpH09BB7ZmOfhalA8lQdzl62l8gGWsk=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.51.0 h1:IBPXwPfKxY7cWQZ38ZCIRPI50YLeevDLlLnyC5wRGTI=
-golang.org/x/crypto v0.51.0/go.mod h1:8AdwkbraGNABw2kOX6YFPs3WM22XqI4EXEd8g+x7Oc8=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
-golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
+golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
+golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -227,13 +187,13 @@ golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
 golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -249,21 +209,21 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
-golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
-golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
+golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
+golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@@ -276,8 +236,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
-google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@@ -299,5 +259,5 @@ gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
 gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
 gorm.io/driver/sqlite v1.6.0 h1:WHRRrIiulaPiPFmDcod6prc4l2VGVWHz80KspNsxSfQ=
 gorm.io/driver/sqlite v1.6.0/go.mod h1:AO9V1qIQddBESngQUKWL9yoH93HIeA1X6V633rBwyT8=
-gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
-gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
+gorm.io/gorm v1.31.0 h1:0VlycGreVhK7RF/Bwt51Fk8v0xLiiiFdbGDPIZQ7mJY=
+gorm.io/gorm v1.31.0/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=

internal/analyzer/analyzer.go

@@ -0,0 +1,87 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"bytes"
+	"fmt"
+
+	"github.com/google/uuid"
+
+	"git.happydns.org/happyDeliver/internal/api"
+	"git.happydns.org/happyDeliver/internal/config"
+)
+
+// EmailAnalyzer provides high-level email analysis functionality
+// This is the main entry point for analyzing emails from both LMTP and CLI
+type EmailAnalyzer struct {
+	generator *ReportGenerator
+}
+
+// NewEmailAnalyzer creates a new email analyzer with the given configuration
+func NewEmailAnalyzer(cfg *config.Config) *EmailAnalyzer {
+	generator := NewReportGenerator(
+		cfg.Analysis.DNSTimeout,
+		cfg.Analysis.HTTPTimeout,
+		cfg.Analysis.RBLs,
+	)
+
+	return &EmailAnalyzer{
+		generator: generator,
+	}
+}
+
+// AnalysisResult contains the complete analysis result
+type AnalysisResult struct {
+	Email   *EmailMessage
+	Results *AnalysisResults
+	Report  *api.Report
+}
+
+// AnalyzeEmailBytes performs complete email analysis from raw bytes
+func (a *EmailAnalyzer) AnalyzeEmailBytes(rawEmail []byte, testID uuid.UUID) (*AnalysisResult, error) {
+	// Parse the email
+	emailMsg, err := ParseEmail(bytes.NewReader(rawEmail))
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse email: %w", err)
+	}
+
+	// Analyze the email
+	results := a.generator.AnalyzeEmail(emailMsg)
+
+	// Generate the report
+	report := a.generator.GenerateReport(testID, results)
+
+	return &AnalysisResult{
+		Email:   emailMsg,
+		Results: results,
+		Report:  report,
+	}, nil
+}
+
+// GetScoreSummaryText returns a human-readable score summary
+func (a *EmailAnalyzer) GetScoreSummaryText(result *AnalysisResult) string {
+	if result == nil || result.Results == nil {
+		return ""
+	}
+	return a.generator.GetScoreSummaryText(result.Results)
+}

internal/analyzer/authentication.go

@@ -0,0 +1,511 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	"git.happydns.org/happyDeliver/internal/api"
+)
+
+// AuthenticationAnalyzer analyzes email authentication results
+type AuthenticationAnalyzer struct{}
+
+// NewAuthenticationAnalyzer creates a new authentication analyzer
+func NewAuthenticationAnalyzer() *AuthenticationAnalyzer {
+	return &AuthenticationAnalyzer{}
+}
+
+// AnalyzeAuthentication extracts and analyzes authentication results from email headers
+func (a *AuthenticationAnalyzer) AnalyzeAuthentication(email *EmailMessage) *api.AuthenticationResults {
+	results := &api.AuthenticationResults{}
+
+	// Parse Authentication-Results headers
+	authHeaders := email.GetAuthenticationResults()
+	for _, header := range authHeaders {
+		a.parseAuthenticationResultsHeader(header, results)
+	}
+
+	// If no Authentication-Results headers, try to parse legacy headers
+	if results.Spf == nil {
+		results.Spf = a.parseLegacySPF(email)
+	}
+
+	if results.Dkim == nil || len(*results.Dkim) == 0 {
+		dkimResults := a.parseLegacyDKIM(email)
+		if len(dkimResults) > 0 {
+			results.Dkim = &dkimResults
+		}
+	}
+
+	return results
+}
+
+// parseAuthenticationResultsHeader parses an Authentication-Results header
+// Format: example.com; spf=pass smtp.mailfrom=sender@example.com; dkim=pass header.d=example.com
+func (a *AuthenticationAnalyzer) parseAuthenticationResultsHeader(header string, results *api.AuthenticationResults) {
+	// Split by semicolon to get individual results
+	parts := strings.Split(header, ";")
+	if len(parts) < 2 {
+		return
+	}
+
+	// Skip the authserv-id (first part)
+	for i := 1; i < len(parts); i++ {
+		part := strings.TrimSpace(parts[i])
+		if part == "" {
+			continue
+		}
+
+		// Parse SPF
+		if strings.HasPrefix(part, "spf=") {
+			if results.Spf == nil {
+				results.Spf = a.parseSPFResult(part)
+			}
+		}
+
+		// Parse DKIM
+		if strings.HasPrefix(part, "dkim=") {
+			dkimResult := a.parseDKIMResult(part)
+			if dkimResult != nil {
+				if results.Dkim == nil {
+					dkimList := []api.AuthResult{*dkimResult}
+					results.Dkim = &dkimList
+				} else {
+					*results.Dkim = append(*results.Dkim, *dkimResult)
+				}
+			}
+		}
+
+		// Parse DMARC
+		if strings.HasPrefix(part, "dmarc=") {
+			if results.Dmarc == nil {
+				results.Dmarc = a.parseDMARCResult(part)
+			}
+		}
+	}
+}
+
+// parseSPFResult parses SPF result from Authentication-Results
+// Example: spf=pass smtp.mailfrom=sender@example.com
+func (a *AuthenticationAnalyzer) parseSPFResult(part string) *api.AuthResult {
+	result := &api.AuthResult{}
+
+	// Extract result (pass, fail, etc.)
+	re := regexp.MustCompile(`spf=(\w+)`)
+	if matches := re.FindStringSubmatch(part); len(matches) > 1 {
+		resultStr := strings.ToLower(matches[1])
+		result.Result = api.AuthResultResult(resultStr)
+	}
+
+	// Extract domain
+	domainRe := regexp.MustCompile(`smtp\.mailfrom=([^\s;]+)`)
+	if matches := domainRe.FindStringSubmatch(part); len(matches) > 1 {
+		email := matches[1]
+		// Extract domain from email
+		if idx := strings.Index(email, "@"); idx != -1 {
+			domain := email[idx+1:]
+			result.Domain = &domain
+		}
+	}
+
+	// Extract details
+	if idx := strings.Index(part, "("); idx != -1 {
+		endIdx := strings.Index(part[idx:], ")")
+		if endIdx != -1 {
+			details := strings.TrimSpace(part[idx+1 : idx+endIdx])
+			result.Details = &details
+		}
+	}
+
+	return result
+}
+
+// parseDKIMResult parses DKIM result from Authentication-Results
+// Example: dkim=pass header.d=example.com header.s=selector1
+func (a *AuthenticationAnalyzer) parseDKIMResult(part string) *api.AuthResult {
+	result := &api.AuthResult{}
+
+	// Extract result (pass, fail, etc.)
+	re := regexp.MustCompile(`dkim=(\w+)`)
+	if matches := re.FindStringSubmatch(part); len(matches) > 1 {
+		resultStr := strings.ToLower(matches[1])
+		result.Result = api.AuthResultResult(resultStr)
+	}
+
+	// Extract domain (header.d or d)
+	domainRe := regexp.MustCompile(`(?:header\.)?d=([^\s;]+)`)
+	if matches := domainRe.FindStringSubmatch(part); len(matches) > 1 {
+		domain := matches[1]
+		result.Domain = &domain
+	}
+
+	// Extract selector (header.s or s)
+	selectorRe := regexp.MustCompile(`(?:header\.)?s=([^\s;]+)`)
+	if matches := selectorRe.FindStringSubmatch(part); len(matches) > 1 {
+		selector := matches[1]
+		result.Selector = &selector
+	}
+
+	// Extract details
+	if idx := strings.Index(part, "("); idx != -1 {
+		endIdx := strings.Index(part[idx:], ")")
+		if endIdx != -1 {
+			details := strings.TrimSpace(part[idx+1 : idx+endIdx])
+			result.Details = &details
+		}
+	}
+
+	return result
+}
+
+// parseDMARCResult parses DMARC result from Authentication-Results
+// Example: dmarc=pass action=none header.from=example.com
+func (a *AuthenticationAnalyzer) parseDMARCResult(part string) *api.AuthResult {
+	result := &api.AuthResult{}
+
+	// Extract result (pass, fail, etc.)
+	re := regexp.MustCompile(`dmarc=(\w+)`)
+	if matches := re.FindStringSubmatch(part); len(matches) > 1 {
+		resultStr := strings.ToLower(matches[1])
+		result.Result = api.AuthResultResult(resultStr)
+	}
+
+	// Extract domain (header.from)
+	domainRe := regexp.MustCompile(`header\.from=([^\s;]+)`)
+	if matches := domainRe.FindStringSubmatch(part); len(matches) > 1 {
+		domain := matches[1]
+		result.Domain = &domain
+	}
+
+	// Extract details (action, policy, etc.)
+	var detailsParts []string
+	actionRe := regexp.MustCompile(`action=([^\s;]+)`)
+	if matches := actionRe.FindStringSubmatch(part); len(matches) > 1 {
+		detailsParts = append(detailsParts, fmt.Sprintf("action=%s", matches[1]))
+	}
+
+	if len(detailsParts) > 0 {
+		details := strings.Join(detailsParts, " ")
+		result.Details = &details
+	}
+
+	return result
+}
+
+// parseLegacySPF attempts to parse SPF from Received-SPF header
+func (a *AuthenticationAnalyzer) parseLegacySPF(email *EmailMessage) *api.AuthResult {
+	receivedSPF := email.Header.Get("Received-SPF")
+	if receivedSPF == "" {
+		return nil
+	}
+
+	result := &api.AuthResult{}
+
+	// Extract result (first word)
+	parts := strings.Fields(receivedSPF)
+	if len(parts) > 0 {
+		resultStr := strings.ToLower(parts[0])
+		result.Result = api.AuthResultResult(resultStr)
+	}
+
+	// Try to extract domain
+	domainRe := regexp.MustCompile(`(?:envelope-from|sender)=([^\s;]+)`)
+	if matches := domainRe.FindStringSubmatch(receivedSPF); len(matches) > 1 {
+		email := matches[1]
+		if idx := strings.Index(email, "@"); idx != -1 {
+			domain := email[idx+1:]
+			result.Domain = &domain
+		}
+	}
+
+	return result
+}
+
+// parseLegacyDKIM attempts to parse DKIM from DKIM-Signature header
+func (a *AuthenticationAnalyzer) parseLegacyDKIM(email *EmailMessage) []api.AuthResult {
+	var results []api.AuthResult
+
+	// Get all DKIM-Signature headers
+	dkimHeaders := email.Header[textprotoCanonical("DKIM-Signature")]
+	for _, dkimHeader := range dkimHeaders {
+		result := api.AuthResult{
+			Result: api.AuthResultResultNone, // We can't determine pass/fail from signature alone
+		}
+
+		// Extract domain (d=)
+		domainRe := regexp.MustCompile(`d=([^\s;]+)`)
+		if matches := domainRe.FindStringSubmatch(dkimHeader); len(matches) > 1 {
+			domain := matches[1]
+			result.Domain = &domain
+		}
+
+		// Extract selector (s=)
+		selectorRe := regexp.MustCompile(`s=([^\s;]+)`)
+		if matches := selectorRe.FindStringSubmatch(dkimHeader); len(matches) > 1 {
+			selector := matches[1]
+			result.Selector = &selector
+		}
+
+		details := "DKIM signature present (verification status unknown)"
+		result.Details = &details
+
+		results = append(results, result)
+	}
+
+	return results
+}
+
+// textprotoCanonical converts a header name to canonical form
+func textprotoCanonical(s string) string {
+	// Simple implementation - capitalize each word
+	words := strings.Split(s, "-")
+	for i, word := range words {
+		if len(word) > 0 {
+			words[i] = strings.ToUpper(word[:1]) + strings.ToLower(word[1:])
+		}
+	}
+	return strings.Join(words, "-")
+}
+
+// GetAuthenticationScore calculates the authentication score (0-3 points)
+func (a *AuthenticationAnalyzer) GetAuthenticationScore(results *api.AuthenticationResults) float32 {
+	var score float32 = 0.0
+
+	// SPF: 1 point for pass, 0.5 for neutral/softfail, 0 for fail
+	if results.Spf != nil {
+		switch results.Spf.Result {
+		case api.AuthResultResultPass:
+			score += 1.0
+		case api.AuthResultResultNeutral, api.AuthResultResultSoftfail:
+			score += 0.5
+		}
+	}
+
+	// DKIM: 1 point for at least one pass
+	if results.Dkim != nil && len(*results.Dkim) > 0 {
+		for _, dkim := range *results.Dkim {
+			if dkim.Result == api.AuthResultResultPass {
+				score += 1.0
+				break
+			}
+		}
+	}
+
+	// DMARC: 1 point for pass
+	if results.Dmarc != nil {
+		switch results.Dmarc.Result {
+		case api.AuthResultResultPass:
+			score += 1.0
+		}
+	}
+
+	// Cap at 3 points maximum
+	if score > 3.0 {
+		score = 3.0
+	}
+
+	return score
+}
+
+// GenerateAuthenticationChecks generates check results for authentication
+func (a *AuthenticationAnalyzer) GenerateAuthenticationChecks(results *api.AuthenticationResults) []api.Check {
+	var checks []api.Check
+
+	// SPF check
+	if results.Spf != nil {
+		check := a.generateSPFCheck(results.Spf)
+		checks = append(checks, check)
+	} else {
+		checks = append(checks, api.Check{
+			Category: api.Authentication,
+			Name:     "SPF Record",
+			Status:   api.CheckStatusWarn,
+			Score:    0.0,
+			Message:  "No SPF authentication result found",
+			Severity: api.PtrTo(api.Medium),
+			Advice:   api.PtrTo("Ensure your MTA is configured to check SPF records"),
+		})
+	}
+
+	// DKIM check
+	if results.Dkim != nil && len(*results.Dkim) > 0 {
+		for i, dkim := range *results.Dkim {
+			check := a.generateDKIMCheck(&dkim, i)
+			checks = append(checks, check)
+		}
+	} else {
+		checks = append(checks, api.Check{
+			Category: api.Authentication,
+			Name:     "DKIM Signature",
+			Status:   api.CheckStatusWarn,
+			Score:    0.0,
+			Message:  "No DKIM signature found",
+			Severity: api.PtrTo(api.Medium),
+			Advice:   api.PtrTo("Configure DKIM signing for your domain to improve deliverability"),
+		})
+	}
+
+	// DMARC check
+	if results.Dmarc != nil {
+		check := a.generateDMARCCheck(results.Dmarc)
+		checks = append(checks, check)
+	} else {
+		checks = append(checks, api.Check{
+			Category: api.Authentication,
+			Name:     "DMARC Policy",
+			Status:   api.CheckStatusWarn,
+			Score:    0.0,
+			Message:  "No DMARC authentication result found",
+			Severity: api.PtrTo(api.Medium),
+			Advice:   api.PtrTo("Implement DMARC policy for your domain"),
+		})
+	}
+
+	return checks
+}
+
+func (a *AuthenticationAnalyzer) generateSPFCheck(spf *api.AuthResult) api.Check {
+	check := api.Check{
+		Category: api.Authentication,
+		Name:     "SPF Record",
+	}
+
+	switch spf.Result {
+	case api.AuthResultResultPass:
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = "SPF validation passed"
+		check.Severity = api.PtrTo(api.Info)
+		check.Advice = api.PtrTo("Your SPF record is properly configured")
+	case api.AuthResultResultFail:
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Message = "SPF validation failed"
+		check.Severity = api.PtrTo(api.Critical)
+		check.Advice = api.PtrTo("Fix your SPF record to authorize this sending server")
+	case api.AuthResultResultSoftfail:
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.5
+		check.Message = "SPF validation softfail"
+		check.Severity = api.PtrTo(api.Medium)
+		check.Advice = api.PtrTo("Review your SPF record configuration")
+	case api.AuthResultResultNeutral:
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.5
+		check.Message = "SPF validation neutral"
+		check.Severity = api.PtrTo(api.Low)
+		check.Advice = api.PtrTo("Consider tightening your SPF policy")
+	default:
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.0
+		check.Message = fmt.Sprintf("SPF validation result: %s", spf.Result)
+		check.Severity = api.PtrTo(api.Medium)
+		check.Advice = api.PtrTo("Review your SPF record configuration")
+	}
+
+	if spf.Domain != nil {
+		details := fmt.Sprintf("Domain: %s", *spf.Domain)
+		check.Details = &details
+	}
+
+	return check
+}
+
+func (a *AuthenticationAnalyzer) generateDKIMCheck(dkim *api.AuthResult, index int) api.Check {
+	check := api.Check{
+		Category: api.Authentication,
+		Name:     fmt.Sprintf("DKIM Signature #%d", index+1),
+	}
+
+	switch dkim.Result {
+	case api.AuthResultResultPass:
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = "DKIM signature is valid"
+		check.Severity = api.PtrTo(api.Info)
+		check.Advice = api.PtrTo("Your DKIM signature is properly configured")
+	case api.AuthResultResultFail:
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Message = "DKIM signature validation failed"
+		check.Severity = api.PtrTo(api.High)
+		check.Advice = api.PtrTo("Check your DKIM keys and signing configuration")
+	default:
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.0
+		check.Message = fmt.Sprintf("DKIM validation result: %s", dkim.Result)
+		check.Severity = api.PtrTo(api.Medium)
+		check.Advice = api.PtrTo("Ensure DKIM signing is enabled and configured correctly")
+	}
+
+	var detailsParts []string
+	if dkim.Domain != nil {
+		detailsParts = append(detailsParts, fmt.Sprintf("Domain: %s", *dkim.Domain))
+	}
+	if dkim.Selector != nil {
+		detailsParts = append(detailsParts, fmt.Sprintf("Selector: %s", *dkim.Selector))
+	}
+	if len(detailsParts) > 0 {
+		details := strings.Join(detailsParts, ", ")
+		check.Details = &details
+	}
+
+	return check
+}
+
+func (a *AuthenticationAnalyzer) generateDMARCCheck(dmarc *api.AuthResult) api.Check {
+	check := api.Check{
+		Category: api.Authentication,
+		Name:     "DMARC Policy",
+	}
+
+	switch dmarc.Result {
+	case api.AuthResultResultPass:
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = "DMARC validation passed"
+		check.Severity = api.PtrTo(api.Info)
+		check.Advice = api.PtrTo("Your DMARC policy is properly aligned")
+	case api.AuthResultResultFail:
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Message = "DMARC validation failed"
+		check.Severity = api.PtrTo(api.High)
+		check.Advice = api.PtrTo("Ensure SPF or DKIM alignment with your From domain")
+	default:
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.0
+		check.Message = fmt.Sprintf("DMARC validation result: %s", dmarc.Result)
+		check.Severity = api.PtrTo(api.Medium)
+		check.Advice = api.PtrTo("Configure DMARC policy for your domain")
+	}
+
+	if dmarc.Domain != nil {
+		details := fmt.Sprintf("Domain: %s", *dmarc.Domain)
+		check.Details = &details
+	}
+
+	return check
+}

internal/analyzer/content.go

@@ -0,0 +1,830 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+	"unicode"
+
+	"git.happydns.org/happyDeliver/internal/api"
+	"golang.org/x/net/html"
+)
+
+// ContentAnalyzer analyzes email content (HTML, links, images)
+type ContentAnalyzer struct {
+	Timeout    time.Duration
+	httpClient *http.Client
+}
+
+// NewContentAnalyzer creates a new content analyzer with configurable timeout
+func NewContentAnalyzer(timeout time.Duration) *ContentAnalyzer {
+	if timeout == 0 {
+		timeout = 10 * time.Second // Default timeout
+	}
+	return &ContentAnalyzer{
+		Timeout: timeout,
+		httpClient: &http.Client{
+			Timeout: timeout,
+			CheckRedirect: func(req *http.Request, via []*http.Request) error {
+				// Allow up to 10 redirects
+				if len(via) >= 10 {
+					return fmt.Errorf("too many redirects")
+				}
+				return nil
+			},
+		},
+	}
+}
+
+// ContentResults represents content analysis results
+type ContentResults struct {
+	HTMLValid        bool
+	HTMLErrors       []string
+	Links            []LinkCheck
+	Images           []ImageCheck
+	HasUnsubscribe   bool
+	UnsubscribeLinks []string
+	TextContent      string
+	HTMLContent      string
+	TextPlainRatio   float32 // Ratio of plain text to HTML consistency
+	ImageTextRatio   float32 // Ratio of images to text
+	SuspiciousURLs   []string
+	ContentIssues    []string
+}
+
+// LinkCheck represents a link validation result
+type LinkCheck struct {
+	URL     string
+	Valid   bool
+	Status  int
+	Error   string
+	IsSafe  bool
+	Warning string
+}
+
+// ImageCheck represents an image validation result
+type ImageCheck struct {
+	Src      string
+	HasAlt   bool
+	AltText  string
+	Valid    bool
+	Error    string
+	IsBroken bool
+}
+
+// AnalyzeContent performs content analysis on email message
+func (c *ContentAnalyzer) AnalyzeContent(email *EmailMessage) *ContentResults {
+	results := &ContentResults{}
+
+	// Get HTML and text parts
+	htmlParts := email.GetHTMLParts()
+	textParts := email.GetTextParts()
+
+	// Analyze HTML parts
+	if len(htmlParts) > 0 {
+		for _, part := range htmlParts {
+			c.analyzeHTML(part.Content, results)
+		}
+	}
+
+	// Analyze text parts
+	if len(textParts) > 0 {
+		for _, part := range textParts {
+			results.TextContent += part.Content
+		}
+	}
+
+	// Check plain text/HTML consistency
+	if len(htmlParts) > 0 && len(textParts) > 0 {
+		results.TextPlainRatio = c.calculateTextPlainConsistency(results.TextContent, results.HTMLContent)
+	}
+
+	return results
+}
+
+// analyzeHTML parses and analyzes HTML content
+func (c *ContentAnalyzer) analyzeHTML(htmlContent string, results *ContentResults) {
+	results.HTMLContent = htmlContent
+
+	// Parse HTML
+	doc, err := html.Parse(strings.NewReader(htmlContent))
+	if err != nil {
+		results.HTMLValid = false
+		results.HTMLErrors = append(results.HTMLErrors, fmt.Sprintf("Failed to parse HTML: %v", err))
+		return
+	}
+
+	results.HTMLValid = true
+
+	// Traverse HTML tree
+	c.traverseHTML(doc, results)
+
+	// Calculate image-to-text ratio
+	if results.HTMLContent != "" {
+		textLength := len(c.extractTextFromHTML(htmlContent))
+		imageCount := len(results.Images)
+		if textLength > 0 {
+			results.ImageTextRatio = float32(imageCount) / float32(textLength) * 1000 // Images per 1000 chars
+		}
+	}
+}
+
+// traverseHTML recursively traverses HTML nodes
+func (c *ContentAnalyzer) traverseHTML(n *html.Node, results *ContentResults) {
+	if n.Type == html.ElementNode {
+		switch n.Data {
+		case "a":
+			// Extract and validate links
+			href := c.getAttr(n, "href")
+			if href != "" {
+				// Check for unsubscribe links
+				if c.isUnsubscribeLink(href, n) {
+					results.HasUnsubscribe = true
+					results.UnsubscribeLinks = append(results.UnsubscribeLinks, href)
+				}
+
+				// Validate link
+				linkCheck := c.validateLink(href)
+				results.Links = append(results.Links, linkCheck)
+
+				// Check for suspicious URLs
+				if !linkCheck.IsSafe {
+					results.SuspiciousURLs = append(results.SuspiciousURLs, href)
+				}
+			}
+
+		case "img":
+			// Extract and validate images
+			src := c.getAttr(n, "src")
+			alt := c.getAttr(n, "alt")
+
+			imageCheck := ImageCheck{
+				Src:     src,
+				HasAlt:  alt != "",
+				AltText: alt,
+				Valid:   src != "",
+			}
+
+			if src == "" {
+				imageCheck.Error = "Image missing src attribute"
+			}
+
+			results.Images = append(results.Images, imageCheck)
+		}
+	}
+
+	// Traverse children
+	for child := n.FirstChild; child != nil; child = child.NextSibling {
+		c.traverseHTML(child, results)
+	}
+}
+
+// getAttr gets an attribute value from an HTML node
+func (c *ContentAnalyzer) getAttr(n *html.Node, key string) string {
+	for _, attr := range n.Attr {
+		if attr.Key == key {
+			return attr.Val
+		}
+	}
+	return ""
+}
+
+// isUnsubscribeLink checks if a link is an unsubscribe link
+func (c *ContentAnalyzer) isUnsubscribeLink(href string, node *html.Node) bool {
+	// Check href for unsubscribe keywords
+	lowerHref := strings.ToLower(href)
+	unsubKeywords := []string{"unsubscribe", "opt-out", "optout", "remove", "list-unsubscribe"}
+	for _, keyword := range unsubKeywords {
+		if strings.Contains(lowerHref, keyword) {
+			return true
+		}
+	}
+
+	// Check link text for unsubscribe keywords
+	text := c.getNodeText(node)
+	lowerText := strings.ToLower(text)
+	for _, keyword := range unsubKeywords {
+		if strings.Contains(lowerText, keyword) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// getNodeText extracts text content from a node
+func (c *ContentAnalyzer) getNodeText(n *html.Node) string {
+	if n.Type == html.TextNode {
+		return n.Data
+	}
+	var text string
+	for child := n.FirstChild; child != nil; child = child.NextSibling {
+		text += c.getNodeText(child)
+	}
+	return text
+}
+
+// validateLink validates a URL and checks if it's accessible
+func (c *ContentAnalyzer) validateLink(urlStr string) LinkCheck {
+	check := LinkCheck{
+		URL:    urlStr,
+		IsSafe: true,
+	}
+
+	// Parse URL
+	parsedURL, err := url.Parse(urlStr)
+	if err != nil {
+		check.Valid = false
+		check.Error = fmt.Sprintf("Invalid URL: %v", err)
+		return check
+	}
+
+	// Check URL safety
+	if c.isSuspiciousURL(urlStr, parsedURL) {
+		check.IsSafe = false
+		check.Warning = "URL appears suspicious (obfuscated, shortened, or unusual)"
+	}
+
+	// Only check HTTP/HTTPS links
+	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
+		check.Valid = true
+		return check
+	}
+
+	// Check if link is accessible (with timeout)
+	ctx, cancel := context.WithTimeout(context.Background(), c.Timeout)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, "HEAD", urlStr, nil)
+	if err != nil {
+		check.Valid = false
+		check.Error = fmt.Sprintf("Failed to create request: %v", err)
+		return check
+	}
+
+	// Set a reasonable user agent
+	req.Header.Set("User-Agent", "HappyDeliver/1.0 (Email Deliverability Tester)")
+
+	resp, err := c.httpClient.Do(req)
+	if err != nil {
+		// Don't fail on timeout/connection errors for external links
+		// Just mark as warning
+		check.Valid = true
+		check.Status = 0
+		check.Warning = fmt.Sprintf("Could not verify link: %v", err)
+		return check
+	}
+	defer resp.Body.Close()
+
+	check.Status = resp.StatusCode
+	check.Valid = true
+
+	// Check for error status codes
+	if resp.StatusCode >= 400 {
+		check.Error = fmt.Sprintf("Link returns %d status", resp.StatusCode)
+	}
+
+	return check
+}
+
+// isSuspiciousURL checks if a URL looks suspicious
+func (c *ContentAnalyzer) isSuspiciousURL(urlStr string, parsedURL *url.URL) bool {
+	// Check for IP address instead of domain
+	if c.isIPAddress(parsedURL.Host) {
+		return true
+	}
+
+	// Check for URL shorteners (common ones)
+	shorteners := []string{
+		"bit.ly", "tinyurl.com", "goo.gl", "ow.ly", "t.co",
+		"buff.ly", "is.gd", "bl.ink", "short.io",
+	}
+	for _, shortener := range shorteners {
+		if strings.Contains(strings.ToLower(parsedURL.Host), shortener) {
+			return true
+		}
+	}
+
+	// Check for excessive subdomains (possible obfuscation)
+	parts := strings.Split(parsedURL.Host, ".")
+	if len(parts) > 4 {
+		return true
+	}
+
+	// Check for URL obfuscation techniques
+	if strings.Count(urlStr, "@") > 0 { // @ in URL (possible phishing)
+		return true
+	}
+
+	// Check for suspicious characters in domain
+	if strings.ContainsAny(parsedURL.Host, "[]()<>") {
+		return true
+	}
+
+	return false
+}
+
+// isIPAddress checks if a string is an IP address
+func (c *ContentAnalyzer) isIPAddress(host string) bool {
+	// Remove port if present
+	if idx := strings.LastIndex(host, ":"); idx != -1 {
+		host = host[:idx]
+	}
+
+	// Simple check for IPv4
+	parts := strings.Split(host, ".")
+	if len(parts) == 4 {
+		for _, part := range parts {
+			// Check if all characters are digits
+			for _, ch := range part {
+				if !unicode.IsDigit(ch) {
+					return false
+				}
+			}
+		}
+		return true
+	}
+
+	// Check for IPv6 (contains colons)
+	if strings.Contains(host, ":") {
+		return true
+	}
+
+	return false
+}
+
+// extractTextFromHTML extracts plain text from HTML
+func (c *ContentAnalyzer) extractTextFromHTML(htmlContent string) string {
+	doc, err := html.Parse(strings.NewReader(htmlContent))
+	if err != nil {
+		return ""
+	}
+
+	var text strings.Builder
+	var extract func(*html.Node)
+	extract = func(n *html.Node) {
+		if n.Type == html.TextNode {
+			text.WriteString(n.Data)
+		}
+		// Skip script and style tags
+		if n.Type == html.ElementNode && (n.Data == "script" || n.Data == "style") {
+			return
+		}
+		for child := n.FirstChild; child != nil; child = child.NextSibling {
+			extract(child)
+		}
+	}
+	extract(doc)
+
+	return text.String()
+}
+
+// calculateTextPlainConsistency compares plain text and HTML versions
+func (c *ContentAnalyzer) calculateTextPlainConsistency(plainText, htmlText string) float32 {
+	// Extract text from HTML
+	htmlPlainText := c.extractTextFromHTML(htmlText)
+
+	// Normalize both texts
+	plainNorm := c.normalizeText(plainText)
+	htmlNorm := c.normalizeText(htmlPlainText)
+
+	// Calculate similarity using simple word overlap
+	plainWords := strings.Fields(plainNorm)
+	htmlWords := strings.Fields(htmlNorm)
+
+	if len(plainWords) == 0 || len(htmlWords) == 0 {
+		return 0.0
+	}
+
+	// Count common words
+	commonWords := 0
+	plainWordSet := make(map[string]bool)
+	for _, word := range plainWords {
+		plainWordSet[word] = true
+	}
+
+	for _, word := range htmlWords {
+		if plainWordSet[word] {
+			commonWords++
+		}
+	}
+
+	// Calculate ratio (Jaccard similarity approximation)
+	maxWords := len(plainWords)
+	if len(htmlWords) > maxWords {
+		maxWords = len(htmlWords)
+	}
+
+	if maxWords == 0 {
+		return 0.0
+	}
+
+	return float32(commonWords) / float32(maxWords)
+}
+
+// normalizeText normalizes text for comparison
+func (c *ContentAnalyzer) normalizeText(text string) string {
+	// Convert to lowercase
+	text = strings.ToLower(text)
+
+	// Remove extra whitespace
+	text = strings.TrimSpace(text)
+	text = regexp.MustCompile(`\s+`).ReplaceAllString(text, " ")
+
+	return text
+}
+
+// GenerateContentChecks generates check results for content analysis
+func (c *ContentAnalyzer) GenerateContentChecks(results *ContentResults) []api.Check {
+	var checks []api.Check
+
+	if results == nil {
+		return checks
+	}
+
+	// HTML validity check
+	checks = append(checks, c.generateHTMLValidityCheck(results))
+
+	// Link checks
+	checks = append(checks, c.generateLinkChecks(results)...)
+
+	// Image checks
+	checks = append(checks, c.generateImageChecks(results)...)
+
+	// Unsubscribe link check
+	checks = append(checks, c.generateUnsubscribeCheck(results))
+
+	// Text/HTML consistency check
+	if results.TextContent != "" && results.HTMLContent != "" {
+		checks = append(checks, c.generateTextConsistencyCheck(results))
+	}
+
+	// Image-to-text ratio check
+	if len(results.Images) > 0 && results.HTMLContent != "" {
+		checks = append(checks, c.generateImageRatioCheck(results))
+	}
+
+	// Suspicious URLs check
+	if len(results.SuspiciousURLs) > 0 {
+		checks = append(checks, c.generateSuspiciousURLCheck(results))
+	}
+
+	return checks
+}
+
+// generateHTMLValidityCheck creates a check for HTML validity
+func (c *ContentAnalyzer) generateHTMLValidityCheck(results *ContentResults) api.Check {
+	check := api.Check{
+		Category: api.Content,
+		Name:     "HTML Structure",
+	}
+
+	if !results.HTMLValid {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Medium)
+		check.Message = "HTML structure is invalid"
+		if len(results.HTMLErrors) > 0 {
+			details := strings.Join(results.HTMLErrors, "; ")
+			check.Details = &details
+		}
+		check.Advice = api.PtrTo("Fix HTML structure errors to improve email rendering")
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.2
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = "HTML structure is valid"
+		check.Advice = api.PtrTo("Your HTML is well-formed")
+	}
+
+	return check
+}
+
+// generateLinkChecks creates checks for links
+func (c *ContentAnalyzer) generateLinkChecks(results *ContentResults) []api.Check {
+	var checks []api.Check
+
+	if len(results.Links) == 0 {
+		return checks
+	}
+
+	// Count broken links
+	brokenLinks := 0
+	warningLinks := 0
+	for _, link := range results.Links {
+		if link.Status >= 400 {
+			brokenLinks++
+		} else if link.Warning != "" {
+			warningLinks++
+		}
+	}
+
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Links",
+	}
+
+	if brokenLinks > 0 {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.High)
+		check.Message = fmt.Sprintf("Found %d broken link(s)", brokenLinks)
+		check.Advice = api.PtrTo("Fix or remove broken links to improve deliverability")
+		details := fmt.Sprintf("Total links: %d, Broken: %d", len(results.Links), brokenLinks)
+		check.Details = &details
+	} else if warningLinks > 0 {
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.3
+		check.Severity = api.PtrTo(api.Low)
+		check.Message = fmt.Sprintf("Found %d link(s) that could not be verified", warningLinks)
+		check.Advice = api.PtrTo("Review links that could not be verified")
+		details := fmt.Sprintf("Total links: %d, Unverified: %d", len(results.Links), warningLinks)
+		check.Details = &details
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.4
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = fmt.Sprintf("All %d link(s) are valid", len(results.Links))
+		check.Advice = api.PtrTo("Your links are working properly")
+	}
+
+	checks = append(checks, check)
+	return checks
+}
+
+// generateImageChecks creates checks for images
+func (c *ContentAnalyzer) generateImageChecks(results *ContentResults) []api.Check {
+	var checks []api.Check
+
+	if len(results.Images) == 0 {
+		return checks
+	}
+
+	// Count images without alt text
+	noAltCount := 0
+	for _, img := range results.Images {
+		if !img.HasAlt {
+			noAltCount++
+		}
+	}
+
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Image Alt Attributes",
+	}
+
+	if noAltCount == len(results.Images) {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Medium)
+		check.Message = "No images have alt attributes"
+		check.Advice = api.PtrTo("Add alt text to all images for accessibility and deliverability")
+		details := fmt.Sprintf("Images without alt: %d/%d", noAltCount, len(results.Images))
+		check.Details = &details
+	} else if noAltCount > 0 {
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.2
+		check.Severity = api.PtrTo(api.Low)
+		check.Message = fmt.Sprintf("%d image(s) missing alt attributes", noAltCount)
+		check.Advice = api.PtrTo("Add alt text to all images for better accessibility")
+		details := fmt.Sprintf("Images without alt: %d/%d", noAltCount, len(results.Images))
+		check.Details = &details
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.3
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = "All images have alt attributes"
+		check.Advice = api.PtrTo("Your images are properly tagged for accessibility")
+	}
+
+	checks = append(checks, check)
+	return checks
+}
+
+// generateUnsubscribeCheck creates a check for unsubscribe links
+func (c *ContentAnalyzer) generateUnsubscribeCheck(results *ContentResults) api.Check {
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Unsubscribe Link",
+	}
+
+	if !results.HasUnsubscribe {
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Low)
+		check.Message = "No unsubscribe link found"
+		check.Advice = api.PtrTo("Add an unsubscribe link for marketing emails (RFC 8058)")
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.3
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = fmt.Sprintf("Found %d unsubscribe link(s)", len(results.UnsubscribeLinks))
+		check.Advice = api.PtrTo("Your email includes an unsubscribe option")
+	}
+
+	return check
+}
+
+// generateTextConsistencyCheck creates a check for text/HTML consistency
+func (c *ContentAnalyzer) generateTextConsistencyCheck(results *ContentResults) api.Check {
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Plain Text Consistency",
+	}
+
+	consistency := results.TextPlainRatio
+
+	if consistency < 0.3 {
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Low)
+		check.Message = "Plain text and HTML versions differ significantly"
+		check.Advice = api.PtrTo("Ensure plain text and HTML versions convey the same content")
+		details := fmt.Sprintf("Consistency: %.0f%%", consistency*100)
+		check.Details = &details
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.3
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = "Plain text and HTML versions are consistent"
+		check.Advice = api.PtrTo("Your multipart email is well-structured")
+		details := fmt.Sprintf("Consistency: %.0f%%", consistency*100)
+		check.Details = &details
+	}
+
+	return check
+}
+
+// generateImageRatioCheck creates a check for image-to-text ratio
+func (c *ContentAnalyzer) generateImageRatioCheck(results *ContentResults) api.Check {
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Image-to-Text Ratio",
+	}
+
+	ratio := results.ImageTextRatio
+
+	// Flag if more than 1 image per 100 characters (very image-heavy)
+	if ratio > 10.0 {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Medium)
+		check.Message = "Email is excessively image-heavy"
+		check.Advice = api.PtrTo("Reduce the number of images relative to text content")
+		details := fmt.Sprintf("Images: %d, Ratio: %.2f images per 1000 chars", len(results.Images), ratio)
+		check.Details = &details
+	} else if ratio > 5.0 {
+		check.Status = api.CheckStatusWarn
+		check.Score = 0.2
+		check.Severity = api.PtrTo(api.Low)
+		check.Message = "Email has high image-to-text ratio"
+		check.Advice = api.PtrTo("Consider adding more text content relative to images")
+		details := fmt.Sprintf("Images: %d, Ratio: %.2f images per 1000 chars", len(results.Images), ratio)
+		check.Details = &details
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 0.3
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = "Image-to-text ratio is reasonable"
+		check.Advice = api.PtrTo("Your content has a good balance of images and text")
+		details := fmt.Sprintf("Images: %d, Ratio: %.2f images per 1000 chars", len(results.Images), ratio)
+		check.Details = &details
+	}
+
+	return check
+}
+
+// generateSuspiciousURLCheck creates a check for suspicious URLs
+func (c *ContentAnalyzer) generateSuspiciousURLCheck(results *ContentResults) api.Check {
+	check := api.Check{
+		Category: api.Content,
+		Name:     "Suspicious URLs",
+	}
+
+	count := len(results.SuspiciousURLs)
+
+	check.Status = api.CheckStatusWarn
+	check.Score = 0.0
+	check.Severity = api.PtrTo(api.Medium)
+	check.Message = fmt.Sprintf("Found %d suspicious URL(s)", count)
+	check.Advice = api.PtrTo("Avoid URL shorteners, IP addresses, and obfuscated URLs in emails")
+
+	if count <= 3 {
+		details := strings.Join(results.SuspiciousURLs, ", ")
+		check.Details = &details
+	} else {
+		details := fmt.Sprintf("%s, and %d more", strings.Join(results.SuspiciousURLs[:3], ", "), count-3)
+		check.Details = &details
+	}
+
+	return check
+}
+
+// GetContentScore calculates the content score (0-2 points)
+func (c *ContentAnalyzer) GetContentScore(results *ContentResults) float32 {
+	if results == nil {
+		return 0.0
+	}
+
+	var score float32 = 0.0
+
+	// HTML validity (0.2 points)
+	if results.HTMLValid {
+		score += 0.2
+	}
+
+	// Links (0.4 points)
+	if len(results.Links) > 0 {
+		brokenLinks := 0
+		for _, link := range results.Links {
+			if link.Status >= 400 {
+				brokenLinks++
+			}
+		}
+		if brokenLinks == 0 {
+			score += 0.4
+		}
+	} else {
+		// No links is neutral, give partial score
+		score += 0.2
+	}
+
+	// Images (0.3 points)
+	if len(results.Images) > 0 {
+		noAltCount := 0
+		for _, img := range results.Images {
+			if !img.HasAlt {
+				noAltCount++
+			}
+		}
+		if noAltCount == 0 {
+			score += 0.3
+		} else if noAltCount < len(results.Images) {
+			score += 0.15
+		}
+	} else {
+		// No images is neutral
+		score += 0.15
+	}
+
+	// Unsubscribe link (0.3 points)
+	if results.HasUnsubscribe {
+		score += 0.3
+	}
+
+	// Text consistency (0.3 points)
+	if results.TextPlainRatio >= 0.3 {
+		score += 0.3
+	}
+
+	// Image ratio (0.3 points)
+	if results.ImageTextRatio <= 5.0 {
+		score += 0.3
+	} else if results.ImageTextRatio <= 10.0 {
+		score += 0.15
+	}
+
+	// Penalize suspicious URLs (deduct up to 0.5 points)
+	if len(results.SuspiciousURLs) > 0 {
+		penalty := float32(len(results.SuspiciousURLs)) * 0.1
+		if penalty > 0.5 {
+			penalty = 0.5
+		}
+		score -= penalty
+	}
+
+	// Ensure score is between 0 and 2
+	if score < 0 {
+		score = 0
+	}
+	if score > 2.0 {
+		score = 2.0
+	}
+
+	return score
+}

internal/analyzer/content_test.go

@@ -28,6 +28,7 @@ import (
 	"testing"
 	"time"
 
+	"git.happydns.org/happyDeliver/internal/api"
 	"golang.org/x/net/html"
 )
 
@@ -76,17 +77,17 @@ func TestExtractTextFromHTML(t *testing.T) {
 		{
 			name:         "Multiple elements",
 			html:         "<div><h1>Title</h1><p>Paragraph</p></div>",
-			expectedText: "Title Paragraph",
+			expectedText: "TitleParagraph",
 		},
 		{
 			name:         "With script tag",
 			html:         "<p>Text</p><script>alert('hi')</script><p>More</p>",
-			expectedText: "Text More",
+			expectedText: "TextMore",
 		},
 		{
 			name:         "With style tag",
 			html:         "<p>Text</p><style>.class { color: red; }</style><p>More</p>",
-			expectedText: "Text More",
+			expectedText: "TextMore",
 		},
 		{
 			name:         "Empty HTML",
@@ -144,74 +145,6 @@ func TestIsUnsubscribeLink(t *testing.T) {
 			linkText: "Read more",
 			expected: false,
 		},
-		// Multilingual keyword detection - URL path
-		{
-			name:     "German abmelden in URL",
-			href:     "https://example.com/abmelden?id=42",
-			linkText: "Click here",
-			expected: true,
-		},
-		{
-			name:     "French se-desabonner slug in URL (no accent/space - not detected by keyword)",
-			href:     "https://example.com/se-desabonner?id=42",
-			linkText: "Click here",
-			expected: false,
-		},
-		// Multilingual keyword detection - link text
-		{
-			name:     "German Abmelden in link text",
-			href:     "https://example.com/manage?id=42&lang=de",
-			linkText: "Abmelden",
-			expected: true,
-		},
-		{
-			name:     "French Se désabonner in link text",
-			href:     "https://example.com/manage?id=42&lang=fr",
-			linkText: "Se désabonner",
-			expected: true,
-		},
-		{
-			name:     "Russian Отписаться in link text",
-			href:     "https://example.com/manage?id=42&lang=ru",
-			linkText: "Отписаться",
-			expected: true,
-		},
-		{
-			name:     "Chinese 退订 in link text",
-			href:     "https://example.com/manage?id=42&lang=zh",
-			linkText: "退订",
-			expected: true,
-		},
-		{
-			name:     "Japanese 登録を取り消す in link text",
-			href:     "https://example.com/manage?id=42&lang=ja",
-			linkText: "登録を取り消す",
-			expected: true,
-		},
-		{
-			name:     "Korean 구독 해지 in link text",
-			href:     "https://example.com/manage?id=42&lang=ko",
-			linkText: "구독 해지",
-			expected: true,
-		},
-		{
-			name:     "Dutch Uitschrijven in link text",
-			href:     "https://example.com/manage?id=42&lang=nl",
-			linkText: "Uitschrijven",
-			expected: true,
-		},
-		{
-			name:     "Polish Odsubskrybuj in link text",
-			href:     "https://example.com/manage?id=42&lang=pl",
-			linkText: "Odsubskrybuj",
-			expected: true,
-		},
-		{
-			name:     "Turkish Üyeliği sonlandır in link text",
-			href:     "https://example.com/manage?id=42&lang=tr",
-			linkText: "Üyeliği sonlandır",
-			expected: true,
-		},
 	}
 
 	analyzer := NewContentAnalyzer(5 * time.Second)
@@ -281,16 +214,6 @@ func TestIsSuspiciousURL(t *testing.T) {
 			url:      "https://mail.example.com/page",
 			expected: false,
 		},
-		{
-			name:     "Mailto with @ symbol",
-			url:      "mailto:support@example.com",
-			expected: false,
-		},
-		{
-			name:     "Mailto with multiple @ symbols",
-			url:      "mailto:user@subdomain@example.com",
-			expected: false,
-		},
 	}
 
 	analyzer := NewContentAnalyzer(5 * time.Second)
@@ -685,6 +608,453 @@ func TestAnalyzeContent_ImageAltAttributes(t *testing.T) {
 	}
 }
 
+func TestGenerateHTMLValidityCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Valid HTML",
+			results: &ContentResults{
+				HTMLValid: true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  0.2,
+		},
+		{
+			name: "Invalid HTML",
+			results: &ContentResults{
+				HTMLValid:  false,
+				HTMLErrors: []string{"Parse error"},
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateHTMLValidityCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Content {
+				t.Errorf("Category = %v, want %v", check.Category, api.Content)
+			}
+		})
+	}
+}
+
+func TestGenerateLinkChecks(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "All links valid",
+			results: &ContentResults{
+				Links: []LinkCheck{
+					{URL: "https://example.com", Valid: true, Status: 200},
+					{URL: "https://example.org", Valid: true, Status: 200},
+				},
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  0.4,
+		},
+		{
+			name: "Broken links",
+			results: &ContentResults{
+				Links: []LinkCheck{
+					{URL: "https://example.com", Valid: true, Status: 404, Error: "Not found"},
+				},
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+		{
+			name: "Links with warnings",
+			results: &ContentResults{
+				Links: []LinkCheck{
+					{URL: "https://example.com", Valid: true, Warning: "Could not verify"},
+				},
+			},
+			expectedStatus: api.CheckStatusWarn,
+			expectedScore:  0.3,
+		},
+		{
+			name:    "No links",
+			results: &ContentResults{},
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			checks := analyzer.generateLinkChecks(tt.results)
+
+			if tt.name == "No links" {
+				if len(checks) != 0 {
+					t.Errorf("Expected no checks, got %d", len(checks))
+				}
+				return
+			}
+
+			if len(checks) == 0 {
+				t.Fatal("Expected at least one check")
+			}
+
+			check := checks[0]
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+		})
+	}
+}
+
+func TestGenerateImageChecks(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+	}{
+		{
+			name: "All images have alt",
+			results: &ContentResults{
+				Images: []ImageCheck{
+					{Src: "img1.jpg", HasAlt: true, AltText: "Alt 1"},
+					{Src: "img2.jpg", HasAlt: true, AltText: "Alt 2"},
+				},
+			},
+			expectedStatus: api.CheckStatusPass,
+		},
+		{
+			name: "No images have alt",
+			results: &ContentResults{
+				Images: []ImageCheck{
+					{Src: "img1.jpg", HasAlt: false},
+					{Src: "img2.jpg", HasAlt: false},
+				},
+			},
+			expectedStatus: api.CheckStatusFail,
+		},
+		{
+			name: "Some images have alt",
+			results: &ContentResults{
+				Images: []ImageCheck{
+					{Src: "img1.jpg", HasAlt: true, AltText: "Alt 1"},
+					{Src: "img2.jpg", HasAlt: false},
+				},
+			},
+			expectedStatus: api.CheckStatusWarn,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			checks := analyzer.generateImageChecks(tt.results)
+
+			if len(checks) == 0 {
+				t.Fatal("Expected at least one check")
+			}
+
+			check := checks[0]
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Category != api.Content {
+				t.Errorf("Category = %v, want %v", check.Category, api.Content)
+			}
+		})
+	}
+}
+
+func TestGenerateUnsubscribeCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+	}{
+		{
+			name: "Has unsubscribe link",
+			results: &ContentResults{
+				HasUnsubscribe:   true,
+				UnsubscribeLinks: []string{"https://example.com/unsubscribe"},
+			},
+			expectedStatus: api.CheckStatusPass,
+		},
+		{
+			name:           "No unsubscribe link",
+			results:        &ContentResults{},
+			expectedStatus: api.CheckStatusWarn,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateUnsubscribeCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Category != api.Content {
+				t.Errorf("Category = %v, want %v", check.Category, api.Content)
+			}
+		})
+	}
+}
+
+func TestGenerateTextConsistencyCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+	}{
+		{
+			name: "High consistency",
+			results: &ContentResults{
+				TextPlainRatio: 0.8,
+			},
+			expectedStatus: api.CheckStatusPass,
+		},
+		{
+			name: "Low consistency",
+			results: &ContentResults{
+				TextPlainRatio: 0.1,
+			},
+			expectedStatus: api.CheckStatusWarn,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateTextConsistencyCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestGenerateImageRatioCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *ContentResults
+		expectedStatus api.CheckStatus
+	}{
+		{
+			name: "Reasonable ratio",
+			results: &ContentResults{
+				ImageTextRatio: 3.0,
+				Images:         []ImageCheck{{}, {}, {}},
+			},
+			expectedStatus: api.CheckStatusPass,
+		},
+		{
+			name: "High ratio",
+			results: &ContentResults{
+				ImageTextRatio: 7.0,
+				Images:         make([]ImageCheck, 7),
+			},
+			expectedStatus: api.CheckStatusWarn,
+		},
+		{
+			name: "Excessive ratio",
+			results: &ContentResults{
+				ImageTextRatio: 15.0,
+				Images:         make([]ImageCheck, 15),
+			},
+			expectedStatus: api.CheckStatusFail,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateImageRatioCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+		})
+	}
+}
+
+func TestGenerateSuspiciousURLCheck(t *testing.T) {
+	results := &ContentResults{
+		SuspiciousURLs: []string{
+			"https://bit.ly/abc123",
+			"https://192.168.1.1/page",
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+	check := analyzer.generateSuspiciousURLCheck(results)
+
+	if check.Status != api.CheckStatusWarn {
+		t.Errorf("Status = %v, want %v", check.Status, api.CheckStatusWarn)
+	}
+	if check.Category != api.Content {
+		t.Errorf("Category = %v, want %v", check.Category, api.Content)
+	}
+	if !strings.Contains(check.Message, "2") {
+		t.Error("Message should mention the count of suspicious URLs")
+	}
+}
+
+func TestGetContentScore(t *testing.T) {
+	tests := []struct {
+		name     string
+		results  *ContentResults
+		minScore float32
+		maxScore float32
+	}{
+		{
+			name:     "Nil results",
+			results:  nil,
+			minScore: 0.0,
+			maxScore: 0.0,
+		},
+		{
+			name: "Perfect content",
+			results: &ContentResults{
+				HTMLValid:      true,
+				Links:          []LinkCheck{{Valid: true, Status: 200}},
+				Images:         []ImageCheck{{HasAlt: true}},
+				HasUnsubscribe: true,
+				TextPlainRatio: 0.8,
+				ImageTextRatio: 3.0,
+			},
+			minScore: 1.8,
+			maxScore: 2.0,
+		},
+		{
+			name: "Poor content",
+			results: &ContentResults{
+				HTMLValid:      false,
+				Links:          []LinkCheck{{Valid: true, Status: 404}},
+				Images:         []ImageCheck{{HasAlt: false}},
+				HasUnsubscribe: false,
+				TextPlainRatio: 0.1,
+				ImageTextRatio: 15.0,
+				SuspiciousURLs: []string{"url1", "url2"},
+			},
+			minScore: 0.0,
+			maxScore: 0.5,
+		},
+		{
+			name: "Average content",
+			results: &ContentResults{
+				HTMLValid:      true,
+				Links:          []LinkCheck{{Valid: true, Status: 200}},
+				Images:         []ImageCheck{{HasAlt: true}},
+				HasUnsubscribe: false,
+				TextPlainRatio: 0.5,
+				ImageTextRatio: 4.0,
+			},
+			minScore: 1.0,
+			maxScore: 1.8,
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			score := analyzer.GetContentScore(tt.results)
+
+			if score < tt.minScore || score > tt.maxScore {
+				t.Errorf("GetContentScore() = %v, want between %v and %v", score, tt.minScore, tt.maxScore)
+			}
+
+			// Ensure score is capped at 2.0
+			if score > 2.0 {
+				t.Errorf("Score %v exceeds maximum of 2.0", score)
+			}
+
+			// Ensure score is not negative
+			if score < 0.0 {
+				t.Errorf("Score %v is negative", score)
+			}
+		})
+	}
+}
+
+func TestGenerateContentChecks(t *testing.T) {
+	tests := []struct {
+		name      string
+		results   *ContentResults
+		minChecks int
+	}{
+		{
+			name:      "Nil results",
+			results:   nil,
+			minChecks: 0,
+		},
+		{
+			name: "Complete results",
+			results: &ContentResults{
+				HTMLValid:      true,
+				Links:          []LinkCheck{{Valid: true}},
+				Images:         []ImageCheck{{HasAlt: true}},
+				HasUnsubscribe: true,
+				TextContent:    "Plain text",
+				HTMLContent:    "<p>HTML text</p>",
+				ImageTextRatio: 3.0,
+			},
+			minChecks: 5, // HTML, Links, Images, Unsubscribe, Text consistency, Image ratio
+		},
+		{
+			name: "With suspicious URLs",
+			results: &ContentResults{
+				HTMLValid:      true,
+				SuspiciousURLs: []string{"url1"},
+			},
+			minChecks: 3, // HTML, Unsubscribe, Suspicious URLs
+		},
+	}
+
+	analyzer := NewContentAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			checks := analyzer.GenerateContentChecks(tt.results)
+
+			if len(checks) < tt.minChecks {
+				t.Errorf("Got %d checks, want at least %d", len(checks), tt.minChecks)
+			}
+
+			// Verify all checks have the Content category
+			for _, check := range checks {
+				if check.Category != api.Content {
+					t.Errorf("Check %s has category %v, want %v", check.Name, check.Category, api.Content)
+				}
+			}
+		})
+	}
+}
+
 // Helper functions for testing
 
 func parseHTML(htmlStr string) (*html.Node, error) {
@@ -706,276 +1076,3 @@ func findFirstLink(n *html.Node) *html.Node {
 func parseURL(urlStr string) (*url.URL, error) {
 	return url.Parse(urlStr)
 }
-
-func TestHasDomainMisalignment(t *testing.T) {
-	tests := []struct {
-		name     string
-		href     string
-		linkText string
-		expected bool
-		reason   string
-	}{
-		// Phishing cases - should return true
-		{
-			name:     "Obvious phishing - different domains",
-			href:     "https://evil.com/page",
-			linkText: "Click here to verify your paypal.com account",
-			expected: true,
-			reason:   "Link text shows 'paypal.com' but URL points to 'evil.com'",
-		},
-		{
-			name:     "Domain in link text differs from URL",
-			href:     "http://attacker.net",
-			linkText: "Visit google.com for more info",
-			expected: true,
-			reason:   "Link text shows 'google.com' but URL points to 'attacker.net'",
-		},
-		{
-			name:     "URL shown in text differs from actual URL",
-			href:     "https://phishing-site.xyz/login",
-			linkText: "https://www.bank.example.com/secure",
-			expected: true,
-			reason:   "Full URL in text doesn't match actual destination",
-		},
-		{
-			name:     "Similar but different domain",
-			href:     "https://paypa1.com/login",
-			linkText: "Login to your paypal.com account",
-			expected: true,
-			reason:   "Typosquatting: 'paypa1.com' vs 'paypal.com'",
-		},
-		{
-			name:     "Subdomain spoofing",
-			href:     "https://paypal.com.evil.com/login",
-			linkText: "Verify your paypal.com account",
-			expected: true,
-			reason:   "Domain is 'evil.com', not 'paypal.com'",
-		},
-		{
-			name:     "Multiple domains in text, none match",
-			href:     "https://badsite.com",
-			linkText: "Transfer from bank.com to paypal.com",
-			expected: true,
-			reason:   "Neither 'bank.com' nor 'paypal.com' matches 'badsite.com'",
-		},
-
-		// Legitimate cases - should return false
-		{
-			name:     "Exact domain match",
-			href:     "https://example.com/page",
-			linkText: "Visit example.com for more information",
-			expected: false,
-			reason:   "Domains match exactly",
-		},
-		{
-			name:     "Legitimate subdomain",
-			href:     "https://mail.google.com/inbox",
-			linkText: "Check your google.com email",
-			expected: false,
-			reason:   "Subdomain of the mentioned domain",
-		},
-		{
-			name:     "www prefix variation",
-			href:     "https://www.example.com/page",
-			linkText: "Visit example.com",
-			expected: false,
-			reason:   "www prefix is acceptable variation",
-		},
-		{
-			name:     "Generic link text - click here",
-			href:     "https://anywhere.com",
-			linkText: "click here",
-			expected: false,
-			reason:   "Generic text doesn't contain a domain",
-		},
-		{
-			name:     "Generic link text - read more",
-			href:     "https://example.com/article",
-			linkText: "Read more",
-			expected: false,
-			reason:   "Generic text doesn't contain a domain",
-		},
-		{
-			name:     "Generic link text - learn more",
-			href:     "https://example.com/info",
-			linkText: "Learn More",
-			expected: false,
-			reason:   "Generic text doesn't contain a domain (case insensitive)",
-		},
-		{
-			name:     "No domain in link text",
-			href:     "https://example.com/page",
-			linkText: "Click to continue",
-			expected: false,
-			reason:   "Link text has no domain reference",
-		},
-		{
-			name:     "Short link text",
-			href:     "https://example.com",
-			linkText: "Go",
-			expected: false,
-			reason:   "Text too short to contain meaningful domain",
-		},
-		{
-			name:     "Empty link text",
-			href:     "https://example.com",
-			linkText: "",
-			expected: false,
-			reason:   "Empty text cannot contain domain",
-		},
-		{
-			name:     "Mailto link - matching domain",
-			href:     "mailto:support@example.com",
-			linkText: "Email support@example.com",
-			expected: false,
-			reason:   "Mailto email matches text email",
-		},
-		{
-			name:     "Mailto link - domain mismatch (phishing)",
-			href:     "mailto:attacker@evil.com",
-			linkText: "Contact support@paypal.com for help",
-			expected: true,
-			reason:   "Mailto domain 'evil.com' doesn't match text domain 'paypal.com'",
-		},
-		{
-			name:     "Mailto link - generic text",
-			href:     "mailto:info@example.com",
-			linkText: "Contact us",
-			expected: false,
-			reason:   "Generic text without domain reference",
-		},
-		{
-			name:     "Mailto link - same domain different user",
-			href:     "mailto:sales@example.com",
-			linkText: "Email support@example.com",
-			expected: false,
-			reason:   "Both emails share the same domain",
-		},
-		{
-			name:     "Mailto link - text shows only domain",
-			href:     "mailto:info@example.com",
-			linkText: "Write to example.com",
-			expected: false,
-			reason:   "Text domain matches mailto domain",
-		},
-		{
-			name:     "Mailto link - domain in text doesn't match",
-			href:     "mailto:scam@phishing.net",
-			linkText: "Reply to customer-service@amazon.com",
-			expected: true,
-			reason:   "Mailto domain 'phishing.net' doesn't match 'amazon.com' in text",
-		},
-		{
-			name:     "Tel link",
-			href:     "tel:+1234567890",
-			linkText: "Call example.com support",
-			expected: false,
-			reason:   "Non-HTTP(S) links are excluded",
-		},
-		{
-			name:     "Same base domain with different subdomains",
-			href:     "https://www.example.com/page",
-			linkText: "Visit blog.example.com",
-			expected: false,
-			reason:   "Both share same base domain 'example.com'",
-		},
-		{
-			name:     "URL with path matches domain in text",
-			href:     "https://example.com/section/page",
-			linkText: "Go to example.com",
-			expected: false,
-			reason:   "Domain matches, path doesn't matter",
-		},
-		{
-			name:     "Generic text - subscribe",
-			href:     "https://newsletter.example.com/signup",
-			linkText: "Subscribe",
-			expected: false,
-			reason:   "Generic call-to-action text",
-		},
-		{
-			name:     "Generic text - unsubscribe",
-			href:     "https://example.com/unsubscribe?id=123",
-			linkText: "Unsubscribe",
-			expected: false,
-			reason:   "Generic unsubscribe text",
-		},
-		{
-			name:     "Generic text - download",
-			href:     "https://files.example.com/document.pdf",
-			linkText: "Download",
-			expected: false,
-			reason:   "Generic action text",
-		},
-		{
-			name:     "Descriptive text without domain",
-			href:     "https://shop.example.com/products",
-			linkText: "View our latest products",
-			expected: false,
-			reason:   "No domain mentioned in text",
-		},
-
-		// Edge cases
-		{
-			name:     "Domain-like text but not valid domain",
-			href:     "https://example.com",
-			linkText: "Save up to 50.00 dollars",
-			expected: false,
-			reason:   "50.00 looks like domain but isn't",
-		},
-		{
-			name:     "Text with http prefix matching domain",
-			href:     "https://example.com/page",
-			linkText: "Visit http://example.com",
-			expected: false,
-			reason:   "Domains match despite different protocols in display",
-		},
-		{
-			name:     "Port in URL should not affect matching",
-			href:     "https://example.com:8080/page",
-			linkText: "Go to example.com",
-			expected: false,
-			reason:   "Port number doesn't affect domain matching",
-		},
-		{
-			name:     "Whitespace in link text",
-			href:     "https://example.com",
-			linkText: "  example.com  ",
-			expected: false,
-			reason:   "Whitespace should be trimmed",
-		},
-		{
-			name:     "Multiple spaces in generic text",
-			href:     "https://example.com",
-			linkText: "click  here",
-			expected: false,
-			reason:   "Generic text with extra spaces",
-		},
-		{
-			name:     "Anchor fragment in URL",
-			href:     "https://example.com/page#section",
-			linkText: "example.com section",
-			expected: false,
-			reason:   "Fragment doesn't affect domain matching",
-		},
-		{
-			name:     "Query parameters in URL",
-			href:     "https://example.com/page?utm_source=email",
-			linkText: "Visit example.com",
-			expected: false,
-			reason:   "Query params don't affect domain matching",
-		},
-	}
-
-	analyzer := NewContentAnalyzer(5 * time.Second)
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			result := analyzer.hasDomainMisalignment(tt.href, tt.linkText)
-			if result != tt.expected {
-				t.Errorf("hasDomainMisalignment(%q, %q) = %v, want %v\nReason: %s",
-					tt.href, tt.linkText, result, tt.expected, tt.reason)
-			}
-		})
-	}
-}

internal/analyzer/dns.go

@@ -0,0 +1,566 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"regexp"
+	"strings"
+	"time"
+
+	"git.happydns.org/happyDeliver/internal/api"
+)
+
+// DNSAnalyzer analyzes DNS records for email domains
+type DNSAnalyzer struct {
+	Timeout  time.Duration
+	resolver *net.Resolver
+}
+
+// NewDNSAnalyzer creates a new DNS analyzer with configurable timeout
+func NewDNSAnalyzer(timeout time.Duration) *DNSAnalyzer {
+	if timeout == 0 {
+		timeout = 10 * time.Second // Default timeout
+	}
+	return &DNSAnalyzer{
+		Timeout: timeout,
+		resolver: &net.Resolver{
+			PreferGo: true,
+		},
+	}
+}
+
+// DNSResults represents DNS validation results for an email
+type DNSResults struct {
+	Domain      string
+	MXRecords   []MXRecord
+	SPFRecord   *SPFRecord
+	DKIMRecords []DKIMRecord
+	DMARCRecord *DMARCRecord
+	Errors      []string
+}
+
+// MXRecord represents an MX record
+type MXRecord struct {
+	Host     string
+	Priority uint16
+	Valid    bool
+	Error    string
+}
+
+// SPFRecord represents an SPF record
+type SPFRecord struct {
+	Record string
+	Valid  bool
+	Error  string
+}
+
+// DKIMRecord represents a DKIM record
+type DKIMRecord struct {
+	Selector string
+	Domain   string
+	Record   string
+	Valid    bool
+	Error    string
+}
+
+// DMARCRecord represents a DMARC record
+type DMARCRecord struct {
+	Record string
+	Policy string // none, quarantine, reject
+	Valid  bool
+	Error  string
+}
+
+// AnalyzeDNS performs DNS validation for the email's domain
+func (d *DNSAnalyzer) AnalyzeDNS(email *EmailMessage, authResults *api.AuthenticationResults) *DNSResults {
+	// Extract domain from From address
+	domain := d.extractDomain(email)
+	if domain == "" {
+		return &DNSResults{
+			Errors: []string{"Unable to extract domain from email"},
+		}
+	}
+
+	results := &DNSResults{
+		Domain: domain,
+	}
+
+	// Check MX records
+	results.MXRecords = d.checkMXRecords(domain)
+
+	// Check SPF record
+	results.SPFRecord = d.checkSPFRecord(domain)
+
+	// Check DKIM records (from authentication results)
+	if authResults != nil && authResults.Dkim != nil {
+		for _, dkim := range *authResults.Dkim {
+			if dkim.Domain != nil && dkim.Selector != nil {
+				dkimRecord := d.checkDKIMRecord(*dkim.Domain, *dkim.Selector)
+				if dkimRecord != nil {
+					results.DKIMRecords = append(results.DKIMRecords, *dkimRecord)
+				}
+			}
+		}
+	}
+
+	// Check DMARC record
+	results.DMARCRecord = d.checkDMARCRecord(domain)
+
+	return results
+}
+
+// extractDomain extracts the domain from the email's From address
+func (d *DNSAnalyzer) extractDomain(email *EmailMessage) string {
+	if email.From != nil && email.From.Address != "" {
+		parts := strings.Split(email.From.Address, "@")
+		if len(parts) == 2 {
+			return strings.ToLower(strings.TrimSpace(parts[1]))
+		}
+	}
+	return ""
+}
+
+// checkMXRecords looks up MX records for a domain
+func (d *DNSAnalyzer) checkMXRecords(domain string) []MXRecord {
+	ctx, cancel := context.WithTimeout(context.Background(), d.Timeout)
+	defer cancel()
+
+	mxRecords, err := d.resolver.LookupMX(ctx, domain)
+	if err != nil {
+		return []MXRecord{
+			{
+				Valid: false,
+				Error: fmt.Sprintf("Failed to lookup MX records: %v", err),
+			},
+		}
+	}
+
+	if len(mxRecords) == 0 {
+		return []MXRecord{
+			{
+				Valid: false,
+				Error: "No MX records found",
+			},
+		}
+	}
+
+	var results []MXRecord
+	for _, mx := range mxRecords {
+		results = append(results, MXRecord{
+			Host:     mx.Host,
+			Priority: mx.Pref,
+			Valid:    true,
+		})
+	}
+
+	return results
+}
+
+// checkSPFRecord looks up and validates SPF record for a domain
+func (d *DNSAnalyzer) checkSPFRecord(domain string) *SPFRecord {
+	ctx, cancel := context.WithTimeout(context.Background(), d.Timeout)
+	defer cancel()
+
+	txtRecords, err := d.resolver.LookupTXT(ctx, domain)
+	if err != nil {
+		return &SPFRecord{
+			Valid: false,
+			Error: fmt.Sprintf("Failed to lookup TXT records: %v", err),
+		}
+	}
+
+	// Find SPF record (starts with "v=spf1")
+	var spfRecord string
+	spfCount := 0
+	for _, txt := range txtRecords {
+		if strings.HasPrefix(txt, "v=spf1") {
+			spfRecord = txt
+			spfCount++
+		}
+	}
+
+	if spfCount == 0 {
+		return &SPFRecord{
+			Valid: false,
+			Error: "No SPF record found",
+		}
+	}
+
+	if spfCount > 1 {
+		return &SPFRecord{
+			Record: spfRecord,
+			Valid:  false,
+			Error:  "Multiple SPF records found (RFC violation)",
+		}
+	}
+
+	// Basic validation
+	if !d.validateSPF(spfRecord) {
+		return &SPFRecord{
+			Record: spfRecord,
+			Valid:  false,
+			Error:  "SPF record appears malformed",
+		}
+	}
+
+	return &SPFRecord{
+		Record: spfRecord,
+		Valid:  true,
+	}
+}
+
+// validateSPF performs basic SPF record validation
+func (d *DNSAnalyzer) validateSPF(record string) bool {
+	// Must start with v=spf1
+	if !strings.HasPrefix(record, "v=spf1") {
+		return false
+	}
+
+	// Check for common syntax issues
+	// Should have a final mechanism (all, +all, -all, ~all, ?all)
+	validEndings := []string{" all", " +all", " -all", " ~all", " ?all"}
+	hasValidEnding := false
+	for _, ending := range validEndings {
+		if strings.HasSuffix(record, ending) {
+			hasValidEnding = true
+			break
+		}
+	}
+
+	return hasValidEnding
+}
+
+// checkDKIMRecord looks up and validates DKIM record for a domain and selector
+func (d *DNSAnalyzer) checkDKIMRecord(domain, selector string) *DKIMRecord {
+	// DKIM records are at: selector._domainkey.domain
+	dkimDomain := fmt.Sprintf("%s._domainkey.%s", selector, domain)
+
+	ctx, cancel := context.WithTimeout(context.Background(), d.Timeout)
+	defer cancel()
+
+	txtRecords, err := d.resolver.LookupTXT(ctx, dkimDomain)
+	if err != nil {
+		return &DKIMRecord{
+			Selector: selector,
+			Domain:   domain,
+			Valid:    false,
+			Error:    fmt.Sprintf("Failed to lookup DKIM record: %v", err),
+		}
+	}
+
+	if len(txtRecords) == 0 {
+		return &DKIMRecord{
+			Selector: selector,
+			Domain:   domain,
+			Valid:    false,
+			Error:    "No DKIM record found",
+		}
+	}
+
+	// Concatenate all TXT record parts (DKIM can be split)
+	dkimRecord := strings.Join(txtRecords, "")
+
+	// Basic validation - should contain "v=DKIM1" and "p=" (public key)
+	if !d.validateDKIM(dkimRecord) {
+		return &DKIMRecord{
+			Selector: selector,
+			Domain:   domain,
+			Record:   dkimRecord,
+			Valid:    false,
+			Error:    "DKIM record appears malformed",
+		}
+	}
+
+	return &DKIMRecord{
+		Selector: selector,
+		Domain:   domain,
+		Record:   dkimRecord,
+		Valid:    true,
+	}
+}
+
+// validateDKIM performs basic DKIM record validation
+func (d *DNSAnalyzer) validateDKIM(record string) bool {
+	// Should contain p= tag (public key)
+	if !strings.Contains(record, "p=") {
+		return false
+	}
+
+	// Often contains v=DKIM1 but not required
+	// If v= is present, it should be DKIM1
+	if strings.Contains(record, "v=") && !strings.Contains(record, "v=DKIM1") {
+		return false
+	}
+
+	return true
+}
+
+// checkDMARCRecord looks up and validates DMARC record for a domain
+func (d *DNSAnalyzer) checkDMARCRecord(domain string) *DMARCRecord {
+	// DMARC records are at: _dmarc.domain
+	dmarcDomain := fmt.Sprintf("_dmarc.%s", domain)
+
+	ctx, cancel := context.WithTimeout(context.Background(), d.Timeout)
+	defer cancel()
+
+	txtRecords, err := d.resolver.LookupTXT(ctx, dmarcDomain)
+	if err != nil {
+		return &DMARCRecord{
+			Valid: false,
+			Error: fmt.Sprintf("Failed to lookup DMARC record: %v", err),
+		}
+	}
+
+	// Find DMARC record (starts with "v=DMARC1")
+	var dmarcRecord string
+	for _, txt := range txtRecords {
+		if strings.HasPrefix(txt, "v=DMARC1") {
+			dmarcRecord = txt
+			break
+		}
+	}
+
+	if dmarcRecord == "" {
+		return &DMARCRecord{
+			Valid: false,
+			Error: "No DMARC record found",
+		}
+	}
+
+	// Extract policy
+	policy := d.extractDMARCPolicy(dmarcRecord)
+
+	// Basic validation
+	if !d.validateDMARC(dmarcRecord) {
+		return &DMARCRecord{
+			Record: dmarcRecord,
+			Policy: policy,
+			Valid:  false,
+			Error:  "DMARC record appears malformed",
+		}
+	}
+
+	return &DMARCRecord{
+		Record: dmarcRecord,
+		Policy: policy,
+		Valid:  true,
+	}
+}
+
+// extractDMARCPolicy extracts the policy from a DMARC record
+func (d *DNSAnalyzer) extractDMARCPolicy(record string) string {
+	// Look for p=none, p=quarantine, or p=reject
+	re := regexp.MustCompile(`p=(none|quarantine|reject)`)
+	matches := re.FindStringSubmatch(record)
+	if len(matches) > 1 {
+		return matches[1]
+	}
+	return "unknown"
+}
+
+// validateDMARC performs basic DMARC record validation
+func (d *DNSAnalyzer) validateDMARC(record string) bool {
+	// Must start with v=DMARC1
+	if !strings.HasPrefix(record, "v=DMARC1") {
+		return false
+	}
+
+	// Must have a policy tag
+	if !strings.Contains(record, "p=") {
+		return false
+	}
+
+	return true
+}
+
+// GenerateDNSChecks generates check results for DNS validation
+func (d *DNSAnalyzer) GenerateDNSChecks(results *DNSResults) []api.Check {
+	var checks []api.Check
+
+	if results == nil {
+		return checks
+	}
+
+	// MX record check
+	checks = append(checks, d.generateMXCheck(results))
+
+	// SPF record check
+	if results.SPFRecord != nil {
+		checks = append(checks, d.generateSPFCheck(results.SPFRecord))
+	}
+
+	// DKIM record checks
+	for _, dkim := range results.DKIMRecords {
+		checks = append(checks, d.generateDKIMCheck(&dkim))
+	}
+
+	// DMARC record check
+	if results.DMARCRecord != nil {
+		checks = append(checks, d.generateDMARCCheck(results.DMARCRecord))
+	}
+
+	return checks
+}
+
+// generateMXCheck creates a check for MX records
+func (d *DNSAnalyzer) generateMXCheck(results *DNSResults) api.Check {
+	check := api.Check{
+		Category: api.Dns,
+		Name:     "MX Records",
+	}
+
+	if len(results.MXRecords) == 0 || !results.MXRecords[0].Valid {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Severity = api.PtrTo(api.Critical)
+
+		if len(results.MXRecords) > 0 && results.MXRecords[0].Error != "" {
+			check.Message = results.MXRecords[0].Error
+		} else {
+			check.Message = "No valid MX records found"
+		}
+		check.Advice = api.PtrTo("Configure MX records for your domain to receive email")
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Severity = api.PtrTo(api.Info)
+		check.Message = fmt.Sprintf("Found %d valid MX record(s)", len(results.MXRecords))
+
+		// Add details about MX records
+		var mxList []string
+		for _, mx := range results.MXRecords {
+			mxList = append(mxList, fmt.Sprintf("%s (priority %d)", mx.Host, mx.Priority))
+		}
+		details := strings.Join(mxList, ", ")
+		check.Details = &details
+		check.Advice = api.PtrTo("Your MX records are properly configured")
+	}
+
+	return check
+}
+
+// generateSPFCheck creates a check for SPF records
+func (d *DNSAnalyzer) generateSPFCheck(spf *SPFRecord) api.Check {
+	check := api.Check{
+		Category: api.Dns,
+		Name:     "SPF Record",
+	}
+
+	if !spf.Valid {
+		// If no record exists at all, it's a failure
+		if spf.Record == "" {
+			check.Status = api.CheckStatusFail
+			check.Score = 0.0
+			check.Message = spf.Error
+			check.Severity = api.PtrTo(api.High)
+			check.Advice = api.PtrTo("Configure an SPF record for your domain to improve deliverability")
+		} else {
+			// If record exists but is invalid, it's a warning
+			check.Status = api.CheckStatusWarn
+			check.Score = 0.5
+			check.Message = "SPF record found but appears invalid"
+			check.Severity = api.PtrTo(api.Medium)
+			check.Advice = api.PtrTo("Review and fix your SPF record syntax")
+			check.Details = &spf.Record
+		}
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = "Valid SPF record found"
+		check.Severity = api.PtrTo(api.Info)
+		check.Details = &spf.Record
+		check.Advice = api.PtrTo("Your SPF record is properly configured")
+	}
+
+	return check
+}
+
+// generateDKIMCheck creates a check for DKIM records
+func (d *DNSAnalyzer) generateDKIMCheck(dkim *DKIMRecord) api.Check {
+	check := api.Check{
+		Category: api.Dns,
+		Name:     fmt.Sprintf("DKIM Record (%s)", dkim.Selector),
+	}
+
+	if !dkim.Valid {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Message = fmt.Sprintf("DKIM record not found or invalid: %s", dkim.Error)
+		check.Severity = api.PtrTo(api.High)
+		check.Advice = api.PtrTo("Ensure DKIM record is published in DNS for the selector used")
+		details := fmt.Sprintf("Selector: %s, Domain: %s", dkim.Selector, dkim.Domain)
+		check.Details = &details
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = "Valid DKIM record found"
+		check.Severity = api.PtrTo(api.Info)
+		details := fmt.Sprintf("Selector: %s, Domain: %s", dkim.Selector, dkim.Domain)
+		check.Details = &details
+		check.Advice = api.PtrTo("Your DKIM record is properly published")
+	}
+
+	return check
+}
+
+// generateDMARCCheck creates a check for DMARC records
+func (d *DNSAnalyzer) generateDMARCCheck(dmarc *DMARCRecord) api.Check {
+	check := api.Check{
+		Category: api.Dns,
+		Name:     "DMARC Record",
+	}
+
+	if !dmarc.Valid {
+		check.Status = api.CheckStatusFail
+		check.Score = 0.0
+		check.Message = dmarc.Error
+		check.Severity = api.PtrTo(api.High)
+		check.Advice = api.PtrTo("Configure a DMARC record for your domain to improve deliverability and prevent spoofing")
+	} else {
+		check.Status = api.CheckStatusPass
+		check.Score = 1.0
+		check.Message = fmt.Sprintf("Valid DMARC record found with policy: %s", dmarc.Policy)
+		check.Severity = api.PtrTo(api.Info)
+		check.Details = &dmarc.Record
+
+		// Provide advice based on policy
+		switch dmarc.Policy {
+		case "none":
+			advice := "DMARC policy is set to 'none' (monitoring only). Consider upgrading to 'quarantine' or 'reject' for better protection"
+			check.Advice = &advice
+		case "quarantine":
+			advice := "DMARC policy is set to 'quarantine'. This provides good protection"
+			check.Advice = &advice
+		case "reject":
+			advice := "DMARC policy is set to 'reject'. This provides the strongest protection"
+			check.Advice = &advice
+		default:
+			advice := "Your DMARC record is properly configured"
+			check.Advice = &advice
+		}
+	}
+
+	return check
+}

internal/analyzer/dns_test.go

@@ -0,0 +1,633 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"net/mail"
+	"strings"
+	"testing"
+	"time"
+
+	"git.happydns.org/happyDeliver/internal/api"
+)
+
+func TestNewDNSAnalyzer(t *testing.T) {
+	tests := []struct {
+		name            string
+		timeout         time.Duration
+		expectedTimeout time.Duration
+	}{
+		{
+			name:            "Default timeout",
+			timeout:         0,
+			expectedTimeout: 10 * time.Second,
+		},
+		{
+			name:            "Custom timeout",
+			timeout:         5 * time.Second,
+			expectedTimeout: 5 * time.Second,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			analyzer := NewDNSAnalyzer(tt.timeout)
+			if analyzer.Timeout != tt.expectedTimeout {
+				t.Errorf("Timeout = %v, want %v", analyzer.Timeout, tt.expectedTimeout)
+			}
+			if analyzer.resolver == nil {
+				t.Error("Resolver should not be nil")
+			}
+		})
+	}
+}
+
+func TestExtractDomain(t *testing.T) {
+	tests := []struct {
+		name           string
+		fromAddress    string
+		expectedDomain string
+	}{
+		{
+			name:           "Valid email",
+			fromAddress:    "user@example.com",
+			expectedDomain: "example.com",
+		},
+		{
+			name:           "Email with subdomain",
+			fromAddress:    "user@mail.example.com",
+			expectedDomain: "mail.example.com",
+		},
+		{
+			name:           "Email with uppercase",
+			fromAddress:    "User@Example.COM",
+			expectedDomain: "example.com",
+		},
+		{
+			name:           "Invalid email (no @)",
+			fromAddress:    "invalid-email",
+			expectedDomain: "",
+		},
+		{
+			name:           "Empty email",
+			fromAddress:    "",
+			expectedDomain: "",
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			email := &EmailMessage{
+				Header: make(mail.Header),
+			}
+			if tt.fromAddress != "" {
+				email.From = &mail.Address{
+					Address: tt.fromAddress,
+				}
+			}
+
+			domain := analyzer.extractDomain(email)
+			if domain != tt.expectedDomain {
+				t.Errorf("extractDomain() = %q, want %q", domain, tt.expectedDomain)
+			}
+		})
+	}
+}
+
+func TestValidateSPF(t *testing.T) {
+	tests := []struct {
+		name     string
+		record   string
+		expected bool
+	}{
+		{
+			name:     "Valid SPF with -all",
+			record:   "v=spf1 include:_spf.example.com -all",
+			expected: true,
+		},
+		{
+			name:     "Valid SPF with ~all",
+			record:   "v=spf1 ip4:192.0.2.0/24 ~all",
+			expected: true,
+		},
+		{
+			name:     "Valid SPF with +all",
+			record:   "v=spf1 +all",
+			expected: true,
+		},
+		{
+			name:     "Valid SPF with ?all",
+			record:   "v=spf1 mx ?all",
+			expected: true,
+		},
+		{
+			name:     "Invalid SPF - no version",
+			record:   "include:_spf.example.com -all",
+			expected: false,
+		},
+		{
+			name:     "Invalid SPF - no all mechanism",
+			record:   "v=spf1 include:_spf.example.com",
+			expected: false,
+		},
+		{
+			name:     "Invalid SPF - wrong version",
+			record:   "v=spf2 include:_spf.example.com -all",
+			expected: false,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.validateSPF(tt.record)
+			if result != tt.expected {
+				t.Errorf("validateSPF(%q) = %v, want %v", tt.record, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestValidateDKIM(t *testing.T) {
+	tests := []struct {
+		name     string
+		record   string
+		expected bool
+	}{
+		{
+			name:     "Valid DKIM with version",
+			record:   "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...",
+			expected: true,
+		},
+		{
+			name:     "Valid DKIM without version",
+			record:   "k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...",
+			expected: true,
+		},
+		{
+			name:     "Invalid DKIM - no public key",
+			record:   "v=DKIM1; k=rsa",
+			expected: false,
+		},
+		{
+			name:     "Invalid DKIM - wrong version",
+			record:   "v=DKIM2; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...",
+			expected: false,
+		},
+		{
+			name:     "Invalid DKIM - empty",
+			record:   "",
+			expected: false,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.validateDKIM(tt.record)
+			if result != tt.expected {
+				t.Errorf("validateDKIM(%q) = %v, want %v", tt.record, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestExtractDMARCPolicy(t *testing.T) {
+	tests := []struct {
+		name           string
+		record         string
+		expectedPolicy string
+	}{
+		{
+			name:           "Policy none",
+			record:         "v=DMARC1; p=none; rua=mailto:dmarc@example.com",
+			expectedPolicy: "none",
+		},
+		{
+			name:           "Policy quarantine",
+			record:         "v=DMARC1; p=quarantine; pct=100",
+			expectedPolicy: "quarantine",
+		},
+		{
+			name:           "Policy reject",
+			record:         "v=DMARC1; p=reject; sp=reject",
+			expectedPolicy: "reject",
+		},
+		{
+			name:           "No policy",
+			record:         "v=DMARC1",
+			expectedPolicy: "unknown",
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.extractDMARCPolicy(tt.record)
+			if result != tt.expectedPolicy {
+				t.Errorf("extractDMARCPolicy(%q) = %q, want %q", tt.record, result, tt.expectedPolicy)
+			}
+		})
+	}
+}
+
+func TestValidateDMARC(t *testing.T) {
+	tests := []struct {
+		name     string
+		record   string
+		expected bool
+	}{
+		{
+			name:     "Valid DMARC",
+			record:   "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com",
+			expected: true,
+		},
+		{
+			name:     "Valid DMARC minimal",
+			record:   "v=DMARC1; p=none",
+			expected: true,
+		},
+		{
+			name:     "Invalid DMARC - no version",
+			record:   "p=quarantine",
+			expected: false,
+		},
+		{
+			name:     "Invalid DMARC - no policy",
+			record:   "v=DMARC1",
+			expected: false,
+		},
+		{
+			name:     "Invalid DMARC - wrong version",
+			record:   "v=DMARC2; p=reject",
+			expected: false,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := analyzer.validateDMARC(tt.record)
+			if result != tt.expected {
+				t.Errorf("validateDMARC(%q) = %v, want %v", tt.record, result, tt.expected)
+			}
+		})
+	}
+}
+
+func TestGenerateMXCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *DNSResults
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Valid MX records",
+			results: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Host: "mail.example.com", Priority: 10, Valid: true},
+					{Host: "mail2.example.com", Priority: 20, Valid: true},
+				},
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "No MX records",
+			results: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Valid: false, Error: "No MX records found"},
+				},
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+		{
+			name: "MX lookup failed",
+			results: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Valid: false, Error: "DNS lookup failed"},
+				},
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateMXCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Dns {
+				t.Errorf("Category = %v, want %v", check.Category, api.Dns)
+			}
+		})
+	}
+}
+
+func TestGenerateSPFCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		spf            *SPFRecord
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Valid SPF",
+			spf: &SPFRecord{
+				Record: "v=spf1 include:_spf.example.com -all",
+				Valid:  true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "Invalid SPF",
+			spf: &SPFRecord{
+				Record: "v=spf1 invalid syntax",
+				Valid:  false,
+				Error:  "SPF record appears malformed",
+			},
+			expectedStatus: api.CheckStatusWarn,
+			expectedScore:  0.5,
+		},
+		{
+			name: "No SPF record",
+			spf: &SPFRecord{
+				Valid: false,
+				Error: "No SPF record found",
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateSPFCheck(tt.spf)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Dns {
+				t.Errorf("Category = %v, want %v", check.Category, api.Dns)
+			}
+		})
+	}
+}
+
+func TestGenerateDKIMCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		dkim           *DKIMRecord
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Valid DKIM",
+			dkim: &DKIMRecord{
+				Selector: "default",
+				Domain:   "example.com",
+				Record:   "v=DKIM1; k=rsa; p=MIGfMA0...",
+				Valid:    true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "Invalid DKIM",
+			dkim: &DKIMRecord{
+				Selector: "default",
+				Domain:   "example.com",
+				Valid:    false,
+				Error:    "No DKIM record found",
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateDKIMCheck(tt.dkim)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Dns {
+				t.Errorf("Category = %v, want %v", check.Category, api.Dns)
+			}
+			if !strings.Contains(check.Name, tt.dkim.Selector) {
+				t.Errorf("Check name should contain selector %s", tt.dkim.Selector)
+			}
+		})
+	}
+}
+
+func TestGenerateDMARCCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		dmarc          *DMARCRecord
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Valid DMARC - reject",
+			dmarc: &DMARCRecord{
+				Record: "v=DMARC1; p=reject",
+				Policy: "reject",
+				Valid:  true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "Valid DMARC - quarantine",
+			dmarc: &DMARCRecord{
+				Record: "v=DMARC1; p=quarantine",
+				Policy: "quarantine",
+				Valid:  true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "Valid DMARC - none",
+			dmarc: &DMARCRecord{
+				Record: "v=DMARC1; p=none",
+				Policy: "none",
+				Valid:  true,
+			},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  1.0,
+		},
+		{
+			name: "No DMARC record",
+			dmarc: &DMARCRecord{
+				Valid: false,
+				Error: "No DMARC record found",
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := analyzer.generateDMARCCheck(tt.dmarc)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Dns {
+				t.Errorf("Category = %v, want %v", check.Category, api.Dns)
+			}
+
+			// Check that advice mentions policy for valid DMARC
+			if tt.dmarc.Valid && check.Advice != nil {
+				if tt.dmarc.Policy == "none" && !strings.Contains(*check.Advice, "none") {
+					t.Error("Advice should mention 'none' policy")
+				}
+			}
+		})
+	}
+}
+
+func TestGenerateDNSChecks(t *testing.T) {
+	tests := []struct {
+		name      string
+		results   *DNSResults
+		minChecks int
+	}{
+		{
+			name:      "Nil results",
+			results:   nil,
+			minChecks: 0,
+		},
+		{
+			name: "Complete results",
+			results: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Host: "mail.example.com", Priority: 10, Valid: true},
+				},
+				SPFRecord: &SPFRecord{
+					Record: "v=spf1 include:_spf.example.com -all",
+					Valid:  true,
+				},
+				DKIMRecords: []DKIMRecord{
+					{
+						Selector: "default",
+						Domain:   "example.com",
+						Valid:    true,
+					},
+				},
+				DMARCRecord: &DMARCRecord{
+					Record: "v=DMARC1; p=quarantine",
+					Policy: "quarantine",
+					Valid:  true,
+				},
+			},
+			minChecks: 4, // MX, SPF, DKIM, DMARC
+		},
+		{
+			name: "Partial results",
+			results: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Host: "mail.example.com", Priority: 10, Valid: true},
+				},
+			},
+			minChecks: 1, // Only MX
+		},
+	}
+
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			checks := analyzer.GenerateDNSChecks(tt.results)
+
+			if len(checks) < tt.minChecks {
+				t.Errorf("Got %d checks, want at least %d", len(checks), tt.minChecks)
+			}
+
+			// Verify all checks have the DNS category
+			for _, check := range checks {
+				if check.Category != api.Dns {
+					t.Errorf("Check %s has category %v, want %v", check.Name, check.Category, api.Dns)
+				}
+			}
+		})
+	}
+}
+
+func TestAnalyzeDNS_NoDomain(t *testing.T) {
+	analyzer := NewDNSAnalyzer(5 * time.Second)
+	email := &EmailMessage{
+		Header: make(mail.Header),
+		// No From address
+	}
+
+	results := analyzer.AnalyzeDNS(email, nil)
+
+	if results == nil {
+		t.Fatal("Expected results, got nil")
+	}
+
+	if len(results.Errors) == 0 {
+		t.Error("Expected error when no domain can be extracted")
+	}
+}

internal/analyzer/parser.go

@@ -211,27 +211,8 @@ func buildRawHeaders(header mail.Header) string {
 }
 
 // GetAuthenticationResults extracts Authentication-Results headers
-// If receiverHostname is provided, only returns headers that begin with that hostname
-func (e *EmailMessage) GetAuthenticationResults(receiverHostname string) []string {
-	allResults := e.Header[textproto.CanonicalMIMEHeaderKey("Authentication-Results")]
-
-	// If no hostname specified, return all results
-	if receiverHostname == "" {
-		return allResults
-	}
-
-	// Filter results that begin with the specified hostname
-	var filtered []string
-	prefix := receiverHostname + ";"
-	for _, result := range allResults {
-		// Trim whitespace and check if it starts with hostname;
-		trimmed := strings.TrimSpace(result)
-		if strings.HasPrefix(trimmed, prefix) {
-			filtered = append(filtered, result)
-		}
-	}
-
-	return filtered
+func (e *EmailMessage) GetAuthenticationResults() []string {
+	return e.Header[textproto.CanonicalMIMEHeaderKey("Authentication-Results")]
 }
 
 // GetSpamAssassinHeaders extracts SpamAssassin-related headers
@@ -249,33 +230,6 @@ func (e *EmailMessage) GetSpamAssassinHeaders() map[string]string {
 	}
 
 	for _, headerName := range saHeaders {
-		if values, ok := e.Header[headerName]; ok && len(values) > 0 {
-			for _, value := range values {
-				if strings.TrimSpace(value) != "" {
-					headers[headerName] = value
-					break
-				}
-			}
-		} else if value := e.Header.Get(headerName); value != "" {
-			headers[headerName] = value
-		}
-	}
-
-	return headers
-}
-
-// GetRspamdHeaders extracts rspamd-related headers
-func (e *EmailMessage) GetRspamdHeaders() map[string]string {
-	headers := make(map[string]string)
-
-	rspamdHeaders := []string{
-		"X-Spamd-Result",
-		"X-Rspamd-Score",
-		"X-Rspamd-Action",
-		"X-Rspamd-Server",
-	}
-
-	for _, headerName := range rspamdHeaders {
 		if value := e.Header.Get(headerName); value != "" {
 			headers[headerName] = value
 		}
@@ -321,20 +275,3 @@ func (e *EmailMessage) GetHeaderValue(key string) string {
 func (e *EmailMessage) HasHeader(key string) bool {
 	return e.Header.Get(key) != ""
 }
-
-// GetListUnsubscribeURLs parses the List-Unsubscribe header and returns all URLs.
-// The header format is: <url1>, <url2>, ...
-func (e *EmailMessage) GetListUnsubscribeURLs() []string {
-	value := e.Header.Get("List-Unsubscribe")
-	if value == "" {
-		return nil
-	}
-	var urls []string
-	for _, part := range strings.Split(value, ",") {
-		part = strings.TrimSpace(part)
-		if strings.HasPrefix(part, "<") && strings.HasSuffix(part, ">") {
-			urls = append(urls, part[1:len(part)-1])
-		}
-	}
-	return urls
-}

internal/analyzer/parser_test.go

@@ -120,7 +120,7 @@ Body content.
 		t.Fatalf("Failed to parse email: %v", err)
 	}
 
-	authResults := email.GetAuthenticationResults("example.com")
+	authResults := email.GetAuthenticationResults()
 	if len(authResults) != 2 {
 		t.Errorf("Expected 2 Authentication-Results headers, got: %d", len(authResults))
 	}

internal/analyzer/rbl.go

@@ -0,0 +1,408 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"regexp"
+	"strings"
+	"time"
+
+	"git.happydns.org/happyDeliver/internal/api"
+)
+
+// RBLChecker checks IP addresses against DNS-based blacklists
+type RBLChecker struct {
+	Timeout  time.Duration
+	RBLs     []string
+	resolver *net.Resolver
+}
+
+// DefaultRBLs is a list of commonly used RBL providers
+var DefaultRBLs = []string{
+	"zen.spamhaus.org",       // Spamhaus combined list
+	"bl.spamcop.net",         // SpamCop
+	"dnsbl.sorbs.net",        // SORBS
+	"b.barracudacentral.org", // Barracuda
+	"cbl.abuseat.org",        // CBL (Composite Blocking List)
+	"dnsbl-1.uceprotect.net", // UCEPROTECT Level 1
+}
+
+// NewRBLChecker creates a new RBL checker with configurable timeout and RBL list
+func NewRBLChecker(timeout time.Duration, rbls []string) *RBLChecker {
+	if timeout == 0 {
+		timeout = 5 * time.Second // Default timeout
+	}
+	if len(rbls) == 0 {
+		rbls = DefaultRBLs
+	}
+	return &RBLChecker{
+		Timeout: timeout,
+		RBLs:    rbls,
+		resolver: &net.Resolver{
+			PreferGo: true,
+		},
+	}
+}
+
+// RBLResults represents the results of RBL checks
+type RBLResults struct {
+	Checks      []RBLCheck
+	IPsChecked  []string
+	ListedCount int
+}
+
+// RBLCheck represents a single RBL check result
+type RBLCheck struct {
+	IP       string
+	RBL      string
+	Listed   bool
+	Response string
+	Error    string
+}
+
+// CheckEmail checks all IPs found in the email headers against RBLs
+func (r *RBLChecker) CheckEmail(email *EmailMessage) *RBLResults {
+	results := &RBLResults{}
+
+	// Extract IPs from Received headers
+	ips := r.extractIPs(email)
+	if len(ips) == 0 {
+		return results
+	}
+
+	results.IPsChecked = ips
+
+	// Check each IP against all RBLs
+	for _, ip := range ips {
+		for _, rbl := range r.RBLs {
+			check := r.checkIP(ip, rbl)
+			results.Checks = append(results.Checks, check)
+			if check.Listed {
+				results.ListedCount++
+			}
+		}
+	}
+
+	return results
+}
+
+// extractIPs extracts IP addresses from Received headers
+func (r *RBLChecker) extractIPs(email *EmailMessage) []string {
+	var ips []string
+	seenIPs := make(map[string]bool)
+
+	// Get all Received headers
+	receivedHeaders := email.Header["Received"]
+
+	// Regex patterns for IP addresses
+	// Match IPv4: xxx.xxx.xxx.xxx
+	ipv4Pattern := regexp.MustCompile(`\b(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b`)
+
+	// Look for IPs in Received headers
+	for _, received := range receivedHeaders {
+		// Find all IPv4 addresses
+		matches := ipv4Pattern.FindAllString(received, -1)
+		for _, match := range matches {
+			// Skip private/reserved IPs
+			if !r.isPublicIP(match) {
+				continue
+			}
+			// Avoid duplicates
+			if !seenIPs[match] {
+				ips = append(ips, match)
+				seenIPs[match] = true
+			}
+		}
+	}
+
+	// If no IPs found in Received headers, try X-Originating-IP
+	if len(ips) == 0 {
+		originatingIP := email.Header.Get("X-Originating-IP")
+		if originatingIP != "" {
+			// Extract IP from formats like "[192.0.2.1]" or "192.0.2.1"
+			cleanIP := strings.TrimSuffix(strings.TrimPrefix(originatingIP, "["), "]")
+			// Remove any whitespace
+			cleanIP = strings.TrimSpace(cleanIP)
+			matches := ipv4Pattern.FindString(cleanIP)
+			if matches != "" && r.isPublicIP(matches) {
+				ips = append(ips, matches)
+			}
+		}
+	}
+
+	return ips
+}
+
+// isPublicIP checks if an IP address is public (not private, loopback, or reserved)
+func (r *RBLChecker) isPublicIP(ipStr string) bool {
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		return false
+	}
+
+	// Check if it's a private network
+	if ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsLinkLocalMulticast() {
+		return false
+	}
+
+	// Additional checks for reserved ranges
+	// 0.0.0.0/8, 192.0.0.0/24, 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), 203.0.113.0/24 (TEST-NET-3)
+	if ip.IsUnspecified() {
+		return false
+	}
+
+	return true
+}
+
+// checkIP checks a single IP against a single RBL
+func (r *RBLChecker) checkIP(ip, rbl string) RBLCheck {
+	check := RBLCheck{
+		IP:  ip,
+		RBL: rbl,
+	}
+
+	// Reverse the IP for DNSBL query
+	reversedIP := r.reverseIP(ip)
+	if reversedIP == "" {
+		check.Error = "Failed to reverse IP address"
+		return check
+	}
+
+	// Construct DNSBL query: reversed-ip.rbl-domain
+	query := fmt.Sprintf("%s.%s", reversedIP, rbl)
+
+	// Perform DNS lookup with timeout
+	ctx, cancel := context.WithTimeout(context.Background(), r.Timeout)
+	defer cancel()
+
+	addrs, err := r.resolver.LookupHost(ctx, query)
+	if err != nil {
+		// Most likely not listed (NXDOMAIN)
+		if dnsErr, ok := err.(*net.DNSError); ok {
+			if dnsErr.IsNotFound {
+				check.Listed = false
+				return check
+			}
+		}
+		// Other DNS errors
+		check.Error = fmt.Sprintf("DNS lookup failed: %v", err)
+		return check
+	}
+
+	// If we got a response, the IP is listed
+	if len(addrs) > 0 {
+		check.Listed = true
+		check.Response = addrs[0] // Return code (e.g., 127.0.0.2)
+	}
+
+	return check
+}
+
+// reverseIP reverses an IPv4 address for DNSBL queries
+// Example: 192.0.2.1 -> 1.2.0.192
+func (r *RBLChecker) reverseIP(ipStr string) string {
+	ip := net.ParseIP(ipStr)
+	if ip == nil {
+		return ""
+	}
+
+	// Convert to IPv4
+	ipv4 := ip.To4()
+	if ipv4 == nil {
+		return "" // IPv6 not supported yet
+	}
+
+	// Reverse the octets
+	return fmt.Sprintf("%d.%d.%d.%d", ipv4[3], ipv4[2], ipv4[1], ipv4[0])
+}
+
+// GetBlacklistScore calculates the blacklist contribution to deliverability (0-2 points)
+// Scoring:
+// - Not listed on any RBL: 2 points (excellent)
+// - Listed on 1 RBL: 1 point (warning)
+// - Listed on 2-3 RBLs: 0.5 points (poor)
+// - Listed on 4+ RBLs: 0 points (critical)
+func (r *RBLChecker) GetBlacklistScore(results *RBLResults) float32 {
+	if results == nil || len(results.IPsChecked) == 0 {
+		// No IPs to check, give benefit of doubt
+		return 2.0
+	}
+
+	listedCount := results.ListedCount
+
+	if listedCount == 0 {
+		return 2.0
+	} else if listedCount == 1 {
+		return 1.0
+	} else if listedCount <= 3 {
+		return 0.5
+	}
+
+	return 0.0
+}
+
+// GenerateRBLChecks generates check results for RBL analysis
+func (r *RBLChecker) GenerateRBLChecks(results *RBLResults) []api.Check {
+	var checks []api.Check
+
+	if results == nil {
+		return checks
+	}
+
+	// If no IPs were checked, add a warning
+	if len(results.IPsChecked) == 0 {
+		checks = append(checks, api.Check{
+			Category: api.Blacklist,
+			Name:     "RBL Check",
+			Status:   api.CheckStatusWarn,
+			Score:    1.0,
+			Message:  "No public IP addresses found to check",
+			Severity: api.PtrTo(api.Low),
+			Advice:   api.PtrTo("Unable to extract sender IP from email headers"),
+		})
+		return checks
+	}
+
+	// Create a summary check
+	summaryCheck := r.generateSummaryCheck(results)
+	checks = append(checks, summaryCheck)
+
+	// Create individual checks for each listing
+	for _, check := range results.Checks {
+		if check.Listed {
+			detailCheck := r.generateListingCheck(&check)
+			checks = append(checks, detailCheck)
+		}
+	}
+
+	return checks
+}
+
+// generateSummaryCheck creates an overall RBL summary check
+func (r *RBLChecker) generateSummaryCheck(results *RBLResults) api.Check {
+	check := api.Check{
+		Category: api.Blacklist,
+		Name:     "RBL Summary",
+	}
+
+	score := r.GetBlacklistScore(results)
+	check.Score = score
+
+	totalChecks := len(results.Checks)
+	listedCount := results.ListedCount
+
+	if listedCount == 0 {
+		check.Status = api.CheckStatusPass
+		check.Message = fmt.Sprintf("Not listed on any blacklists (%d RBLs checked)", len(r.RBLs))
+		check.Severity = api.PtrTo(api.Info)
+		check.Advice = api.PtrTo("Your sending IP has a good reputation")
+	} else if listedCount == 1 {
+		check.Status = api.CheckStatusWarn
+		check.Message = fmt.Sprintf("Listed on 1 blacklist (out of %d checked)", totalChecks)
+		check.Severity = api.PtrTo(api.Medium)
+		check.Advice = api.PtrTo("You're listed on one blacklist. Review the specific listing and request delisting if appropriate")
+	} else if listedCount <= 3 {
+		check.Status = api.CheckStatusWarn
+		check.Message = fmt.Sprintf("Listed on %d blacklists (out of %d checked)", listedCount, totalChecks)
+		check.Severity = api.PtrTo(api.High)
+		check.Advice = api.PtrTo("Multiple blacklist listings detected. This will significantly impact deliverability. Review each listing and take corrective action")
+	} else {
+		check.Status = api.CheckStatusFail
+		check.Message = fmt.Sprintf("Listed on %d blacklists (out of %d checked)", listedCount, totalChecks)
+		check.Severity = api.PtrTo(api.Critical)
+		check.Advice = api.PtrTo("Your IP is listed on multiple blacklists. This will severely impact email deliverability. Investigate the cause and request delisting from each RBL")
+	}
+
+	// Add details about IPs checked
+	if len(results.IPsChecked) > 0 {
+		details := fmt.Sprintf("IPs checked: %s", strings.Join(results.IPsChecked, ", "))
+		check.Details = &details
+	}
+
+	return check
+}
+
+// generateListingCheck creates a check for a specific RBL listing
+func (r *RBLChecker) generateListingCheck(rblCheck *RBLCheck) api.Check {
+	check := api.Check{
+		Category: api.Blacklist,
+		Name:     fmt.Sprintf("RBL: %s", rblCheck.RBL),
+		Status:   api.CheckStatusFail,
+		Score:    0.0,
+	}
+
+	check.Message = fmt.Sprintf("IP %s is listed on %s", rblCheck.IP, rblCheck.RBL)
+
+	// Determine severity based on which RBL
+	if strings.Contains(rblCheck.RBL, "spamhaus") {
+		check.Severity = api.PtrTo(api.Critical)
+		advice := fmt.Sprintf("Listed on Spamhaus, a widely-used blocklist. Visit https://check.spamhaus.org/ to check details and request delisting")
+		check.Advice = &advice
+	} else if strings.Contains(rblCheck.RBL, "spamcop") {
+		check.Severity = api.PtrTo(api.High)
+		advice := fmt.Sprintf("Listed on SpamCop. Visit http://www.spamcop.net/bl.shtml to request delisting")
+		check.Advice = &advice
+	} else {
+		check.Severity = api.PtrTo(api.High)
+		advice := fmt.Sprintf("Listed on %s. Contact the RBL operator for delisting procedures", rblCheck.RBL)
+		check.Advice = &advice
+	}
+
+	// Add response code details
+	if rblCheck.Response != "" {
+		details := fmt.Sprintf("Response: %s", rblCheck.Response)
+		check.Details = &details
+	}
+
+	return check
+}
+
+// GetUniqueListedIPs returns a list of unique IPs that are listed on at least one RBL
+func (r *RBLChecker) GetUniqueListedIPs(results *RBLResults) []string {
+	seenIPs := make(map[string]bool)
+	var listedIPs []string
+
+	for _, check := range results.Checks {
+		if check.Listed && !seenIPs[check.IP] {
+			listedIPs = append(listedIPs, check.IP)
+			seenIPs[check.IP] = true
+		}
+	}
+
+	return listedIPs
+}
+
+// GetRBLsForIP returns all RBLs that list a specific IP
+func (r *RBLChecker) GetRBLsForIP(results *RBLResults, ip string) []string {
+	var rbls []string
+
+	for _, check := range results.Checks {
+		if check.IP == ip && check.Listed {
+			rbls = append(rbls, check.RBL)
+		}
+	}
+
+	return rbls
+}

internal/analyzer/rbl_test.go

@@ -23,10 +23,11 @@ package analyzer
 
 import (
 	"net/mail"
+	"strings"
 	"testing"
 	"time"
 
-	"git.happydns.org/happyDeliver/internal/model"
+	"git.happydns.org/happyDeliver/internal/api"
 )
 
 func TestNewRBLChecker(t *testing.T) {
@@ -55,12 +56,12 @@ func TestNewRBLChecker(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			checker := NewRBLChecker(tt.timeout, tt.rbls, false)
+			checker := NewRBLChecker(tt.timeout, tt.rbls)
 			if checker.Timeout != tt.expectedTimeout {
 				t.Errorf("Timeout = %v, want %v", checker.Timeout, tt.expectedTimeout)
 			}
-			if len(checker.Lists) != tt.expectedRBLs {
-				t.Errorf("RBLs count = %d, want %d", len(checker.Lists), tt.expectedRBLs)
+			if len(checker.RBLs) != tt.expectedRBLs {
+				t.Errorf("RBLs count = %d, want %d", len(checker.RBLs), tt.expectedRBLs)
 			}
 			if checker.resolver == nil {
 				t.Error("Resolver should not be nil")
@@ -97,7 +98,7 @@ func TestReverseIP(t *testing.T) {
 		},
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -157,7 +158,7 @@ func TestIsPublicIP(t *testing.T) {
 		},
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -237,7 +238,7 @@ func TestExtractIPs(t *testing.T) {
 		},*/
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -265,68 +266,68 @@ func TestExtractIPs(t *testing.T) {
 func TestGetBlacklistScore(t *testing.T) {
 	tests := []struct {
 		name          string
-		results       *DNSListResults
-		expectedScore int
+		results       *RBLResults
+		expectedScore float32
 	}{
 		{
 			name:          "Nil results",
 			results:       nil,
-			expectedScore: 100,
+			expectedScore: 2.0,
 		},
 		{
 			name: "No IPs checked",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked: []string{},
 			},
-			expectedScore: 100,
+			expectedScore: 2.0,
 		},
 		{
 			name: "Not listed on any RBL",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked:  []string{"198.51.100.1"},
 				ListedCount: 0,
 			},
-			expectedScore: 100,
+			expectedScore: 2.0,
 		},
 		{
 			name: "Listed on 1 RBL",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked:  []string{"198.51.100.1"},
 				ListedCount: 1,
 			},
-			expectedScore: 84, // 100 - 1*100/6 = 84 (integer division: 100/6=16)
+			expectedScore: 1.0,
 		},
 		{
 			name: "Listed on 2 RBLs",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked:  []string{"198.51.100.1"},
 				ListedCount: 2,
 			},
-			expectedScore: 67, // 100 - 2*100/6 = 67 (integer division: 200/6=33)
+			expectedScore: 0.5,
 		},
 		{
 			name: "Listed on 3 RBLs",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked:  []string{"198.51.100.1"},
 				ListedCount: 3,
 			},
-			expectedScore: 50, // 100 - 3*100/6 = 50 (integer division: 300/6=50)
+			expectedScore: 0.5,
 		},
 		{
 			name: "Listed on 4+ RBLs",
-			results: &DNSListResults{
+			results: &RBLResults{
 				IPsChecked:  []string{"198.51.100.1"},
 				ListedCount: 4,
 			},
-			expectedScore: 34, // 100 - 4*100/6 = 34 (integer division: 400/6=66)
+			expectedScore: 0.0,
 		},
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			score, _ := checker.CalculateScore(tt.results)
+			score := checker.GetBlacklistScore(tt.results)
 			if score != tt.expectedScore {
 				t.Errorf("GetBlacklistScore() = %v, want %v", score, tt.expectedScore)
 			}
@@ -334,24 +335,215 @@ func TestGetBlacklistScore(t *testing.T) {
 	}
 }
 
-func TestGetUniqueListedIPs(t *testing.T) {
-	results := &DNSListResults{
-		Checks: map[string][]model.BlacklistCheck{
-			"198.51.100.1": {
-				{Rbl: "zen.spamhaus.org", Listed: true},
-				{Rbl: "bl.spamcop.net", Listed: true},
+func TestGenerateSummaryCheck(t *testing.T) {
+	tests := []struct {
+		name           string
+		results        *RBLResults
+		expectedStatus api.CheckStatus
+		expectedScore  float32
+	}{
+		{
+			name: "Not listed",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 0,
+				Checks:      make([]RBLCheck, 6), // 6 default RBLs
 			},
-			"198.51.100.2": {
-				{Rbl: "zen.spamhaus.org", Listed: true},
-				{Rbl: "bl.spamcop.net", Listed: false},
+			expectedStatus: api.CheckStatusPass,
+			expectedScore:  2.0,
+		},
+		{
+			name: "Listed on 1 RBL",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 1,
+				Checks:      make([]RBLCheck, 6),
 			},
-			"198.51.100.3": {
-				{Rbl: "zen.spamhaus.org", Listed: false},
+			expectedStatus: api.CheckStatusWarn,
+			expectedScore:  1.0,
+		},
+		{
+			name: "Listed on 2 RBLs",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 2,
+				Checks:      make([]RBLCheck, 6),
 			},
+			expectedStatus: api.CheckStatusWarn,
+			expectedScore:  0.5,
+		},
+		{
+			name: "Listed on 4+ RBLs",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 4,
+				Checks:      make([]RBLCheck, 6),
+			},
+			expectedStatus: api.CheckStatusFail,
+			expectedScore:  0.0,
 		},
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := checker.generateSummaryCheck(tt.results)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Score != tt.expectedScore {
+				t.Errorf("Score = %v, want %v", check.Score, tt.expectedScore)
+			}
+			if check.Category != api.Blacklist {
+				t.Errorf("Category = %v, want %v", check.Category, api.Blacklist)
+			}
+		})
+	}
+}
+
+func TestGenerateListingCheck(t *testing.T) {
+	tests := []struct {
+		name             string
+		rblCheck         *RBLCheck
+		expectedStatus   api.CheckStatus
+		expectedSeverity api.CheckSeverity
+	}{
+		{
+			name: "Spamhaus listing",
+			rblCheck: &RBLCheck{
+				IP:       "198.51.100.1",
+				RBL:      "zen.spamhaus.org",
+				Listed:   true,
+				Response: "127.0.0.2",
+			},
+			expectedStatus:   api.CheckStatusFail,
+			expectedSeverity: api.Critical,
+		},
+		{
+			name: "SpamCop listing",
+			rblCheck: &RBLCheck{
+				IP:       "198.51.100.1",
+				RBL:      "bl.spamcop.net",
+				Listed:   true,
+				Response: "127.0.0.2",
+			},
+			expectedStatus:   api.CheckStatusFail,
+			expectedSeverity: api.High,
+		},
+		{
+			name: "Other RBL listing",
+			rblCheck: &RBLCheck{
+				IP:       "198.51.100.1",
+				RBL:      "dnsbl.sorbs.net",
+				Listed:   true,
+				Response: "127.0.0.2",
+			},
+			expectedStatus:   api.CheckStatusFail,
+			expectedSeverity: api.High,
+		},
+	}
+
+	checker := NewRBLChecker(5*time.Second, nil)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			check := checker.generateListingCheck(tt.rblCheck)
+
+			if check.Status != tt.expectedStatus {
+				t.Errorf("Status = %v, want %v", check.Status, tt.expectedStatus)
+			}
+			if check.Severity == nil || *check.Severity != tt.expectedSeverity {
+				t.Errorf("Severity = %v, want %v", check.Severity, tt.expectedSeverity)
+			}
+			if check.Category != api.Blacklist {
+				t.Errorf("Category = %v, want %v", check.Category, api.Blacklist)
+			}
+			if !strings.Contains(check.Name, tt.rblCheck.RBL) {
+				t.Errorf("Check name should contain RBL name %s", tt.rblCheck.RBL)
+			}
+		})
+	}
+}
+
+func TestGenerateRBLChecks(t *testing.T) {
+	tests := []struct {
+		name      string
+		results   *RBLResults
+		minChecks int
+	}{
+		{
+			name:      "Nil results",
+			results:   nil,
+			minChecks: 0,
+		},
+		{
+			name: "No IPs checked",
+			results: &RBLResults{
+				IPsChecked: []string{},
+			},
+			minChecks: 1, // Warning check
+		},
+		{
+			name: "Not listed on any RBL",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 0,
+				Checks: []RBLCheck{
+					{IP: "198.51.100.1", RBL: "zen.spamhaus.org", Listed: false},
+					{IP: "198.51.100.1", RBL: "bl.spamcop.net", Listed: false},
+				},
+			},
+			minChecks: 1, // Summary check only
+		},
+		{
+			name: "Listed on 2 RBLs",
+			results: &RBLResults{
+				IPsChecked:  []string{"198.51.100.1"},
+				ListedCount: 2,
+				Checks: []RBLCheck{
+					{IP: "198.51.100.1", RBL: "zen.spamhaus.org", Listed: true},
+					{IP: "198.51.100.1", RBL: "bl.spamcop.net", Listed: true},
+					{IP: "198.51.100.1", RBL: "dnsbl.sorbs.net", Listed: false},
+				},
+			},
+			minChecks: 3, // Summary + 2 listing checks
+		},
+	}
+
+	checker := NewRBLChecker(5*time.Second, nil)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			checks := checker.GenerateRBLChecks(tt.results)
+
+			if len(checks) < tt.minChecks {
+				t.Errorf("Got %d checks, want at least %d", len(checks), tt.minChecks)
+			}
+
+			// Verify all checks have the Blacklist category
+			for _, check := range checks {
+				if check.Category != api.Blacklist {
+					t.Errorf("Check %s has category %v, want %v", check.Name, check.Category, api.Blacklist)
+				}
+			}
+		})
+	}
+}
+
+func TestGetUniqueListedIPs(t *testing.T) {
+	results := &RBLResults{
+		Checks: []RBLCheck{
+			{IP: "198.51.100.1", RBL: "zen.spamhaus.org", Listed: true},
+			{IP: "198.51.100.1", RBL: "bl.spamcop.net", Listed: true},
+			{IP: "198.51.100.2", RBL: "zen.spamhaus.org", Listed: true},
+			{IP: "198.51.100.2", RBL: "bl.spamcop.net", Listed: false},
+			{IP: "198.51.100.3", RBL: "zen.spamhaus.org", Listed: false},
+		},
+	}
+
+	checker := NewRBLChecker(5*time.Second, nil)
 	listedIPs := checker.GetUniqueListedIPs(results)
 
 	expectedIPs := []string{"198.51.100.1", "198.51.100.2"}
@@ -363,20 +555,16 @@ func TestGetUniqueListedIPs(t *testing.T) {
 }
 
 func TestGetRBLsForIP(t *testing.T) {
-	results := &DNSListResults{
-		Checks: map[string][]model.BlacklistCheck{
-			"198.51.100.1": {
-				{Rbl: "zen.spamhaus.org", Listed: true},
-				{Rbl: "bl.spamcop.net", Listed: true},
-				{Rbl: "dnsbl.sorbs.net", Listed: false},
-			},
-			"198.51.100.2": {
-				{Rbl: "zen.spamhaus.org", Listed: true},
-			},
+	results := &RBLResults{
+		Checks: []RBLCheck{
+			{IP: "198.51.100.1", RBL: "zen.spamhaus.org", Listed: true},
+			{IP: "198.51.100.1", RBL: "bl.spamcop.net", Listed: true},
+			{IP: "198.51.100.1", RBL: "dnsbl.sorbs.net", Listed: false},
+			{IP: "198.51.100.2", RBL: "zen.spamhaus.org", Listed: true},
 		},
 	}
 
-	checker := NewRBLChecker(5*time.Second, nil, false)
+	checker := NewRBLChecker(5*time.Second, nil)
 
 	tests := []struct {
 		name         string
@@ -402,7 +590,7 @@ func TestGetRBLsForIP(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			rbls := checker.GetListsForIP(results, tt.ip)
+			rbls := checker.GetRBLsForIP(results, tt.ip)
 
 			if len(rbls) != len(tt.expectedRBLs) {
 				t.Errorf("Got %d RBLs, want %d", len(rbls), len(tt.expectedRBLs))

internal/analyzer/report.go

@@ -0,0 +1,348 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"time"
+
+	"git.happydns.org/happyDeliver/internal/api"
+	"github.com/google/uuid"
+)
+
+// ReportGenerator generates comprehensive deliverability reports
+type ReportGenerator struct {
+	authAnalyzer    *AuthenticationAnalyzer
+	spamAnalyzer    *SpamAssassinAnalyzer
+	dnsAnalyzer     *DNSAnalyzer
+	rblChecker      *RBLChecker
+	contentAnalyzer *ContentAnalyzer
+	scorer          *DeliverabilityScorer
+}
+
+// NewReportGenerator creates a new report generator
+func NewReportGenerator(
+	dnsTimeout time.Duration,
+	httpTimeout time.Duration,
+	rbls []string,
+) *ReportGenerator {
+	return &ReportGenerator{
+		authAnalyzer:    NewAuthenticationAnalyzer(),
+		spamAnalyzer:    NewSpamAssassinAnalyzer(),
+		dnsAnalyzer:     NewDNSAnalyzer(dnsTimeout),
+		rblChecker:      NewRBLChecker(dnsTimeout, rbls),
+		contentAnalyzer: NewContentAnalyzer(httpTimeout),
+		scorer:          NewDeliverabilityScorer(),
+	}
+}
+
+// AnalysisResults contains all intermediate analysis results
+type AnalysisResults struct {
+	Email          *EmailMessage
+	Authentication *api.AuthenticationResults
+	SpamAssassin   *SpamAssassinResult
+	DNS            *DNSResults
+	RBL            *RBLResults
+	Content        *ContentResults
+	Score          *ScoringResult
+}
+
+// AnalyzeEmail performs complete email analysis
+func (r *ReportGenerator) AnalyzeEmail(email *EmailMessage) *AnalysisResults {
+	results := &AnalysisResults{
+		Email: email,
+	}
+
+	// Run all analyzers
+	results.Authentication = r.authAnalyzer.AnalyzeAuthentication(email)
+	results.SpamAssassin = r.spamAnalyzer.AnalyzeSpamAssassin(email)
+	results.DNS = r.dnsAnalyzer.AnalyzeDNS(email, results.Authentication)
+	results.RBL = r.rblChecker.CheckEmail(email)
+	results.Content = r.contentAnalyzer.AnalyzeContent(email)
+
+	// Calculate overall score
+	results.Score = r.scorer.CalculateScore(
+		results.Authentication,
+		results.SpamAssassin,
+		results.RBL,
+		results.Content,
+		email,
+	)
+
+	return results
+}
+
+// GenerateReport creates a complete API report from analysis results
+func (r *ReportGenerator) GenerateReport(testID uuid.UUID, results *AnalysisResults) *api.Report {
+	reportID := uuid.New()
+	now := time.Now()
+
+	report := &api.Report{
+		Id:        reportID,
+		TestId:    testID,
+		Score:     results.Score.OverallScore,
+		CreatedAt: now,
+	}
+
+	// Build score summary
+	report.Summary = &api.ScoreSummary{
+		AuthenticationScore: results.Score.AuthScore,
+		SpamScore:           results.Score.SpamScore,
+		BlacklistScore:      results.Score.BlacklistScore,
+		ContentScore:        results.Score.ContentScore,
+		HeaderScore:         results.Score.HeaderScore,
+	}
+
+	// Collect all checks from different analyzers
+	checks := []api.Check{}
+
+	// Authentication checks
+	if results.Authentication != nil {
+		authChecks := r.authAnalyzer.GenerateAuthenticationChecks(results.Authentication)
+		checks = append(checks, authChecks...)
+	}
+
+	// DNS checks
+	if results.DNS != nil {
+		dnsChecks := r.dnsAnalyzer.GenerateDNSChecks(results.DNS)
+		checks = append(checks, dnsChecks...)
+	}
+
+	// RBL checks
+	if results.RBL != nil {
+		rblChecks := r.rblChecker.GenerateRBLChecks(results.RBL)
+		checks = append(checks, rblChecks...)
+	}
+
+	// SpamAssassin checks
+	if results.SpamAssassin != nil {
+		spamChecks := r.spamAnalyzer.GenerateSpamAssassinChecks(results.SpamAssassin)
+		checks = append(checks, spamChecks...)
+	}
+
+	// Content checks
+	if results.Content != nil {
+		contentChecks := r.contentAnalyzer.GenerateContentChecks(results.Content)
+		checks = append(checks, contentChecks...)
+	}
+
+	// Header checks
+	headerChecks := r.scorer.GenerateHeaderChecks(results.Email)
+	checks = append(checks, headerChecks...)
+
+	report.Checks = checks
+
+	// Add authentication results
+	report.Authentication = results.Authentication
+
+	// Add SpamAssassin result
+	if results.SpamAssassin != nil {
+		report.Spamassassin = &api.SpamAssassinResult{
+			Score:         float32(results.SpamAssassin.Score),
+			RequiredScore: float32(results.SpamAssassin.RequiredScore),
+			IsSpam:        results.SpamAssassin.IsSpam,
+		}
+
+		if len(results.SpamAssassin.Tests) > 0 {
+			report.Spamassassin.Tests = &results.SpamAssassin.Tests
+		}
+
+		if results.SpamAssassin.RawReport != "" {
+			report.Spamassassin.Report = &results.SpamAssassin.RawReport
+		}
+	}
+
+	// Add DNS records
+	if results.DNS != nil {
+		dnsRecords := r.buildDNSRecords(results.DNS)
+		if len(dnsRecords) > 0 {
+			report.DnsRecords = &dnsRecords
+		}
+	}
+
+	// Add blacklist checks
+	if results.RBL != nil && len(results.RBL.Checks) > 0 {
+		blacklistChecks := make([]api.BlacklistCheck, 0, len(results.RBL.Checks))
+		for _, check := range results.RBL.Checks {
+			blCheck := api.BlacklistCheck{
+				Ip:     check.IP,
+				Rbl:    check.RBL,
+				Listed: check.Listed,
+			}
+			if check.Response != "" {
+				blCheck.Response = &check.Response
+			}
+			blacklistChecks = append(blacklistChecks, blCheck)
+		}
+		report.Blacklists = &blacklistChecks
+	}
+
+	// Add raw headers
+	if results.Email != nil && results.Email.RawHeaders != "" {
+		report.RawHeaders = &results.Email.RawHeaders
+	}
+
+	return report
+}
+
+// buildDNSRecords converts DNS analysis results to API DNS records
+func (r *ReportGenerator) buildDNSRecords(dns *DNSResults) []api.DNSRecord {
+	records := []api.DNSRecord{}
+
+	if dns == nil {
+		return records
+	}
+
+	// MX records
+	if len(dns.MXRecords) > 0 {
+		for _, mx := range dns.MXRecords {
+			status := api.Found
+			if !mx.Valid {
+				if mx.Error != "" {
+					status = api.Missing
+				} else {
+					status = api.Invalid
+				}
+			}
+
+			record := api.DNSRecord{
+				Domain:     dns.Domain,
+				RecordType: api.MX,
+				Status:     status,
+			}
+
+			if mx.Host != "" {
+				value := mx.Host
+				record.Value = &value
+			}
+
+			records = append(records, record)
+		}
+	}
+
+	// SPF record
+	if dns.SPFRecord != nil {
+		status := api.Found
+		if !dns.SPFRecord.Valid {
+			if dns.SPFRecord.Record == "" {
+				status = api.Missing
+			} else {
+				status = api.Invalid
+			}
+		}
+
+		record := api.DNSRecord{
+			Domain:     dns.Domain,
+			RecordType: api.SPF,
+			Status:     status,
+		}
+
+		if dns.SPFRecord.Record != "" {
+			record.Value = &dns.SPFRecord.Record
+		}
+
+		records = append(records, record)
+	}
+
+	// DKIM records
+	for _, dkim := range dns.DKIMRecords {
+		status := api.Found
+		if !dkim.Valid {
+			if dkim.Record == "" {
+				status = api.Missing
+			} else {
+				status = api.Invalid
+			}
+		}
+
+		record := api.DNSRecord{
+			Domain:     dkim.Domain,
+			RecordType: api.DKIM,
+			Status:     status,
+		}
+
+		if dkim.Record != "" {
+			// Include selector in value for clarity
+			value := dkim.Record
+			record.Value = &value
+		}
+
+		records = append(records, record)
+	}
+
+	// DMARC record
+	if dns.DMARCRecord != nil {
+		status := api.Found
+		if !dns.DMARCRecord.Valid {
+			if dns.DMARCRecord.Record == "" {
+				status = api.Missing
+			} else {
+				status = api.Invalid
+			}
+		}
+
+		record := api.DNSRecord{
+			Domain:     dns.Domain,
+			RecordType: api.DMARC,
+			Status:     status,
+		}
+
+		if dns.DMARCRecord.Record != "" {
+			record.Value = &dns.DMARCRecord.Record
+		}
+
+		records = append(records, record)
+	}
+
+	return records
+}
+
+// GenerateRawEmail returns the raw email message as a string
+func (r *ReportGenerator) GenerateRawEmail(email *EmailMessage) string {
+	if email == nil {
+		return ""
+	}
+
+	raw := email.RawHeaders
+	if email.RawBody != "" {
+		raw += "\n" + email.RawBody
+	}
+
+	return raw
+}
+
+// GetRecommendations returns actionable recommendations based on the score
+func (r *ReportGenerator) GetRecommendations(results *AnalysisResults) []string {
+	if results == nil || results.Score == nil {
+		return []string{}
+	}
+
+	return results.Score.Recommendations
+}
+
+// GetScoreSummaryText returns a human-readable score summary
+func (r *ReportGenerator) GetScoreSummaryText(results *AnalysisResults) string {
+	if results == nil || results.Score == nil {
+		return ""
+	}
+
+	return r.scorer.GetScoreSummary(results.Score)
+}

internal/analyzer/report_test.go

@@ -0,0 +1,501 @@
+// This file is part of the happyDeliver (R) project.
+// Copyright (c) 2025 happyDomain
+// Authors: Pierre-Olivier Mercier, et al.
+//
+// This program is offered under a commercial and under the AGPL license.
+// For commercial licensing, contact us at <contact@happydomain.org>.
+//
+// For AGPL licensing:
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+package analyzer
+
+import (
+	"net/mail"
+	"net/textproto"
+	"strings"
+	"testing"
+	"time"
+
+	"git.happydns.org/happyDeliver/internal/api"
+	"github.com/google/uuid"
+)
+
+func TestNewReportGenerator(t *testing.T) {
+	gen := NewReportGenerator(10*time.Second, 10*time.Second, DefaultRBLs)
+	if gen == nil {
+		t.Fatal("Expected report generator, got nil")
+	}
+
+	if gen.authAnalyzer == nil {
+		t.Error("authAnalyzer should not be nil")
+	}
+	if gen.spamAnalyzer == nil {
+		t.Error("spamAnalyzer should not be nil")
+	}
+	if gen.dnsAnalyzer == nil {
+		t.Error("dnsAnalyzer should not be nil")
+	}
+	if gen.rblChecker == nil {
+		t.Error("rblChecker should not be nil")
+	}
+	if gen.contentAnalyzer == nil {
+		t.Error("contentAnalyzer should not be nil")
+	}
+	if gen.scorer == nil {
+		t.Error("scorer should not be nil")
+	}
+}
+
+func TestAnalyzeEmail(t *testing.T) {
+	gen := NewReportGenerator(10*time.Second, 10*time.Second, DefaultRBLs)
+
+	email := createTestEmail()
+
+	results := gen.AnalyzeEmail(email)
+
+	if results == nil {
+		t.Fatal("Expected analysis results, got nil")
+	}
+
+	if results.Email == nil {
+		t.Error("Email should not be nil")
+	}
+
+	if results.Authentication == nil {
+		t.Error("Authentication should not be nil")
+	}
+
+	// SpamAssassin might be nil if headers don't exist
+	// DNS results should exist
+	// RBL results should exist
+	// Content results should exist
+
+	if results.Score == nil {
+		t.Error("Score should not be nil")
+	}
+
+	// Verify score is within bounds
+	if results.Score.OverallScore < 0 || results.Score.OverallScore > 10 {
+		t.Errorf("Overall score %v is out of bounds", results.Score.OverallScore)
+	}
+}
+
+func TestGenerateReport(t *testing.T) {
+	gen := NewReportGenerator(10*time.Second, 10*time.Second, DefaultRBLs)
+	testID := uuid.New()
+
+	email := createTestEmail()
+	results := gen.AnalyzeEmail(email)
+
+	report := gen.GenerateReport(testID, results)
+
+	if report == nil {
+		t.Fatal("Expected report, got nil")
+	}
+
+	// Verify required fields
+	if report.Id == uuid.Nil {
+		t.Error("Report ID should not be empty")
+	}
+
+	if report.TestId != testID {
+		t.Errorf("TestId = %s, want %s", report.TestId, testID)
+	}
+
+	if report.Score < 0 || report.Score > 10 {
+		t.Errorf("Score %v is out of bounds", report.Score)
+	}
+
+	if report.Summary == nil {
+		t.Error("Summary should not be nil")
+	}
+
+	if len(report.Checks) == 0 {
+		t.Error("Checks should not be empty")
+	}
+
+	// Verify score summary
+	if report.Summary != nil {
+		if report.Summary.AuthenticationScore < 0 || report.Summary.AuthenticationScore > 3 {
+			t.Errorf("AuthenticationScore %v is out of bounds", report.Summary.AuthenticationScore)
+		}
+		if report.Summary.SpamScore < 0 || report.Summary.SpamScore > 2 {
+			t.Errorf("SpamScore %v is out of bounds", report.Summary.SpamScore)
+		}
+		if report.Summary.BlacklistScore < 0 || report.Summary.BlacklistScore > 2 {
+			t.Errorf("BlacklistScore %v is out of bounds", report.Summary.BlacklistScore)
+		}
+		if report.Summary.ContentScore < 0 || report.Summary.ContentScore > 2 {
+			t.Errorf("ContentScore %v is out of bounds", report.Summary.ContentScore)
+		}
+		if report.Summary.HeaderScore < 0 || report.Summary.HeaderScore > 1 {
+			t.Errorf("HeaderScore %v is out of bounds", report.Summary.HeaderScore)
+		}
+	}
+
+	// Verify checks have required fields
+	for i, check := range report.Checks {
+		if string(check.Category) == "" {
+			t.Errorf("Check %d: Category should not be empty", i)
+		}
+		if check.Name == "" {
+			t.Errorf("Check %d: Name should not be empty", i)
+		}
+		if string(check.Status) == "" {
+			t.Errorf("Check %d: Status should not be empty", i)
+		}
+		if check.Message == "" {
+			t.Errorf("Check %d: Message should not be empty", i)
+		}
+	}
+}
+
+func TestGenerateReportWithSpamAssassin(t *testing.T) {
+	gen := NewReportGenerator(10*time.Second, 10*time.Second, DefaultRBLs)
+	testID := uuid.New()
+
+	email := createTestEmailWithSpamAssassin()
+	results := gen.AnalyzeEmail(email)
+
+	report := gen.GenerateReport(testID, results)
+
+	if report.Spamassassin == nil {
+		t.Error("SpamAssassin result should not be nil")
+	}
+
+	if report.Spamassassin != nil {
+		if report.Spamassassin.Score == 0 && report.Spamassassin.RequiredScore == 0 {
+			t.Error("SpamAssassin scores should be set")
+		}
+	}
+}
+
+func TestBuildDNSRecords(t *testing.T) {
+	gen := NewReportGenerator(10*time.Second, 10*time.Second, DefaultRBLs)
+
+	tests := []struct {
+		name          string
+		dns           *DNSResults
+		expectedCount int
+		expectTypes   []api.DNSRecordRecordType
+	}{
+		{
+			name:          "Nil DNS results",
+			dns:           nil,
+			expectedCount: 0,
+		},
+		{
+			name: "Complete DNS results",
+			dns: &DNSResults{
+				Domain: "example.com",
+				MXRecords: []MXRecord{
+					{Host: "mail.example.com", Priority: 10, Valid: true},
+				},
+				SPFRecord: &SPFRecord{
+					Record: "v=spf1 include:_spf.example.com -all",
+					Valid:  true,
+				},
+				DKIMRecords: []DKIMRecord{
+					{
+						Selector: "default",
+						Domain:   "example.com",
+						Record:   "v=DKIM1; k=rsa; p=...",
+						Valid:    true,
+					},
+				},
+				DMARCRecord: &DMARCRecord{
+					Record: "v=DMARC1; p=quarantine",
+					Valid:  true,
+				},
+			},
+			expectedCount: 4, // MX, SPF, DKIM, DMARC
+			expectTypes:   []api.DNSRecordRecordType{api.MX, api.SPF, api.DKIM, api.DMARC},
+		},
+		{
+			name: "Missing records",
+			dns: &DNSResults{
+				Domain: "example.com",
+				SPFRecord: &SPFRecord{
+					Valid: false,
+					Error: "No SPF record found",
+				},
+			},
+			expectedCount: 1,
+			expectTypes:   []api.DNSRecordRecordType{api.SPF},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			records := gen.buildDNSRecords(tt.dns)
+
+			if len(records) != tt.expectedCount {
+				t.Errorf("Got %d DNS records, want %d", len(records), tt.expectedCount)
+			}
+
+			// Verify expected types are present
+			if tt.expectTypes != nil {
+				foundTypes := make(map[api.DNSRecordRecordType]bool)
+				for _, record := range records {
+					foundTypes[record.RecordType] = true
+				}
+
+				for _, expectedType := range tt.expectTypes {
+					if !foundType