v5.0.0

5.0.0 (2026-08-06)

⚠ BREAKING CHANGES

• Node.js 20 is no longer supported, the minimum is now 22.19.0 (the engine floor of undici 8).
• dmarc: adkim=s and aspf=s now actually fail when only the organizational domains match. Previously strict alignment fell through to the relaxed comparison, so these records behaved as adkim=r/aspf=r and such messages passed. Senders that publish strict alignment but sign or send from a different host under the same organizational domain will flip from pass to fail. dmarc.status.header.from now reports the From domain rather than the organizational domain, dmarc.status.header.d reports the domain the record was found at, and dkim.results[].status.aligned is false for org-level-only matches when the domain publishes adkim=s.

Features

• add seal-only mode to the seal CLI command (#119) (afdfc3d)

Bug Fixes

• arc: report public key failures instead of a bare arc=fail (3464be7)
• cli: validate seal-only options and dedupe the seal command paths (17dd59c)
• close residual parser and DMARC discovery edge cases (f1c28e1)
• dmarc: normalize tag values and report the correct identifiers (e5dc758)
• enforce DMARC strict identifier alignment (adkim=s/aspf=s) (0c4bab7)
• harden tag and header parsers against crafted property keys (7eb9ea2)
• require Node.js >= 22.19.0 (1c689c5)
• tools: do not treat a legacy getAlignment options object as strict (2007ab4)