update

internal/db/migrations.go

@@ -368,6 +368,42 @@ CREATE TABLE mfa_backup_codes (
 CREATE INDEX idx_mfa_backup_codes_user ON mfa_backup_codes(user_id);
 
 ALTER TABLE users ADD COLUMN recovery_email TEXT;
+`,
+		},
+	},
+	{
+		// Encrypted header summary (From/To/Subject/Date), populated at
+		// delivery time so folder listing can decrypt a few hundred bytes
+		// instead of the full message body. NULL for messages delivered
+		// before this migration — ListMessages falls back to a full read
+		// for those, see accounts.GoMailProvider.ListMessages.
+		name: "0012_mailbox_header_cache",
+		sql: map[string]string{
+			"sqlite": `
+ALTER TABLE mailbox_index ADD COLUMN header_enc BLOB;
+`,
+		},
+	},
+	{
+		// Cached MTA-STS policy per recipient domain (RFC 8461) — not
+		// encrypted, a domain's mail policy is public data at the same
+		// trust level as its SPF/DMARC/MX records, none of which are
+		// encrypted either. Cached because the RFC requires honoring the
+		// policy's own max_age rather than re-fetching on every message.
+		name: "0013_mta_sts_policies",
+		sql: map[string]string{
+			"sqlite": `
+CREATE TABLE mta_sts_policies (
+	id TEXT PRIMARY KEY,
+	domain TEXT UNIQUE NOT NULL,
+	policy_id TEXT NOT NULL,
+	mode TEXT NOT NULL,
+	mx_patterns TEXT NOT NULL,
+	max_age INTEGER NOT NULL,
+	fetched_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+	expires_at DATETIME NOT NULL
+);
+CREATE INDEX idx_mta_sts_policies_domain ON mta_sts_policies(domain);
 `,
 		},
 	},