update

internal/db/models.go

@@ -144,6 +144,7 @@ type MailboxEntry struct {
 	SizeBytes    int64
 	ReceivedAt   time.Time
 	InternalDate time.Time
+	HeaderEnc    []byte // encrypted CachedHeader JSON; nil for pre-migration rows
 }
 
 // ── Outbound queue ───────────────────────────────────────────────────────────
@@ -342,6 +343,20 @@ type TLSCert struct {
 	UpdatedAt         time.Time
 }
 
+// MTASTSPolicy is a cached RFC 8461 policy for a recipient domain, keyed by
+// domain — not encrypted, a domain's published mail policy is public data
+// (same trust level as its SPF/DMARC/MX records).
+type MTASTSPolicy struct {
+	ID         string
+	Domain     string
+	PolicyID   string
+	Mode       string
+	MXPatterns string // JSON array
+	MaxAge     int    // seconds
+	FetchedAt  time.Time
+	ExpiresAt  time.Time
+}
+
 // ── MFA ───────────────────────────────────────────────────────────────────────
 
 type MFABackupCode struct {