added IMAP, LetsEncrypt, update layout

internal/mailstore/spam.go

@@ -0,0 +1,58 @@
+package mailstore
+
+import (
+	"context"
+	"net"
+	"strings"
+)
+
+// spamKeywords is a tiny, obvious-spam subject keyword list — a coarse signal only.
+var spamKeywords = []string{"viagra", "casino", "lottery winner", "click here now", "wire transfer urgent", "nigerian prince"}
+
+// SpamScore is a lightweight built-in heuristic — always runs, regardless of whether
+// rspamd (rspamd.go) is also enabled; both are additive, not either/or. Higher is more
+// suspicious; compare against [Mailstore] spam_reject_score.
+// ponytail: naive keyword/weight heuristic, not a real Bayesian/ML scorer — upgrade or
+// lean harder on rspamd if false-positive rate matters.
+func SpamScore(peerIP string, headers map[string]string, dkimPass, spfPass bool) int {
+	score := 0
+	if !spfPass {
+		score += 2
+	}
+	if !dkimPass {
+		score++
+	}
+	if CheckDNSBL(peerIP) {
+		score += 5
+	}
+	subject := strings.ToLower(headers["subject"])
+	for _, kw := range spamKeywords {
+		if strings.Contains(subject, kw) {
+			score++
+		}
+	}
+	return score
+}
+
+// CheckDNSBL looks up peerIP against the Spamhaus ZEN DNSBL. Per RFC 5782, a listing
+// response is always an A record in 127.0.0.0/8 — checking for that range (rather than
+// "any resolution succeeded") avoids false positives from a resolver that hijacks
+// NXDOMAIN into a search/ad page instead of returning an error.
+func CheckDNSBL(peerIP string) bool {
+	ip := net.ParseIP(peerIP)
+	if ip == nil || ip.To4() == nil {
+		return false
+	}
+	octets := strings.Split(ip.To4().String(), ".")
+	reversed := octets[3] + "." + octets[2] + "." + octets[1] + "." + octets[0]
+	addrs, err := net.DefaultResolver.LookupHost(context.Background(), reversed+".zen.spamhaus.org")
+	if err != nil {
+		return false
+	}
+	for _, a := range addrs {
+		if resolved := net.ParseIP(a); resolved != nil && resolved.To4() != nil && resolved.To4()[0] == 127 {
+			return true
+		}
+	}
+	return false
+}