[kerdofficial]

What changed

When trusted authserv-ids are configured, which the Cloudflare puller does with mx.cloudflare.net, Inbot now evaluates only the topmost Authentication-Results header carrying a trusted id. Headers below it are ignored, even when they claim the same id and report pass. A malformed top trusted header now fails closed instead of being skipped.

Why

Before this change, a passing trusted-id header anywhere in the message was enough to skip the unauthenticated label. A sender could add such a header lower in the header block. This narrows the boundary but does not remove it: the label is still only as trustworthy as the receiver. If Cloudflare does not prepend its own header, or does not strip a sender-supplied header with its id, a forged header at the top still counts. Whether Cloudflare strips such headers is unknown.

Checklist

• The PR title follows conventional commits
• The PR does one thing
• pnpm check passes locally
• Every affected surface is covered (service, docs)

Proof: new inbound tests parse synthetic raw messages and assert both header wire order and the resulting label. A forged lower pass under a failing top header stays unauthenticated. The inbound suite passed (79 tests).