feat: extract sender domains and auth verdicts

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KphFXTc2QajxXsHWyvGJ4R

1 files changed, 32 insertions, 0 deletions

diff --git a/tests/test_parse.py b/tests/test_parse.py
index 92095fd..1083f1d 100644
--- a/tests/test_parse.py
+++ b/tests/test_parse.py
@@ -64,5 +64,37 @@ class TestReceivedChain(unittest.TestCase):
         self.assertIsNone(ip)
 
 
+class TestSenderDomains(unittest.TestCase):
+    def test_the_three_sender_headers_are_collected(self):
+        domains = parse.sender_domains(load("simple.eml"))
+        self.assertEqual(
+            domains,
+            {
+                "return_path": "sender.example.invalid",
+                "from": "bank.example.invalid",
+                "reply_to": "drop.example.invalid",
+            },
+        )
+
+    def test_reply_to_is_absent_when_it_matches_from(self):
+        # Only a DIFFERING Reply-To is an indicator; repeating From adds noise.
+        domains = parse.sender_domains(load("with-attachment.eml"))
+        self.assertNotIn("reply_to", domains)
+
+    def test_recipient_headers_are_never_returned(self):
+        # The safety property, asserted rather than assumed.
+        domains = parse.sender_domains(load("simple.eml"))
+        self.assertNotIn("example.org", domains.values())
+
+
+class TestAuthResults(unittest.TestCase):
+    def test_verdicts_are_read_as_the_server_recorded_them(self):
+        auth = parse.auth_results(load("simple.eml"))
+        self.assertEqual(auth, {"spf": "fail", "dkim": "none", "dmarc": "fail"})
+
+    def test_a_message_with_no_auth_header_reports_nothing(self):
+        self.assertEqual(parse.auth_results(load("with-attachment.eml")), {})
+
+
 if __name__ == "__main__":
     unittest.main()