4 files changed, 81 insertions, 0 deletions
diff --git a/tests/fixtures/forged-chain.eml b/tests/fixtures/forged-chain.eml
new file mode 100644
index 0000000..bfd0cb5
--- /dev/null
+++ b/tests/fixtures/forged-chain.eml
@@ -0,0 +1,20 @@
+Received: from mx.example.org (mx.example.org [192.0.2.11])
+	by mail.example.org (Postfix) with ESMTP id CCC33
+	for <you@example.org>; Tue, 8 Sep 2026 11:00:02 +0200 (CEST)
+Received: from evil.example.invalid (evil.example.invalid [203.0.113.99])
+	by mx.example.org (Postfix) with ESMTP id DDD44
+	for <you@example.org>; Tue, 8 Sep 2026 11:00:01 +0200 (CEST)
+Received: from innocent.example.invalid (innocent.example.invalid [198.51.100.7])
+	by evil.example.invalid (Postfix) with ESMTP id EEE55; Tue, 8 Sep 2026 10:59:00 +0200 (CEST)
+Received: from also-forged.example.invalid (also-forged.example.invalid [198.51.100.8])
+	by innocent.example.invalid (Postfix) with ESMTP id FFF66; Tue, 8 Sep 2026 10:58:00 +0200 (CEST)
+Return-Path: <bounce@evil.example.invalid>
+From: "Support" <help@evil.example.invalid>
+To: <you@example.org>
+Subject: Action required
+Message-ID: <bbb222@evil.example.invalid>
+Date: Tue, 8 Sep 2026 10:58:00 +0200
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+
+Visit http://evil.example.invalid/go?u=dGVzdEBleGFtcGxlLm9yZw to continue.
diff --git a/tests/fixtures/redirector.eml b/tests/fixtures/redirector.eml
new file mode 100644
index 0000000..9bff168
--- /dev/null
+++ b/tests/fixtures/redirector.eml
@@ -0,0 +1,13 @@
+Received: from sender.example.invalid (sender.example.invalid [203.0.113.42])
+	by mail.example.org (Postfix) with ESMTP id HHH88
+	for <you@example.org>; Tue, 8 Sep 2026 14:00:00 +0200 (CEST)
+Return-Path: <bounce@sender.example.invalid>
+From: "Delivery" <notice@sender.example.invalid>
+To: <you@example.org>
+Subject: Your parcel
+Message-ID: <ddd444@sender.example.invalid>
+Date: Tue, 8 Sep 2026 14:00:00 +0200
+MIME-Version: 1.0
+Content-Type: text/plain; charset=utf-8
+
+Track it: http://t.example.invalid/c?url=http%3A%2F%2Fevil.example.invalid%2Fpay%3Fref%3D99&u=dGVzdEBleGFtcGxlLm9yZw
diff --git a/tests/fixtures/simple.eml b/tests/fixtures/simple.eml
new file mode 100644
index 0000000..089510b
--- /dev/null
+++ b/tests/fixtures/simple.eml
@@ -0,0 +1,23 @@
+Received: from mx.example.org (mx.example.org [192.0.2.11])
+	by mail.example.org (Postfix) with ESMTP id AAA11
+	for <you@example.org>; Tue, 8 Sep 2026 10:15:02 +0200 (CEST)
+Received: from sender.example.invalid (sender.example.invalid [203.0.113.42])
+	by mx.example.org (Postfix) with ESMTP id BBB22
+	for <you@example.org>; Tue, 8 Sep 2026 10:15:01 +0200 (CEST)
+Authentication-Results: mx.example.org;
+	spf=fail smtp.mailfrom=sender.example.invalid;
+	dkim=none;
+	dmarc=fail header.from=bank.example.invalid
+Return-Path: <bounce@sender.example.invalid>
+From: "Your Bank" <security@bank.example.invalid>
+Reply-To: <collect@drop.example.invalid>
+To: <you@example.org>
+Subject: Verify your account
+Message-ID: <aaa111@sender.example.invalid>
+Date: Tue, 8 Sep 2026 10:15:00 +0200
+MIME-Version: 1.0
+Content-Type: text/html; charset=utf-8
+
+<html><body>
+<p>Please <a href="http://login.bank-verify.example.invalid/verify?id=dGVzdEBleGFtcGxlLm9yZw">confirm</a>.</p>
+</body></html>
diff --git a/tests/fixtures/with-attachment.eml b/tests/fixtures/with-attachment.eml
new file mode 100644
index 0000000..7b1aedc
--- /dev/null
+++ b/tests/fixtures/with-attachment.eml
@@ -0,0 +1,25 @@
+Received: from sender.example.invalid (sender.example.invalid [203.0.113.42])
+	by mail.example.org (Postfix) with ESMTP id GGG77
+	for <you@example.org>; Tue, 8 Sep 2026 12:00:00 +0200 (CEST)
+Return-Path: <bounce@sender.example.invalid>
+From: "Accounts" <billing@sender.example.invalid>
+To: <you@example.org>
+Subject: Invoice attached
+Message-ID: <ccc333@sender.example.invalid>
+Date: Tue, 8 Sep 2026 12:00:00 +0200
+MIME-Version: 1.0
+Content-Type: multipart/mixed; boundary="BOUND1"
+
+--BOUND1
+Content-Type: text/plain; charset=utf-8
+
+See the attached invoice.
+
+--BOUND1
+Content-Type: application/pdf; name="invoice.pdf"
+Content-Disposition: attachment; filename="invoice.pdf"
+Content-Transfer-Encoding: base64
+
+SGVsbG8sIHdvcmxkIQ==
+
+--BOUND1--