A message's sender facts for SI identity checks; SI_AUTH_REQUEST belongs to no app

Shipped: October 26, 2026 at 7:16 PM UTC
Author: Kamo
Commit: 5cd632f

The provenance answer now also says what the message itself claims about its sender: From, Reply-To, the server that handed it to ours, and the SPF/DKIM/DMARC results recorded in its headers (header-only read, nothing marked). SI_AUTH_REQUEST is ungated: anyone may be asked by an SI to confirm a request was really them.

All changes

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.

Start Free Forever View Pricing