From d7ecd7a6e2a509a4ead307dd73d9aa9e566d1187 Mon Sep 17 00:00:00 2001
From: James <james@jongsma.me>
Date: Wed, 25 Feb 2026 02:00:01 +0100
Subject: [PATCH] auto: daily config snapshot

---
 stalwart_config.toml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/stalwart_config.toml b/stalwart_config.toml
index f33ff84..3426fc3 100644
--- a/stalwart_config.toml
+++ b/stalwart_config.toml
@@ -83,7 +83,7 @@ default = true
 "47.197.93.62" = true
 
 [spam-filter.score]
-spam = 5.0
+spam = 8.0
 discard = 0
 reject = 0
 
@@ -121,3 +121,21 @@ scope = "ip"
 lookup = "b.barracudacentral.org"
 tag = "RBL_BARRACUDA"
 score = 5.0
+
+
+# Trusted senders — bypass Bayes spam scoring (TRUSTED_DOMAIN = -7.0)
+# Added 2026-02-24: squareup.com (Health Link invoices via Square/Amazon SES)
+[lookup.trusted-domains]
+"squareup.com" = ""
+"messaging.squareup.com" = ""
+"amazonses.com" = ""
+
+[spam-filter.bayes]
+enable = false
+enable = false
+
+# DMARC+DKIM pass = guaranteed inbox — score so low it can never be stamped as spam
+# Replaces defaults: DMARC_POLICY_ALLOW=-0.5, DKIM_ALLOW=-0.2
+[spam-filter.list.scores]
+DMARC_POLICY_ALLOW = -100.0
+DKIM_ALLOW = -50.0