Merge branch 'feature/mail-deliverability'

README.md

@@ -200,7 +200,10 @@ headers, Host rewrite, HTTPS to the backend, certificate status per port.
 **Alerts**
 - Email or webhook (JSON, Slack, Discord, ntfy) when an edge or site goes quiet, a port can't bind, a
   target fails its health check, a certificate errors, or a mail relay isn't deliverable (reverse DNS,
-  HELO, port 25, DKIM record missing).
+  HELO, port 25, DKIM record missing), a sending domain's SPF doesn't authorize the relay or its
+  DMARC record is missing, the relay's IP lands on a DNS blocklist, too much of its mail is being
+  refused, or too little of the mail it sends passes DMARC in the reports you upload. Each alert says
+  what to change.
 - A problem must last the **debounce time** (default 2 minutes, per organization) before you hear about
   it, so restarts and blips stay quiet. One message when it starts, one when it clears, optional
   reminders. Active alerts are stored, so restarting Hammerhead doesn't repeat them, and an alert is
@@ -227,6 +230,20 @@ headers, Host rewrite, HTTPS to the backend, certificate status per port.
   record it shows. Mail is signed by From domain (a parent domain's key covers subdomains); a message
   your mail server already signed for that domain is left alone, and a signing problem sends the mail
   unsigned rather than dropping it. Hammerhead checks the DNS record and alerts if it's missing or wrong.
+- **Deliverability dashboard.** The Mail egress page shows a checklist per relay, each line with a fix:
+  reverse DNS, HELO, outbound port 25, every DKIM key, and for each domain you sign mail for, SPF
+  (evaluated against the relay's IP, including `include:`/`redirect=` and the 10-lookup limit), DMARC
+  (missing, monitoring-only, no `rua`, enforcing) and MTA-STS. The edge also looks the IP up on DNS
+  blocklists (Spamhaus ZEN, SpamCop, Barracuda, PSBL) and counts the last 24 hours of delivery outcomes
+  (delivered, deferred, refused, by recipient domain, with the latest refusal messages and what they
+  usually mean). Checks run every 15 minutes; failures raise alerts and clear when fixed.
+- **DMARC reports.** Put `rua=mailto:...` in a domain's DMARC record, and upload the daily aggregate
+  reports receivers send (the email itself, or its .xml/.gz/.zip attachment, several at once) on the same
+  page. Hammerhead parses them, keeps 90 days, and shows per domain how much mail passed, which sending
+  addresses fail (marking your own relays), and whether the policy can move from `none` to
+  `quarantine`/`reject`. `POST /api/orgs/<org>/dmarc` takes a report as the raw request body, so a mail
+  filter or script can forward reports automatically. Reports are only accepted for domains you have a
+  DKIM key for.
 - **MTA-STS enforcement.** When a recipient domain publishes an `enforce` policy, mail only goes to the
   servers it lists, over TLS with a verified certificate; otherwise it's a temporary failure so your
   server retries. (`testing` mode doesn't block.) Policies are cached for their `max_age`. The policy