# Capability Spec: dmarc

**Package**: `@suaveplan/dmarc`
**Version**: 0.0.0 (genesis)
**Status**: ADDED

---

## ADDED Requirements

### DMARC-01 — Aggregate report parsing
`parseDmarcAggregate(input)` MUST accept raw XML or gzip-wrapped XML (magic `1F 8B`). It MUST return `DmarcAggregateReport { reportMetadata, policyPublished, records: DmarcRecord[] }` matching the schema published at `https://dmarc.org/dmarc-xml/0.1/rua.xsd`.

### DMARC-02 — Forensic report parsing
`parseDmarcForensic(input)` MUST parse a single RFC 6591 message/feedback-report into `DmarcForensicReport { reportedDomain, sourceIp, identifier, authResults, originalMessage? }`.

### DMARC-03 — Policy / alignment fields
`AlignmentMode` MUST be `'r' | 's'`. `DispositionMode` MUST be `'none' | 'quarantine' | 'reject'`. `DmarcAuthResult` MUST carry `{ dkim: 'pass' | 'fail', spf: 'pass' | 'fail' }` (minimum).

### DMARC-04 — Validation
Every report output MUST pass its Zod schema. Invalid input MUST throw `DMARC.INVALID_REPORT` with the failing XPath in context.

### DMARC-05 — Observability
Parsing MUST record `dmarc.parse.duration_ms{kind}` histogram and `dmarc.parse.total{kind}` counter (`kind` ∈ `aggregate | forensic`).