Problem / Motivation

When SPF is evaluated against both the HELO and MAIL FROM identities, the frontend currently displays the HELO result as the primary SPF status. In cases where HELO returns temperror but MAIL FROM returns fail, this causes the UI to show "temporary failure" rather than the more actionable and severe "fail".

Expected behavior:

When multiple SPF results exist, the frontend should surface the most severe result as the headline status.

Current behavior:

HELO temperror is shown as the primary result, even when MAIL FROM is a harder fail.

Why this matters:

• It's confusing: a fail is a definitive policy violation, while temperror implies ambiguity
• Users may underestimate the severity of a spoofed message as a result

Proposed Solution

Show the most severe SPF result as the primary status. Optionally expose all individual results (HELO + MAIL FROM) in an expanded/tooltip view for full transparency.

Alternatives Considered

No response

Feature Area

Email

Mockups / Examples

No response

Additional Context

sample.eml