[feat] Per-domain “trusted forwarder” DMARC override for inbound mail relayed via an upstream security gateway

Add an optional, per-domain trusted-forwarder override applied at the DMARC disposition stage. First, you could define a trusted-forwarder list (IP/CIDR or reverse-DNS suffix such as gateway.example) per domain, configurable via dashboard and API and off by default. Second, at the point where a reject/quarantine would be applied, if the message fails DMARC but the connecting client matches a trusted forwarder for the recipient domain — matched strictly on iprev=pass (forward-confirmed reverse DNS), never HELO or envelope-from — override the disposition to deliver. Third, scope it narrowly: apply only when the failure is consistent with forwarding (SPF fail on the forwarder IP and/or a DKIM body-hash fail), not a blanket accept from that IP, and stamp the decision into Authentication-Results (override-reason=trusted_forwarder) for auditability.

Start by locating the existing DMARC disposition stage and the domain settings paths used by the dashboard and API. Trace how Authentication-Results is produced and how inbound forwarding failures are classified. Done means an off-by-default per-domain override supports the specified matches and narrow failure conditions, records the override reason, and has coverage for the resulting disposition.

Written by the indexing model from the issue text.