Rust Migration Plan

Completed Phases

Phase 3: Rust Primary Backend (DKIM/SPF/DMARC/IP Reputation)

• Rust is the mandatory security backend — no TS fallbacks
• All DKIM signing/verification, SPF, DMARC, IP reputation through Rust bridge

Phase 5: BounceManager + ContentScanner

• BounceManager bounce detection delegated to Rust detectBounce IPC command
• ContentScanner pattern matching delegated to new Rust scanContent IPC command
• New module: rust/crates/mailer-security/src/content_scanner.rs (10 Rust tests)
• ~215 lines removed from BounceManager, ~350 lines removed from ContentScanner
• Binary attachment scanning (PE headers, VBA macros) stays in TS
• Custom rules (runtime-configured) stay in TS
• Net change: ~-560 TS lines, +265 Rust lines

Deferred

| Component | Rationale | |-----------|-----------| | EmailValidator | Already thin; uses smartmail; minimal gain | | DNS record generation | Pure string building; zero benefit from Rust | | MIME building (toRFC822String) | Sync in TS, async via IPC; too much blast radius |