#!/bin/bash

################################################################################
# Email Account/Domain Diagnostics
################################################################################
# Purpose: Verify email is working for specific address or domain
# Shows proof of delivery or identifies why emails aren't working
################################################################################

set -eo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
source "$SCRIPT_DIR/lib/common-functions.sh"
source "$SCRIPT_DIR/lib/system-detect.sh"
source "$SCRIPT_DIR/lib/email-functions.sh"

show_banner "Email Diagnostics - Verify Email Delivery"

# Cleanup temporary files on script exit (Issue 4.1: improved cleanup trap)
cleanup() {
    # Clean up all known temp files and potential report file
    rm -f /tmp/email_diag_$$.txt /tmp/email_auth_$$.txt /tmp/email_all_$$.txt \
          /tmp/email_bounces_$$.txt /tmp/email_blacklists_$$.txt /tmp/email_blacklists_filtered_$$.txt \
          /tmp/email_diag_*_*.txt 2>/dev/null
}
trap cleanup EXIT INT TERM

# Get mail log path
MAIL_LOG=$(get_mail_log_path)
if [ ! -f "$MAIL_LOG" ]; then
    print_error "Mail log not found: $MAIL_LOG"
    exit 1
fi

print_success "Using mail log: $MAIL_LOG"
echo ""

# Ask what to check
echo -e "${BOLD}What would you like to check?${NC}"
echo ""
echo -e "  ${CYAN}1)${NC} Specific email address (e.g., user@example.com)"
echo -e "  ${CYAN}2)${NC} Entire domain (e.g., example.com)"
echo ""

# Validate check_type input
while true; do
    read -p "Enter choice [1]: " check_type
    check_type=${check_type:-1}

    if ! [[ "$check_type" =~ ^[1-2]$ ]]; then
        print_error "Invalid choice. Please enter 1 or 2"
        continue
    fi
    break
done

# Get email/domain to check
echo ""

if [ "$check_type" = "2" ]; then
    # Domain input with validation
    while true; do
        read -p "Enter domain to check (e.g., example.com): " target

        # Validate domain format (basic check)
        if [ -z "$target" ]; then
            print_error "Domain cannot be empty"
            continue
        fi

        # Check for invalid characters (allow alphanumeric, dots, hyphens)
        if ! [[ "$target" =~ ^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
            print_error "Invalid domain format. Use format like: example.com"
            continue
        fi

        search_pattern="@${target}"
        check_label="domain $target"
        break
    done
else
    # Email address input with validation
    while true; do
        read -p "Enter email address to check: " target

        # Validate email format (basic check)
        if [ -z "$target" ]; then
            print_error "Email address cannot be empty"
            continue
        fi

        # Check for valid email format (user@domain.com)
        if ! [[ "$target" =~ ^[a-zA-Z0-9._+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$ ]]; then
            print_error "Invalid email format. Use format like: user@example.com"
            continue
        fi

        search_pattern="$target"
        check_label="email $target"
        break
    done
fi

# Time period to check
echo ""
echo "Check logs from:"
echo -e "  ${CYAN}1)${NC} Last 1 hour"
echo -e "  ${CYAN}2)${NC} Last 6 hours"
echo -e "  ${CYAN}3)${NC} Last 24 hours (recommended)"
echo -e "  ${CYAN}4)${NC} Last 48 hours"
echo -e "  ${CYAN}5)${NC} Last week"
echo ""

# Validate time_choice input
while true; do
    read -p "Enter choice [3]: " time_choice
    time_choice=${time_choice:-3}

    if ! [[ "$time_choice" =~ ^[1-5]$ ]]; then
        print_error "Invalid choice. Please enter 1-5"
        continue
    fi
    break
done

case "$time_choice" in
    1) hours=1; cutoff_seconds=$((3600)) ;;
    2) hours=6; cutoff_seconds=$((3600 * 6)) ;;
    3) hours=24; cutoff_seconds=$((3600 * 24)) ;;
    4) hours=48; cutoff_seconds=$((3600 * 48)) ;;
    5) hours=168; cutoff_seconds=$((3600 * 24 * 7)) ;;
esac

cutoff_epoch=$(($(date +%s) - cutoff_seconds))

echo ""
print_info "Analyzing $check_label for last $hours hours (after $(date -d "@${cutoff_epoch}" '+%Y-%m-%d %H:%M:%S'))..."
echo ""

################################################################################
# Analysis
################################################################################

TEMP_MATCHES="/tmp/email_diag_$$.txt"
TEMP_AUTH="/tmp/email_auth_$$.txt"
TEMP_ALL="/tmp/email_all_$$.txt"

# Time-filtered search: Extract logs from cutoff time, then search
# Uses awk to parse timestamps and filter by epoch time (FIXED: year from system, not hardcoded)
grep -iF -- "$search_pattern" "$MAIL_LOG" 2>/dev/null | awk -v cutoff="$cutoff_epoch" \
    'BEGIN { current_year = strftime("%Y", systime()) }
    NF {
        # Try to extract epoch from various timestamp formats
        # ISO format: "2026-03-20 10:30:00"
        if (match($0, /([0-9]{4})-([0-9]{2})-([0-9]{2}) ([0-9]{2}):([0-9]{2}):([0-9]{2})/)) {
            year = substr($0, RSTART, 4)
            month = substr($0, RSTART+5, 2)
            day = substr($0, RSTART+8, 2)
            hour = substr($0, RSTART+11, 2)
            min = substr($0, RSTART+14, 2)
            sec = substr($0, RSTART+17, 2)
            epoch = mktime(year " " month " " day " " hour " " min " " sec)
        }
        # Syslog format: "Mar 20 10:30:00" (need month number for mktime)
        else if (match($0, /([A-Z][a-z]{2}) +([0-9]+) ([0-9]{2}):([0-9]{2}):([0-9]{2})/)) {
            month_str = substr($0, RSTART, 3)
            # Convert month name to number manually (mktime needs numbers, not names)
            if (month_str == "Jan") month_num = 1
            else if (month_str == "Feb") month_num = 2
            else if (month_str == "Mar") month_num = 3
            else if (month_str == "Apr") month_num = 4
            else if (month_str == "May") month_num = 5
            else if (month_str == "Jun") month_num = 6
            else if (month_str == "Jul") month_num = 7
            else if (month_str == "Aug") month_num = 8
            else if (month_str == "Sep") month_num = 9
            else if (month_str == "Oct") month_num = 10
            else if (month_str == "Nov") month_num = 11
            else if (month_str == "Dec") month_num = 12
            else month_num = 0

            if (month_num > 0) {
                day = substr($0, RSTART+4)
                gsub(/[^0-9]/, "", day)
                hour = substr($0, RSTART+8, 2)
                min = substr($0, RSTART+11, 2)
                sec = substr($0, RSTART+14, 2)
                epoch = mktime(current_year " " sprintf("%02d", month_num) " " sprintf("%02d", day) " " sprintf("%02d", hour) " " sprintf("%02d", min) " " sprintf("%02d", sec))
            } else {
                epoch = 0
            }
        } else {
            epoch = 0  # No timestamp found, include line anyway
        }

        # Print only if: timestamp found AND timestamp is after cutoff
        # (exclude undated lines that have epoch==0)
        if (epoch > 0 && epoch >= cutoff) print
    }' > "$TEMP_ALL" 2>/dev/null || true

# Detect MTA type from log content to use appropriate auth patterns
if grep -qiE "dovecot|imap-login|pop3-login" "$TEMP_ALL" 2>/dev/null; then
    # Dovecot patterns
    AUTH_PATTERNS="imap-login|pop3-login|dovecot.*Login|Logged in|Disconnected"
elif grep -qiE "postfix|smtpd.*auth|sasl" "$TEMP_ALL" 2>/dev/null; then
    # Postfix patterns (SASL auth, SMTP auth)
    AUTH_PATTERNS="smtpd.*sasl_|smtpd.*auth=|SASL|sasl_auth"
elif grep -qiE "sendmail|AUTH=|AUTH failed" "$TEMP_ALL" 2>/dev/null; then
    # Sendmail patterns
    AUTH_PATTERNS="AUTH=|AUTH failed|Authenticated"
else
    # Generic/fallback patterns (minimal to avoid false positives)
    AUTH_PATTERNS="imap-login|pop3-login|dovecot.*Login|auth|AUTH|sasl|SASL"
fi

# Separate authentication events (MTA-aware)
grep -E "$AUTH_PATTERNS" "$TEMP_ALL" > "$TEMP_AUTH" 2>/dev/null || true

# Get only email delivery events (exclude auth logs)
grep -vE "$AUTH_PATTERNS" "$TEMP_ALL" > "$TEMP_MATCHES" 2>/dev/null || true

if [ ! -s "$TEMP_ALL" ]; then
    # TEMP_ALL is empty - either log file error or no matching emails
    if [ ! -f "$MAIL_LOG" ]; then
        print_error "Mail log file not found: $MAIL_LOG"
        echo "Searched in: $MAIL_LOG"
        print_info "Run 'get_mail_log_path' to verify correct log location"
        exit 1
    elif [ ! -r "$MAIL_LOG" ]; then
        print_error "Mail log exists but not readable (permission denied): $MAIL_LOG"
        echo "Try running with elevated privileges"
        exit 1
    elif [ -z "$(cat "$MAIL_LOG" 2>/dev/null)" ]; then
        print_warning "Mail log is empty (no email activity at all)"
        exit 0
    fi
fi

if [ ! -s "$TEMP_MATCHES" ]; then
    print_error "NO EMAIL ACTIVITY FOUND for $check_label"
    echo ""
    echo "The mail log is readable and contains data, but no entries matched your search."
    echo ""
    echo "Possible reasons:"
    echo "  1. Email address/domain doesn't exist on this server"
    echo "  2. No email activity in the last $hours hours"
    echo "  3. Emails are going to a different mail server"
    echo "  4. Search pattern doesn't match log format (MTA format mismatch)"
    echo ""

    # Check if domain exists (control-panel aware)
    if [ "$check_type" = "2" ]; then
        domain_found=0

        # cPanel domains
        if [ -f "/etc/localdomains" ] && grep -qF "$target" /etc/localdomains 2>/dev/null; then
            domain_found=1
        fi

        # Plesk domains (from /var/www/vhosts/*/conf/httpd.include)
        if [ $domain_found -eq 0 ] && [ -d "/var/www/vhosts/$target" ]; then
            domain_found=1
        fi

        # InterWorx domains (from /var/www/html/DOMAIN structure)
        if [ $domain_found -eq 0 ] && [ -d "/var/www/html/$target" ]; then
            domain_found=1
        fi

        if [ $domain_found -eq 1 ]; then
            print_info "Domain $target IS configured on this server"
        else
            print_warning "Domain $target NOT found in local domains"
        fi
    fi

    rm -f "$TEMP_MATCHES" "$TEMP_AUTH" "$TEMP_ALL"
    exit 0
fi

total_lines=$(wc -l < "$TEMP_MATCHES")
print_success "Found $total_lines log entries for $check_label"
echo ""

################################################################################
# Categorize activity
################################################################################

# Count different types (Issue 3.1: use grep for proper pattern matching, Issue 3.2: fix double-counting)
delivered=$(grep -c "^ *[^ ]* *[^ ]* .*=> " "$TEMP_MATCHES" 2>/dev/null || echo 0)
received=$delivered  # received and delivered should be the same metric
sent=$(grep -c "<= " "$TEMP_MATCHES" 2>/dev/null || echo 0)
deferred=$(grep -Eci "deferred|retry|temporarily rejected" "$TEMP_MATCHES" 2>/dev/null || echo 0)
spf_fail=$(grep -Eci "SPF.*fail|fail.*SPF" "$TEMP_MATCHES" 2>/dev/null || echo 0)
dkim_fail=$(grep -Eci "DKIM.*fail|fail.*DKIM" "$TEMP_MATCHES" 2>/dev/null || echo 0)
greylist=$(grep -Eci "greylist|greylisted" "$TEMP_MATCHES" 2>/dev/null || echo 0)

# Bounces: SMTP 5xx codes but NOT auth failures or successful deliveries
bounced=$(grep -Ev "authenticator failed|Authentication failed|saved mail to|=> " "$TEMP_MATCHES" 2>/dev/null | \
          grep -ciE "550 |551 |552 |553 |554 |bounced|Mail delivery failed" || echo 0)

# Rejections: rejected but not auth failures (using -vE for portable extended regex)
rejected=$(grep -vE "authenticator failed|Authentication failed" "$TEMP_MATCHES" 2>/dev/null | \
           grep -ciE "rejected " || echo 0)

# Spam rejected: marked as spam AND rejected/blocked
spam_rejected=$(grep -i "spam" "$TEMP_MATCHES" 2>/dev/null | \
                grep -ciE "rejected|blocked|denied" || echo 0)

# Count authentication events
auth_failed=0 auth_success=0
while IFS= read -r line; do
    [[ "$line" =~ (auth\ failed|Login\ aborted|authentication\ failed) ]] && ((auth_failed++))
    [[ "$line" =~ "Logged in" ]] && ((auth_success++))
done < "$TEMP_AUTH"

################################################################################
# Quick Summary
################################################################################

print_header "QUICK SUMMARY"
echo ""

# Determine quick status
total_problems=$((bounced + rejected + spam_rejected))
total_email_activity=$((sent + received + delivered))

if [ "$total_email_activity" -gt 0 ] && [ "$total_problems" -eq 0 ]; then
    print_success "Email appears to be working (${total_email_activity} email events, no problems)"
elif [ "$total_email_activity" -gt 0 ] && [ "$total_problems" -gt 0 ]; then
    print_warning "Partial email issues (${total_email_activity} delivered, ${total_problems} failed)"
elif [ "$total_problems" -gt 0 ]; then
    print_error "Email delivery problems detected (${total_problems} failures)"
elif [ "$auth_success" -gt 0 ] && [ "$total_email_activity" -eq 0 ]; then
    print_info "Account active (${auth_success} logins) but no email traffic in last ${hours}h"
elif [ "$auth_failed" -gt 0 ]; then
    print_warning "Failed login attempts detected (${auth_failed} attempts) - possible attack"
else
    print_info "No activity detected in last ${hours} hours"
fi

echo ""

################################################################################
# Detailed Activity Breakdown
################################################################################

print_header "EMAIL DELIVERY ACTIVITY (last $hours hours)"
echo ""

# Always show main metrics for clarity
if [ "$received" -gt 0 ]; then
    print_success "Received: $received emails (incoming TO this $check_label)"
else
    echo "Received: 0 emails (no incoming mail)"
fi

if [ "$sent" -gt 0 ]; then
    print_success "Sent: $sent emails (outgoing FROM this $check_label)"
else
    echo "Sent: 0 emails (no outgoing mail)"
fi

if [ "$delivered" -gt 0 ]; then
    print_success "Delivered: $delivered successful deliveries"
else
    echo "Delivered: 0 (no completed deliveries logged)"
fi

echo ""

# Only show problems if they exist
has_problems=0

if [ "$bounced" -gt 0 ]; then
    print_error "Bounced: $bounced emails bounced/failed"
    has_problems=1
fi

if [ "$deferred" -gt 0 ]; then
    print_warning "Deferred: $deferred emails temporarily delayed"
    has_problems=1
fi

if [ "$rejected" -gt 0 ]; then
    print_error "Rejected: $rejected emails blocked/rejected"
    has_problems=1
fi

if [ "$spam_rejected" -gt 0 ]; then
    print_error "Spam Rejected: $spam_rejected emails marked as spam"
    has_problems=1
fi

if [ "$spf_fail" -gt 0 ]; then
    print_warning "SPF Failures: $spf_fail authentication failures"
    has_problems=1
fi

if [ "$dkim_fail" -gt 0 ]; then
    print_warning "DKIM Failures: $dkim_fail signature failures"
    has_problems=1
fi

if [ "$greylist" -gt 0 ]; then
    print_info "Greylisted: $greylist emails temporarily delayed (normal anti-spam)"
fi

if [ $has_problems -eq 0 ]; then
    print_success "No delivery problems detected"
fi

# Show email traffic patterns
if [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
    echo ""
    print_header "EMAIL TRAFFIC PATTERNS"
    echo ""

    # Top recipients (delivery recipients from emails in TEMP_MATCHES)
    if [ "$sent" -gt 0 ] || [ "$delivered" -gt 0 ]; then
        print_info "Top 5 recipients (emails delivered TO):"
        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "=> [^@]+@[^ ]+" | sed 's/=> //' | sort | uniq -c | sort -rn | head -5 | while read count recipient; do
            [ -n "$count" ] && echo "  $recipient - $count emails"
        done
        echo ""
    fi

    # Top senders (who is sending emails in TEMP_MATCHES)
    if [ "$sent" -gt 0 ]; then
        print_info "Top 5 senders (emails sent FROM):"
        grep -F "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | grep -oE "<= [^@]+@[^ ]+" | sed 's/<= //' | sort | uniq -c | sort -rn | head -5 | while read count sender; do
            [ -n "$count" ] && echo "  $sender - $count emails"
        done
        echo ""
    fi
fi

# Show authentication summary
if [ -s "$TEMP_AUTH" ]; then
    echo ""
    print_header "MAILBOX ACCESS ACTIVITY (IMAP/POP3 Logins)"
    echo ""
    print_info "This shows if customer can access their mailbox (not email delivery)"
    echo ""

    if [ "$auth_success" -gt 0 ]; then
        print_success "Successful Logins: $auth_success (password is correct, mailbox accessible)"
    fi

    if [ "$auth_failed" -gt 0 ]; then
        print_error "Failed Logins: $auth_failed (WRONG PASSWORD or brute-force attack)"

        # Extract IPs attempting failed logins
        failed_ips=$(grep -i "auth failed\|Login aborted" "$TEMP_AUTH" | grep -oE "rip=[0-9.]+|from [0-9.]+" | sed 's/rip=//; s/from //' | sort | uniq -c | sort -rn)
        if [ -n "$failed_ips" ]; then
            echo ""
            print_warning "IPs with failed login attempts:"
            echo "$failed_ips" | while read count ip; do
                echo "  $ip - $count attempts"
            done
        fi
    fi
fi

echo ""

################################################################################
# Account Status Check (for specific email addresses)
################################################################################

if [ "$check_type" != "2" ]; then
    print_header "EMAIL ACCOUNT STATUS"
    echo ""

    # Extract username and domain from email
    local_part=$(echo "$target" | cut -d'@' -f1)
    domain_part=$(echo "$target" | cut -d'@' -f2)

    # Check if email account exists in various locations
    account_found=0
    maildir=""

    # Try cPanel mail directory (common path)
    if [ -d "/home/$domain_part/mail/$domain_part/$local_part" ] 2>/dev/null; then
        maildir="/home/$domain_part/mail/$domain_part/$local_part"
        account_found=1
    fi

    # Try Plesk mail directory
    if [ $account_found -eq 0 ] && [ -d "/var/qmail/mailnames/$domain_part/$local_part" ]; then
        account_found=1
        maildir="/var/qmail/mailnames/$domain_part/$local_part"
    fi

    # Try InterWorx mail directory
    if [ $account_found -eq 0 ] && [ -d "/home/$local_part/domains/$domain_part/mail/$local_part" ]; then
        account_found=1
        maildir="/home/$local_part/domains/$domain_part/mail/$local_part"
    fi

    # Try generic /var/mail
    if [ $account_found -eq 0 ] && [ -f "/var/mail/$local_part" ]; then
        account_found=1
        maildir="/var/mail/$local_part"
    fi

    # If successful logins exist, account must exist (even if we can't find the directory)
    if [ "$account_found" -eq 0 ] && [ "$auth_success" -gt 0 ]; then
        account_found=1
        print_success "Email account EXISTS (confirmed by successful logins)"
        print_warning "Note: Mailbox directory not found in standard locations"
    elif [ "$account_found" -eq 1 ]; then
        print_success "Email account EXISTS on this server"

        # Show mailbox details if we found the directory
        if [ -n "$maildir" ] && [ -d "$maildir" ]; then
            disk_usage=$(du -sh "$maildir" 2>/dev/null | awk '{print $1}')
            if [ -n "$disk_usage" ]; then
                print_info "Mailbox size: $disk_usage"
            fi

            # Count messages
            msg_count=$(find "$maildir" -type f -name "*:2,*" 2>/dev/null | wc -l)
            if [ "$msg_count" -gt 0 ]; then
                print_info "Messages stored: $msg_count"
            fi

            # Check for quota file
            quota_file=$(find "$maildir" -name "maildirsize" 2>/dev/null | head -1)
            if [ -f "$quota_file" ]; then
                quota_info=$(head -1 "$quota_file" 2>/dev/null)
                print_info "Quota: $quota_info"
            fi
        fi
    else
        print_warning "Email account NOT FOUND on this server"
        echo ""
        echo "This could mean:"
        echo "  • Account doesn't exist (typo in email address?)"
        echo "  • Account is on a different mail server"
        echo "  • Mail is handled by external service (Google, Office365, etc.)"
    fi

    # Check for forwarders (control-panel aware)
    forwarder_found=0

    # cPanel forwarders (in /etc/valiases)
    if [ -f "/etc/valiases/$domain_part" ]; then
        forwarder=$(grep -F "^$local_part:" "/etc/valiases/$domain_part" 2>/dev/null)
        if [ -n "$forwarder" ]; then
            echo ""
            print_info "Forwarder configured:"
            echo "  $forwarder"
            forwarder_found=1
        fi
    fi

    # Plesk forwarders (in /var/qmail/alias/.qmail-DOMAIN-user)
    if [ $forwarder_found -eq 0 ] && [ -f "/var/qmail/alias/.qmail-$domain_part-$local_part" ]; then
        forwarder=$(cat "/var/qmail/alias/.qmail-$domain_part-$local_part" 2>/dev/null | head -1)
        if [ -n "$forwarder" ]; then
            echo ""
            print_info "Forwarder configured:"
            echo "  $forwarder"
        fi
    fi

    echo ""
fi

################################################################################
# Show verdict
################################################################################

print_header "DIAGNOSTIC RESULT"
echo ""

# Determine overall status
if [ "$delivered" -gt 0 ] && [ "$bounced" -eq 0 ] && [ "$rejected" -eq 0 ] && [ "$spam_rejected" -eq 0 ]; then
    print_success "EMAIL IS WORKING PROPERLY"
    echo ""
    echo "Evidence: $delivered successful deliveries in the last $hours hours"
    echo "No bounces, rejections, or spam filtering detected"
    echo ""

elif [ "$delivered" -gt 0 ] && [ "$bounced" -gt 0 ]; then
    print_warning "EMAIL PARTIALLY WORKING"
    echo ""
    echo "Some emails delivered ($delivered) but some failed ($bounced)"
    echo "Check bounce reasons below for details"
    echo ""

elif [ "$bounced" -gt 0 ] || [ "$rejected" -gt 0 ] || [ "$spam_rejected" -gt 0 ]; then
    print_error "EMAIL HAS DELIVERY PROBLEMS"
    echo ""
    echo "Emails are being rejected, bouncing, or filtered as spam"
    echo "See details below for why"
    echo ""

elif [ "$deferred" -gt 0 ]; then
    print_warning "EMAIL DELAYED"
    echo ""
    echo "Emails are being deferred (temporary failures)"
    echo "This usually resolves itself within minutes"
    echo ""

elif [ "$sent" -gt 0 ] || [ "$received" -gt 0 ]; then
    print_info "EMAIL ACTIVITY DETECTED"
    echo ""
    echo "Email traffic logged but no delivery confirmations in last $hours hours"
    echo "This may be normal depending on email volume"
    echo ""

elif [ "$auth_success" -gt 0 ] || [ "$auth_failed" -gt 0 ]; then
    print_info "MAILBOX ACCESS ONLY"
    echo ""
    echo "No email delivery activity, only mailbox access (IMAP/POP3) detected"
    echo "This means the account exists and is being checked, but no emails sent/received"
    echo ""
    if [ "$auth_success" -gt 0 ]; then
        echo "Authentication is working (customer can access mailbox)"
    fi
    if [ "$auth_failed" -gt 0 ]; then
        echo "Failed login attempts detected (see details below)"
    fi
    echo ""

else
    print_warning "NO EMAIL ACTIVITY FOUND"
    echo ""
    echo "No email sending, receiving, or mailbox access in the last $hours hours"
    echo "Account may be inactive or not used during this time period"
    echo ""
fi

################################################################################
# Show recent activity samples
################################################################################

if [ "$delivered" -gt 0 ]; then
    print_header "RECENT SUCCESSFUL DELIVERIES (last 5 from past $hours hours)"
    echo ""
    print_info "PROOF - These emails were delivered recently:"
    echo ""
    while read line; do
        # Extract timestamp if present
        timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
        if [ -n "$timestamp" ]; then
            echo -e "  ${GREEN}[$timestamp]${NC} $line"
        else
            echo "  $line"
        fi
    done < <(grep -F "$search_pattern" "$TEMP_MATCHES" | grep -iE "=>|delivered" | tail -5)
    echo ""
fi

if [ "$bounced" -gt 0 ]; then
    print_header "DELIVERY FAILURE ANALYSIS"
    echo ""

    # Get all bounce lines (Issue 4.1: add -- after grep flags)
    TEMP_BOUNCES="/tmp/email_bounces_$$.txt"
    grep -F -- "$search_pattern" "$TEMP_MATCHES" 2>/dev/null | \
        grep -Ev "authenticator failed|Authentication failed|saved mail to|=>" | \
        grep -iE "550|551|552|553|554|bounced|Mail delivery failed|\\*\\* " > "$TEMP_BOUNCES" 2>/dev/null

    # Categorize failures (grep -c outputs single number, no sanitization needed)
    recipient_unknown=$(grep -ci "user unknown\|No such user\|does not exist\|recipient rejected\|Recipient address rejected\|550.*User" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
    mailbox_full=$(grep -ci "mailbox.*full\|quota.*exceeded\|552\|insufficient.*space\|over.*quota" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
    relay_denied=$(grep -ci "relay.*denied\|relay.*not.*permitted\|relaying denied\|554.*relay" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
    # Only count actual blacklist/RBL rejections, exclude common false positives (using -vE for portability)
    blocked=$(grep -iE "blacklist|block list|RBL|DNSBL|listed in|blocked using|on our block list" -- "$TEMP_BOUNCES" 2>/dev/null | \
              grep -vE "mailbox.*full|quota.*exceeded|authentication|auth.*failed|SPF.*fail|DKIM.*fail|user unknown|does not exist|relay.*denied|content.*filter|rejected due to content|greylisted|greylist" | \
              wc -l 2>/dev/null || echo 0)
    dns_failure=$(grep -ci "domain.*not.*found\|Host.*unknown\|Name.*not.*resolve\|MX.*not.*found" "$TEMP_BOUNCES" 2>/dev/null || echo 0)
    connection_fail=$(grep -ci "timeout\|connection.*refused\|connection.*failed\|Network.*unreachable" "$TEMP_BOUNCES" 2>/dev/null || echo 0)

    print_info "Failure breakdown by reason:"
    echo ""

    if [ "$recipient_unknown" -gt 0 ]; then
        print_error "  Recipient doesn't exist: $recipient_unknown emails"
        echo "    Reason: Email address is invalid or doesn't exist on recipient server"
        grep -iE "user unknown|No such user|does not exist|recipient rejected|550.*User" "$TEMP_BOUNCES" | head -2 | while read line; do
            echo "    Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
        done
        echo ""
    fi

    if [ "$mailbox_full" -gt 0 ]; then
        print_warning "  Mailbox full: $mailbox_full emails"
        echo "    Reason: Recipient's mailbox has exceeded storage quota"
        grep -iE "mailbox.*full|quota.*exceeded|552" "$TEMP_BOUNCES" | head -2 | while read line; do
            echo "    Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
        done
        echo ""
    fi

    if [ "$relay_denied" -gt 0 ]; then
        print_error "  Relay denied: $relay_denied emails"
        echo "    Reason: Server not authorized to send to this domain"
        echo "    Solution: Check if server IP needs to be whitelisted"
        echo ""
    fi

    if [ "$blocked" -gt 0 ]; then
        print_error "  Blocked/Spam filtered: $blocked emails"
        echo "    Reason: Sender IP or domain is blacklisted, or content flagged as spam"
        echo ""

        # Extract specific blacklists from rejection messages (strict filter to avoid false positives)
        TEMP_BLACKLISTS="/tmp/email_blacklists_$$.txt"
        TEMP_BLACKLISTS_FILTERED="/tmp/email_blacklists_filtered_$$.txt"

        # Initial extraction with broad pattern
        grep -iE "blacklist|block list|RBL|DNSBL|listed in|blocked using|on our block list|S3150|S3140|AS\(48|CS01|local policy|gmail.*(suspicious|reputation|spam|detected).*reputation|gmail.*detected.*suspicious|spamhaus|barracuda|spamcop|sorbs|abuseat|yahoo.*block|yahoo.*reject|aol.*block|aol.*reject|me\.com.*reject|icloud.*reject|mac\.com.*reject|protonmail.*block|protonmail.*reject|pm\.me.*reject|zoho.*block|zoho.*reject|fastmail.*block|fastmail.*reject|outlook.*block|hotmail.*block|live\.com.*block|msn\.com.*block" "$TEMP_BOUNCES" > "$TEMP_BLACKLISTS" 2>/dev/null || true

        # ENHANCED: Filter out false positives with strict exclusions
        # Exclude negation keywords, question contexts, and non-RBL blocks
        if [ -s "$TEMP_BLACKLISTS" ]; then
            grep -vE "not blacklist|not listed|NOT listed|no.*longer|removed from|delisted|successfully delisted|you.*can.*now|check if|if.*server|if your|we block|some.*block|unlike|rarely|are rare|except|not.*block|not.*in|but.*policy|policy.*block|firewall|rate limit|internally|internal.*block|local.*block|rejected.*not.*blacklist|based on sender|blocks are" "$TEMP_BLACKLISTS" > "$TEMP_BLACKLISTS_FILTERED" 2>/dev/null || true

            # Use filtered version if it has content, otherwise use original
            if [ -s "$TEMP_BLACKLISTS_FILTERED" ]; then
                mv "$TEMP_BLACKLISTS_FILTERED" "$TEMP_BLACKLISTS"
            else
                # All messages were false positives, clear the file
                > "$TEMP_BLACKLISTS"
            fi
        fi

        # Try to extract server IP from rejection messages (cleaner pattern for IP extraction)
        extracted_ip=""
        if grep -qiE '\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\]|from [0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$TEMP_BLACKLISTS" 2>/dev/null; then
            extracted_ip=$(grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' "$TEMP_BLACKLISTS" 2>/dev/null | head -1)
        fi

        if [ -s "$TEMP_BLACKLISTS" ]; then
            # Blacklist/Provider detection with real-world message patterns
            # Format: "name|display_name|removal_url|detection_keywords"
            blacklist_db=(
                # Traditional RBLs - Format: "id|name|url|patterns|difficulty|avg_time"
                "spamhaus|Spamhaus (ZEN/SBL/XBL)|https://check.spamhaus.org/|spamhaus|sbl.spamhaus|zen.spamhaus|xbl.spamhaus|pbl.spamhaus|HARD|1-7 days"
                "barracuda|Barracuda Central BRBL|https://www.barracudacentral.org/rbl/removal-request|barracuda|MODERATE|1-3 days"
                "spamcop|SpamCop Blocking List|https://www.spamcop.net/bl.shtml|spamcop|bl.spamcop|EASY|Same day"
                "sorbs|SORBS DNSBL|http://www.sorbs.net/lookup.shtml|sorbs|dnsbl.sorbs|MODERATE|1-2 days"
                "cbl|CBL (Composite Block List)|https://cbl.abuseat.org/lookup.cgi|cbl.abuseat|abuseat|MODERATE|1-3 days"
                "psbl|PSBL (Passive Spam Block List)|https://psbl.org/|psbl.surriel|psbl|MODERATE|1-2 days"
                "uceprotect|UCEPROTECT Network|http://www.uceprotect.net/en/rblcheck.php|uceprotect|HARD|3-7 days"
                "invaluement|Invaluement DNSBL|http://www.invaluement.com/removal/|invaluement|MODERATE|1-3 days"
                "mailspike|Mailspike Blacklist|https://mailspike.net/anubis/lookup.html|mailspike|EASY|Same day"
                "truncate|GBUdb (Truncate)|http://www.gbudb.com/|truncate.gbudb|gbudb|EASY|Same day"
                "dnsrbl|DNSRBL.org|http://www.dnsrbl.org/|dnsrbl|MODERATE|1-2 days"
                "backscatterer|Backscatterer.org|http://www.backscatterer.org/|backscatterer|EASY|Same day"
                "dnswl|DNSWL (actually whitelist)|https://www.dnswl.org/|dnswl|N/A|N/A"
                "mxtoolbox|MXToolbox Blacklist|https://mxtoolbox.com/blacklists.aspx|mxtoolbox|EASY|Same day"

                # Major Email Providers (not traditional RBLs but they block based on reputation)
                "microsoft|Microsoft/Outlook/Hotmail/Live Block|https://sendersupport.olc.protection.outlook.com/snds/|outlook.*block|hotmail.*block|live\.com.*block|msn\.com.*block|protection\.outlook.*block|on our block list|S3150|S3140|AS\(48|MODERATE|Same day"
                "gmail|Gmail Reputation Filter|https://support.google.com/mail/contact/bulk_send_new|gmail.*suspicious|gmail.*reputation|gmail.*spam|gmail.*blocked|gmail.*detected|EASY|Same day"
                "apple|Apple iCloud/me.com/mac.com Block|https://support.apple.com/|local policy|icloud.*reject|me\.com.*reject|mac\.com.*reject|CS01|HARD|3-7 days"
                "yahoo|Yahoo/AOL Mail Block|https://senders.yahooinc.com/contact|yahoo.*block|yahoo.*reject|aol.*block|aol.*reject|verizonmedia.*block|MODERATE|1-2 days"
                "zoho|Zoho Mail Block|https://www.zoho.com/mail/help/|zoho.*reject|zoho.*block|zohomail.*reject|EASY|Same day"
                "protonmail|ProtonMail Block|https://protonmail.com/support/|protonmail.*reject|protonmail.*block|pm\.me.*reject|MODERATE|1-3 days"
                "fastmail|Fastmail Block|https://www.fastmail.help/|fastmail.*reject|fastmail.*block|MODERATE|1-2 days"
                "att|AT&T/SBC Block List|https://www.att.com/support/|att\.net.*block|sbcglobal.*block|MODERATE|1-3 days"
                "comcast|Comcast/Xfinity Block|http://postmaster.comcast.net/|comcast.*block|xfinity.*block|MODERATE|1-3 days"
                "cox|Cox Communications Block|https://www.cox.com/residential/support.html|cox\.net.*block|MODERATE|1-3 days"
                "verizon|Verizon/Frontier Block|https://www.verizon.com/support/|verizon.*block|frontier.*block|MODERATE|1-3 days"
                "spectrum|Spectrum/Charter Block|https://www.spectrum.net/support|spectrum.*block|charter.*block|rr\.com.*block|MODERATE|1-3 days"
            )

            detected_blacklists=""

            # Check each blacklist pattern against rejection messages
            for entry in "${blacklist_db[@]}"; do
                IFS='|' read -r bl_id bl_name bl_url bl_patterns bl_difficulty bl_time <<< "$entry"

                # Split patterns and check each one
                matched=0
                IFS='|' read -ra PATTERNS <<< "$bl_patterns"
                for pattern in "${PATTERNS[@]}"; do
                    if grep -qiE "$pattern" "$TEMP_BLACKLISTS" 2>/dev/null; then
                        matched=1
                        break
                    fi
                done

                if [ $matched -eq 1 ]; then
                    detected_blacklists="${detected_blacklists}${bl_name}|${bl_url}|${bl_difficulty}|${bl_time}\n"

                    # Record in history database (Issue 6.4: proper JSON append, not plain text)
                    HISTORY_FILE="$HOME/.email-diagnostics-history.txt"
                    timestamp=$(date -u +"%Y-%m-%dT%H:%M:%SZ")

                    # Use plain text format to avoid JSON corruption (simpler and safer)
                    echo "$timestamp|$bl_id|$extracted_ip" >> "$HISTORY_FILE" 2>/dev/null || true
                fi
            done

            if [ -n "$detected_blacklists" ]; then
                print_warning "    ⚠ SPECIFIC BLACKLISTS/BLOCKS DETECTED:"
                echo ""
                if [ -n "$extracted_ip" ]; then
                    print_info "      Server IP detected: $extracted_ip"
                    echo ""
                fi
                echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
                    if [ -n "$bl_name" ]; then
                        # Format difficulty and time if available
                        if [ -n "$bl_difficulty" ] && [ -n "$bl_time" ]; then
                            print_error "      • $bl_name [$bl_difficulty - $bl_time]"
                        else
                            print_error "      • $bl_name"
                        fi
                        # Generate IP-specific lookup URL if IP was extracted
                        if [ -n "$extracted_ip" ]; then
                            case "$bl_url" in
                                *spamhaus.org*)
                                    echo "        Lookup: https://check.spamhaus.org/?ip=${extracted_ip}"
                                    ;;
                                *barracudacentral.org*)
                                    echo "        Lookup: https://www.barracudacentral.org/rbl/lookup?ip=${extracted_ip}"
                                    ;;
                                *spamcop.net*)
                                    echo "        Lookup: https://www.spamcop.net/query.html?ip=${extracted_ip}"
                                    ;;
                                *sorbs.net*)
                                    echo "        Lookup: http://www.sorbs.net/lookup.shtml?ip=${extracted_ip}"
                                    ;;
                                *)
                                    echo "        Removal/Info: $bl_url"
                                    ;;
                            esac
                        else
                            echo "        Removal/Info: $bl_url"
                        fi
                        echo ""
                    fi
                done
            else
                # Generic spam filter (not a specific blacklist)
                echo "    ℹ No specific blacklist detected in rejection message"
                echo "    May be content-based spam filtering or unlisted blacklist"
                echo ""
            fi

            # Show example rejection messages
            print_info "    📋 EXAMPLE REJECTION MESSAGES:"
            echo ""
            head -3 "$TEMP_BLACKLISTS" | while read line; do
                # Truncate very long lines
                echo "      $(echo "$line" | cut -c1-120)"
            done
            echo ""
        fi

        echo "    🔧 RECOMMENDED ACTIONS:"
        echo "      1. Check your server IP against the detected blacklists above"
        echo "      2. Visit removal/delisting URLs to submit requests"
        echo "      3. Verify SPF/DKIM/DMARC records are correctly configured"
        echo "      4. Check if server has been compromised (sending spam)"
        echo "      5. Review mail queue for suspicious outbound emails"
        echo ""

        # Show removal request templates for detected blacklists
        print_info "    📧 REMOVAL REQUEST TEMPLATES:"
        echo ""

        # Function to generate removal template based on blacklist
        generate_removal_template() {
            local bl_id="$1"
            local server_ip="${2:-YOUR_SERVER_IP}"
            local server_hostname="${3:-YOUR_SERVER_HOSTNAME}"
            local admin_email="${4:-admin@YOUR_DOMAIN.com}"

            case "$bl_id" in
                spamhaus)
                    cat <<'TEMPLATE'
Subject: Delisting Request for [SERVER_IP]

Dear Spamhaus,

I am writing to request removal of our mail server from your blacklist (SBL/PBL/ZEN).

Server Details:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]

Actions Taken:
1. Verified server is not an open relay
2. Secured server against compromise and abuse
3. Implemented SPF/DKIM/DMARC authentication records
4. Configured proper mail server policies

We believe our server has been remediated and is no longer a spam source.
Please review and remove our IP from your blocklist.

Thank you,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                microsoft)
                    cat <<'TEMPLATE'
Subject: Delisting Request - IP [SERVER_IP]

Hello Microsoft Sender Support,

I need to request removal of our mail server IP from the Microsoft/Outlook blocklist.

Server Information:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]
- Organization: [YOUR_ORGANIZATION]

Remediation Completed:
1. Resolved the security issue causing the block
2. Verified server authentication (SPF/DKIM/DMARC)
3. Removed malicious content from mail queue
4. Implemented additional security measures

Our server is now compliant with Microsoft sender requirements.
Please restore our sending reputation.

Best regards,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                gmail)
                    cat <<'TEMPLATE'
Subject: Delisting Request - Mail Server [SERVER_IP]

Hello Gmail Support,

Our mail server [SERVER_IP] has been blocked due to reputation issues.
We have taken corrective action and request review for restoration.

Server Details:
- IP Address: [SERVER_IP]
- Reverse DNS: [SERVER_HOSTNAME]

Actions Taken:
1. Fixed authentication headers and message formatting
2. Implemented DKIM and DMARC signing on all outgoing mail
3. Improved bounce handling procedures
4. Enhanced content filtering for suspicious messages

We are now complying with Gmail's sender requirements.
Please re-evaluate our server reputation.

Thank you,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                apple)
                    cat <<'TEMPLATE'
Subject: Mail Server Delisting Request - [SERVER_IP]

Hello Apple Support,

Our organization's mail server [SERVER_IP] has been blocked by Apple's
mail filtering system. We have addressed the underlying issues.

Server Information:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]

Remediation Steps Completed:
1. Verified message authentication (SPF/DKIM/DMARC records)
2. Reviewed and removed compromised accounts
3. Implemented additional security hardening
4. Configured proper mail server protocols

Our server now fully complies with Apple's sender requirements.
Please review and remove the block.

Sincerely,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                barracuda)
                    cat <<'TEMPLATE'
Subject: Delisting Request - [SERVER_IP]

Hello Barracuda Central,

Our mail server at [SERVER_IP] is listed in your Barracuda Reputation Block List.
We have remediated the issue and request delisting.

Server Details:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]

Corrective Actions:
1. Fixed all authentication record issues (SPF/DKIM)
2. Reviewed and removed spam/malware from queue
3. Disabled any open relay vulnerabilities
4. Verified reverse DNS configuration

We are committed to maintaining sender reputation and complying with best practices.
Please review our request for removal.

Regards,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                yahoo)
                    cat <<'TEMPLATE'
Subject: Mail Server Delisting - [SERVER_IP]

Hello Yahoo Postmaster,

Our mail server [SERVER_IP] needs to be removed from Yahoo's block list.
We have taken steps to address the issue.

Server Information:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]

Steps Taken:
1. Implemented proper email authentication (SPF/DKIM/DMARC)
2. Configured appropriate rate limiting policies
3. Reviewed mail queue for suspicious content
4. Enhanced server security against compromise

Our server is now configured to meet Yahoo's sender guidelines.
We request review of our IP for delisting.

Thank you,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
                *)
                    cat <<'TEMPLATE'
Subject: Delisting Request - Mail Server [SERVER_IP]

Hello [BLOCKLIST_NAME] Support,

We are writing to request removal of our mail server [SERVER_IP] from your blocklist.

Server Details:
- IP Address: [SERVER_IP]
- Hostname: [SERVER_HOSTNAME]

Actions Taken:
1. Identified and fixed the issue causing the listing
2. Implemented proper authentication protocols
3. Enhanced security measures
4. Verified compliance with best practices

Our server is now properly configured and we believe it should be delisted.
Please review our request.

Sincerely,
[ADMIN_NAME]
[ADMIN_EMAIL]
TEMPLATE
                    ;;
            esac
        }

        # Show templates for each detected blacklist
        echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
            if [ -n "$bl_name" ]; then
                # Extract ID from name (use first word as ID)
                bl_id=$(echo "$bl_name" | cut -d' ' -f1 | tr '[:upper:]' '[:lower:]')

                echo "    ─────────────────────────────────────────────────"
                echo "    📧 Template for: $bl_name"
                echo "    ─────────────────────────────────────────────────"
                generate_removal_template "$bl_id" "$extracted_ip" "mail.example.com" "admin@example.com"
                echo ""
                echo "    💡 Copy-paste instructions:"
                echo "      1. Copy the template above"
                echo "      2. Replace placeholders: [SERVER_IP], [SERVER_HOSTNAME], [ADMIN_NAME], [ADMIN_EMAIL]"
                echo "      3. Submit to: $bl_url"
                echo ""
            fi
        done

        # Real-time blacklist status checking (if IP was extracted)
        if [ -n "$extracted_ip" ]; then
            echo ""
            print_info "    🔍 REAL-TIME BLACKLIST STATUS CHECK:"
            echo ""
            echo "    Checking current listing status for: $extracted_ip"
            echo ""

            # Function to check if IP is currently listed on a blacklist RBL
            check_blacklist_listing() {
                local ip="$1"
                local rbl_host="$2"  # e.g., zen.spamhaus.org
                local rbl_name="$3"  # e.g., Spamhaus

                # Reverse the IP octets: 1.2.3.4 → 4.3.2.1
                local reversed_ip=$(echo "$ip" | awk -F. '{print $4"."$3"."$2"."$1}')

                # Query the RBL with a 3-second timeout
                local query="${reversed_ip}.${rbl_host}"
                local result=$(dig +short +timeout=3 "$query" A 2>/dev/null | head -1)

                if [ -n "$result" ]; then
                    # IP is listed - return the response code
                    echo "LISTED:$result"
                else
                    # IP is not listed
                    echo "CLEAN"
                fi
            }

            # Parse RBL servers from blacklist entries and check each
            echo -e "$detected_blacklists" | sort -u | while IFS='|' read -r bl_name bl_url bl_difficulty bl_time; do
                if [ -n "$bl_name" ]; then
                    # Extract RBL hostnames from URLs or use common patterns
                    case "$bl_name" in
                        *Spamhaus*)
                            rbl_host="zen.spamhaus.org"
                            short_name="Spamhaus"
                            ;;
                        *Barracuda*)
                            rbl_host="bl.barracudacentral.org"
                            short_name="Barracuda"
                            ;;
                        *SpamCop*)
                            rbl_host="bl.spamcop.net"
                            short_name="SpamCop"
                            ;;
                        *SORBS*)
                            rbl_host="dnsbl.sorbs.net"
                            short_name="SORBS"
                            ;;
                        *CBL*)
                            rbl_host="cbl.abuseat.org"
                            short_name="CBL"
                            ;;
                        *)
                            # Skip email providers (not traditional RBLs)
                            continue
                            ;;
                    esac

                    # Check current status
                    status=$(check_blacklist_listing "$extracted_ip" "$rbl_host" "$short_name")

                    if [[ "$status" == "LISTED"* ]]; then
                        response_code=$(echo "$status" | cut -d: -f2)
                        print_error "    ✗ $short_name: CURRENTLY LISTED"
                        echo "        Response: $response_code (meaning: check RBL for code details)"
                        echo "        Action: Submit delisting request if not already done"
                    else
                        print_success "    ✓ $short_name: NOT LISTED (Clean)"
                    fi
                fi
            done

            echo ""
            echo "    📌 Status Check Notes:"
            echo "      • DNS lookups may be cached - results reflect current RBL state"
            echo "      • Some RBLs may not respond within timeout window"
            echo "      • Check removal URLs above for detailed delisting status"
            echo ""
        fi

        # Show historical statistics if history file exists
        HISTORY_FILE="$HOME/.email-diagnostics-history.txt"
        if [ -f "$HISTORY_FILE" ] && [ -s "$HISTORY_FILE" ]; then
            echo ""
            print_info "    📊 HISTORICAL BLACKLIST TRACKING:"
            echo ""

            # Count recorded events from history file (simplified approach)
            history_events=$(grep -c "|" "$HISTORY_FILE" 2>/dev/null || echo 0)

            if [ "$history_events" -gt 0 ]; then
                echo "    📈 Blacklist History Summary:"
                echo "      • Total recorded incidents: $history_events"
                echo "      • History location: $HISTORY_FILE"
                echo ""
                echo "    💡 Use this data to identify:"
                echo "      • Which blacklists repeatedly block your server"
                echo "      • Patterns in blocking frequency"
                echo "      • Whether server has a systemic listing problem"
                echo ""
                echo "    🔍 View detailed history:"
                echo "      cat $HISTORY_FILE"
                echo ""
            fi
        fi

        rm -f "$TEMP_BLACKLISTS"
    fi

    if [ "$dns_failure" -gt 0 ]; then
        print_error "  DNS/Domain issues: $dns_failure emails"
        echo "    Reason: Recipient domain doesn't exist or has no MX records"
        grep -i "domain.*not.*found\|Host.*unknown" "$TEMP_BOUNCES" | head -2 | while read line; do
            echo "    Example: $(echo "$line" | grep -oE '[^ ]+@[^ ,]+' | head -1)"
        done
        echo ""
    fi

    if [ "$connection_fail" -gt 0 ]; then
        print_warning "  Connection failures: $connection_fail emails"
        echo "    Reason: Could not connect to recipient mail server (temporary)"
        echo "    Solution: These usually resolve themselves, check if persistent"
        echo ""
    fi

    # Calculate uncategorized
    total_categorized=$((recipient_unknown + mailbox_full + relay_denied + blocked + dns_failure + connection_fail))
    if [ "$total_categorized" -lt "$bounced" ]; then
        other=$((bounced - total_categorized))
        print_warning "  Other failures: $other emails"
        echo "    See detailed logs below for specific reasons"
        echo ""
    fi

    # Show recent failures for reference
    print_header "RECENT FAILURE EXAMPLES (last 3)"
    echo ""
    grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed\|saved mail to\|=>" | grep -i "550\|551\|552\|553\|554\|bounced\|Mail delivery failed\|** " | tail -3 | while read line; do
        timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
        if [ -n "$timestamp" ]; then
            echo -e "  ${RED}[$timestamp]${NC}"
            # Extract the key error message
            error_msg=$(echo "$line" | grep -oE "550 [^<]*|551 [^<]*|552 [^<]*|User unknown|does not exist|Mailbox full|relay denied" | head -1)
            if [ -n "$error_msg" ]; then
                echo "    Error: $error_msg"
            fi
            recipient=$(echo "$line" | grep -oE '[^ ]+@[^ ,<>]+' | grep -v "$search_pattern" | head -1)
            if [ -n "$recipient" ]; then
                echo "    To: $recipient"
            fi
        fi
        echo ""
    done

    rm -f "$TEMP_BOUNCES"
fi

if [ "$rejected" -gt 0 ]; then
    print_header "RECENT REJECTIONS (last 5)"
    echo ""
    grep -i "$search_pattern" "$TEMP_MATCHES" | grep -v "authenticator failed\|Authentication failed" | grep -i "rejected RCPT\|rejected.*relay.*denied\|rejected.*spam" | tail -5 | while read line; do
        echo "  $line"
    done
    echo ""
fi

if [ "$spam_rejected" -gt 0 ]; then
    print_header "RECENT SPAM REJECTIONS (last 5)"
    echo ""
    print_info "Emails rejected as spam (not delivered):"
    echo ""
    while read line; do
        timestamp=$(echo "$line" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2} [0-9]{2}:[0-9]{2}:[0-9]{2}|[A-Z][a-z]{2} [0-9]+ [0-9]{2}:[0-9]{2}:[0-9]{2}' | head -1)
        if [ -n "$timestamp" ]; then
            echo -e "  ${RED}[$timestamp]${NC} $line"
        else
            echo "  $line"
        fi
    done < <(grep -i "$search_pattern" "$TEMP_MATCHES" | grep -i "spam" | grep -i "rejected\|blocked\|denied" | tail -5)
    echo ""
fi

if [ "$greylist" -gt 0 ]; then
    print_header "RECENT GREYLISTING EVENTS (last 5)"
    echo ""
    print_info "Note: Greylisting is temporary - emails usually deliver after retry"
    echo ""
    grep -i "greylist" "$TEMP_MATCHES" | tail -5 | while read line; do
        echo "  $line"
    done
    echo ""
fi

if [ "$spf_fail" -gt 0 ] || [ "$dkim_fail" -gt 0 ]; then
    print_header "AUTHENTICATION ISSUES"
    echo ""
    if [ "$spf_fail" -gt 0 ]; then
        echo "SPF failures detected:"
        grep -i "SPF.*fail" "$TEMP_MATCHES" | head -3
        echo ""
    fi
    if [ "$dkim_fail" -gt 0 ]; then
        echo "DKIM failures detected:"
        grep -i "DKIM.*fail" "$TEMP_MATCHES" | head -3
        echo ""
    fi
fi

################################################################################
# Recommendations
################################################################################

print_header "RECOMMENDATIONS"
echo ""

if [ "$bounced" -gt 0 ]; then
    echo "To fix bounces:"
    echo "  1. Verify the recipient email address is correct"
    echo "  2. Check if recipient mailbox is full"
    echo "  3. Ensure domain DNS is configured properly"
    echo ""
fi

if [ "$rejected" -gt 0 ]; then
    echo "To fix rejections:"
    echo "  1. Check if server IP is blacklisted (use Blacklist Check tool)"
    echo "  2. Verify SPF/DKIM/DMARC records are correct"
    echo "  3. Check if recipient is blocking your domain"
    echo ""
fi

if [ "$spf_fail" -gt 0 ]; then
    echo "To fix SPF failures:"
    echo "  1. Add this server's IP to domain's SPF record"
    echo "  2. Use SPF/DKIM/DMARC Check tool for details"
    echo ""
fi

if [ "$spam_rejected" -gt 0 ]; then
    echo "To fix spam rejections:"
    echo "  1. Check SpamAssassin score and adjust settings"
    echo "  2. Verify email content isn't triggering spam filters"
    echo "  3. Ensure proper SPF/DKIM authentication"
    echo "  4. Check if sending domain has good reputation"
    echo ""
fi

if [ "$greylist" -gt 0 ] && [ "$delivered" -eq 0 ]; then
    echo "Greylisting delays:"
    echo "  • This is normal anti-spam behavior"
    echo "  • Emails should deliver after sender retries (5-15 minutes)"
    echo "  • No action needed unless emails never arrive"
    echo ""
fi

if [ "${check_type:-1}" != "2" ] && [ "${account_found:-0}" -eq 0 ]; then
    echo "Email account not found:"
    echo "  1. Verify the email address is spelled correctly"
    echo "  2. Check if domain DNS points to this server"
    echo "  3. Create the email account if it should exist here"
    echo "  4. Check if mail is handled by external service"
    echo ""
fi

if [ "$auth_failed" -gt 0 ]; then
    echo "Failed login attempts detected:"
    echo "  1. Customer may be using wrong password"
    echo "  2. Could be brute-force attack attempt"
    echo "  3. Check IPs - block suspicious ones with firewall"
    echo "  4. Advise customer to change password if compromised"
    echo ""
fi

################################################################################
# Save full report
################################################################################

REPORT_FILE="/tmp/email_diag_${target//[@.]/_}_$(date +%Y%m%d_%H%M%S).txt"
cp "$TEMP_MATCHES" "$REPORT_FILE"

print_info "Full log saved to: $REPORT_FILE"
echo ""

# Wait for user (Issue 6.1: design standard requires press_enter before exit)
echo ""
press_enter

# Cleanup (Issue 4.1: improved cleanup for all temp files)
rm -f "$TEMP_MATCHES" "$TEMP_AUTH" "$TEMP_ALL" "$TEMP_BOUNCES" \
      "$TEMP_BLACKLISTS" "$TEMP_BLACKLISTS_FILTERED" "$REPORT_FILE" 2>/dev/null || true
