diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a3dfd92..5a4e7e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,3 +62,64 @@ jobs:
 
       - name: Test
         run: make check
+
+  build-test-macos:
+    runs-on: macos-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: |
+          brew install \
+            autoconf automake libtool pkg-config \
+            openssl \
+            lua \
+            cpanminus
+          cpanm --notest DBI LWP IO::Compress JSON Net::DNS
+
+      - name: Build and install libmilter from source
+        run: |
+          SENDMAIL_VER=8.18.2
+          curl -fsSL "ftp://ftp.sendmail.org/pub/sendmail/sendmail.${SENDMAIL_VER}.tar.gz" | tar xz -C /tmp
+          cd /tmp/sendmail-${SENDMAIL_VER}/libmilter
+          ./Build
+          sudo mkdir -p /usr/local/include/libmilter /usr/local/lib
+          sudo cp ../include/libmilter/mfapi.h ../include/libmilter/mfdef.h /usr/local/include/libmilter/
+          sudo cp "$(find .. -name 'libmilter.a' | head -1)" /usr/local/lib/
+
+      - name: Build miltertest
+        run: |
+          git clone --depth=1 https://github.com/thegushi/miltertest.git /tmp/miltertest
+          cd /tmp/miltertest
+          autoreconf -fvi
+          ./configure \
+            CFLAGS='-g -O2 -Wno-pointer-sign -std=gnu11' \
+            CPPFLAGS="-I$(brew --prefix openssl)/include -I/usr/local/include" \
+            LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/lib"
+          make -j$(sysctl -n hw.logicalcpu)
+          sudo make install
+
+      - name: Bootstrap build system
+        run: autoreconf -fvi
+
+      - name: Configure
+        run: |
+          ./configure --enable-live-tests \
+            CFLAGS='-g -O2 -Wno-pointer-sign -std=gnu11' \
+            CPPFLAGS="-I$(brew --prefix openssl)/include -I/usr/local/include" \
+            LDFLAGS="-L$(brew --prefix openssl)/lib -L/usr/local/lib"
+
+      - name: Build
+        run: make -j$(sysctl -n hw.logicalcpu)
+
+      - name: Check Perl syntax
+        run: |
+          perl -c reports/opendmarc-expire
+          perl -c reports/opendmarc-import
+          perl -c reports/opendmarc-importstats
+          perl -c reports/opendmarc-params
+          perl -c reports/opendmarc-reports
+
+      - name: Test
+        run: make check
diff --git a/CHANGES-202605.md b/CHANGES-202605.md
index 7b11d3a..5d31d03 100644
--- a/CHANGES-202605.md
+++ b/CHANGES-202605.md
@@ -167,6 +167,9 @@ CREATE TABLE IF NOT EXISTS suppressions (
 
 ## Build system and portability
 
+- **`opendmarc_policy_fetch_fo()` missing from public header**: The function was implemented and documented but never declared in `dmarc.h.in`, causing a build failure on Clang 15+ (including Apple Clang 21 on macOS) where implicit function declarations are a hard error rather than a warning. (#408, issue #407)
+- **macOS CI job added**: GitHub Actions now builds and tests on `macos-latest` in addition to `ubuntu-latest`, catching Clang-strict build failures that go undetected on the Linux/GCC job. libmilter is built from the sendmail source tarball; `-std=gnu11` is required because sendmail's `mfapi.h` typedef's `bool`, which conflicts with C23 where `bool` is a keyword.
+
 - **`opendmarc-spf-parse.c` missing from `Makefile.am`**: The Received-SPF parser source file added in the crash fixes was not listed in `opendmarc_SOURCES`, causing a link failure on clean builds. (#335, issue #334)
 - **Perl path hardcoded in report scripts**: `#!/usr/bin/perl` was hardcoded in `opendmarc-reports`, `opendmarc-import`, and related scripts. The path is now detected by `configure` and substituted as `@PERL@`. (#318)
 - **`Switch` module dependency removed**: The report scripts used `Switch`, which was removed from core Perl in 5.36 and requires a separate CPAN install on modern systems. All `switch`/`case` blocks have been converted to `if`/`elsif`/`else`. (#336)
diff --git a/libopendmarc/dmarc.h.in b/libopendmarc/dmarc.h.in
index 814b508..2c47f9b 100644
--- a/libopendmarc/dmarc.h.in
+++ b/libopendmarc/dmarc.h.in
@@ -142,6 +142,7 @@ OPENDMARC_STATUS_T opendmarc_policy_fetch_adkim(DMARC_POLICY_T *pctx, int *adkim
 OPENDMARC_STATUS_T opendmarc_policy_fetch_aspf(DMARC_POLICY_T *pctx, int *aspf);
 OPENDMARC_STATUS_T opendmarc_policy_fetch_p(DMARC_POLICY_T *pctx, int *p);
 OPENDMARC_STATUS_T opendmarc_policy_fetch_sp(DMARC_POLICY_T *pctx, int *sp);
+OPENDMARC_STATUS_T opendmarc_policy_fetch_fo(DMARC_POLICY_T *pctx, int *fo);
 u_char **	   opendmarc_policy_fetch_rua(DMARC_POLICY_T *pctx, u_char *list_buf, size_t size_of_buf, int constant);
 u_char **	   opendmarc_policy_fetch_ruf(DMARC_POLICY_T *pctx, u_char *list_buf, size_t size_of_buf, int constant);
 OPENDMARC_STATUS_T opendmarc_policy_fetch_utilized_domain(DMARC_POLICY_T *pctx, u_char *buf, size_t buflen);