mailauth

package

v0.2.4 Latest Latest Go to latest Published: Oct 24, 2026 License: MIT Imports: 13 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/Anonyfox/lfr

Links

Open Source Insights

Documentation ¶

Overview ¶

Package mailauth authenticates arriving mail (SPF, DKIM, DMARC with alignment) and DKIM-signs leaving mail. It only computes verdicts; what happens to a message is the spam filter's and the SMTP server's call.

Index ¶

Variables
func Aligned(a, b string, strict bool) bool
func OrgDomain(d string) string
func SignHeaders(raw []byte, domain string, keys []Key, now time.Time, headers []string) ([]byte, error)
type DKIMResult
type Key
type Result
- func (r Result) DKIMPass(domain string) bool
- func (r Result) Header(host string) string
type Verifier
- func (v Verifier) Verify(ctx context.Context, raw []byte, ip net.IP, helo, mailFrom, fromDomain string) Result

Constants ¶

This section is empty.

Variables ¶

View Source

var RelayHeaders = signed(true)

RelayHeaders leave out the fields relays rewrite: Amazon SES replaces Message-ID and Date and asks senders not to sign them, and SES and SMTP2GO add their own Feedback-ID. A signature covering them would fail on arrival.

View Source

var SignedHeaders = signed(false)

SignedHeaders are the fields DKIM signatures cover. Fields that change what a reader sees or does are listed twice: a field listed once covers only its last instance, so a replayed message could gain a second Subject or List-Unsubscribe above it; the extra entry signs "no further instance" (oversigning). Listing an absent field still locks it.

Functions ¶

func Aligned ¶

func Aligned(a, b string, strict bool) bool

Aligned reports DMARC identifier alignment of a with b.

func OrgDomain ¶

func OrgDomain(d string) string

OrgDomain is the organizational domain (public suffix plus one label).

func SignHeaders ¶

func SignHeaders(raw []byte, domain string, keys []Key, now time.Time, headers []string) ([]byte, error)

SignHeaders signs like Sign, covering the given header fields.

Types ¶

type DKIMResult ¶

type DKIMResult struct {
	Domain string `json:"domain"`
	Result string `json:"result"` // pass, fail, temperror, permerror
	Error  string `json:"error,omitempty"`
}

DKIMResult is one verified signature.

type Key ¶

type Key struct {
	Selector string
	Signer   crypto.Signer
}

Key is one signing key with its selector.

type Result ¶

type Result struct {
	SPF         string       `json:"spf"`        // pass, fail, softfail, neutral, none, temperror, permerror
	SPFDomain   string       `json:"spf_domain"` // MAIL FROM domain, or HELO when empty
	NullSender  bool         `json:"null_sender,omitempty"`
	DKIM        []DKIMResult `json:"dkim,omitempty"`
	FromDomain  string       `json:"from_domain"`
	DMARC       string       `json:"dmarc"`        // pass, fail, none, temperror, permerror
	DMARCPolicy string       `json:"dmarc_policy"` // none, quarantine, reject; empty without a record
}

Result is the authentication verdict of one message.

func (Result) DKIMPass ¶

func (r Result) DKIMPass(domain string) bool

DKIMPass reports whether any signature of domain (or, when relaxed, its organizational domain) passed.

func (r Result) Header(host string) string

Header renders the verdict as an Authentication-Results field value.

type Verifier ¶

type Verifier struct {
	DNS dnsx.Resolver
}

Verifier checks arriving messages.

func (Verifier) Verify ¶

func (v Verifier) Verify(ctx context.Context, raw []byte, ip net.IP, helo, mailFrom, fromDomain string) Result

Verify checks raw as received from ip, which greeted with helo and gave mailFrom as envelope sender. fromDomain is the domain of the From header.

Source Files ¶

View all Source files

mailauth.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL