emailauth

package
v1.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 21, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AlignmentMechanism 

type AlignmentMechanism string
const (
	AlignedBySPF  AlignmentMechanism = "spf"
	AlignedByDKIM AlignmentMechanism = "dkim"
)

type AuthVerdict 

type AuthVerdict struct {
	SPF   CheckResult `json:"spf"`
	DKIM  CheckResult `json:"dkim"`
	DMARC CheckResult `json:"dmarc"`
}

AuthVerdict aggregates SPF, DKIM, and DMARC check results. It is the inbound trust primitive surfaced as `auth: {spf,dkim,dmarc}` on inbound messages and (Slice 7) enforced on by the inbound policy.

func Check 

func Check(remoteIP net.IP, senderEmail string, rawMessage []byte) *AuthVerdict

Check is the compatibility entry point used while relay and persistence callers migrate to Authentication. New code should call CheckAuthentication. remoteIP is the IP address of the SMTP client that connected to us. senderEmail is the envelope sender (MAIL FROM). rawMessage is the full RFC 2822 message including headers.

func (*AuthVerdict) DomainAuthenticated 

func (r *AuthVerdict) DomainAuthenticated() bool

DomainAuthenticated returns true if at least one domain-level check passed.

func (*AuthVerdict) Summary 

func (r *AuthVerdict) Summary() string

Summary returns a short string describing the results, suitable for an auth header.

type Authentication 

type Authentication struct {
	SPF   SPFResult    `json:"spf" doc:"SPF evidence for the SMTP peer and RFC 5321 identity."`
	DKIM  []DKIMResult `` /* 134-byte string literal not displayed */
	DMARC DMARCResult  `json:"dmarc" doc:"DMARC evaluation of the RFC 5322 Author Domain against aligned SPF and DKIM evidence."`
}

func CheckAuthentication 

func CheckAuthentication(ctx context.Context, remoteIP net.IP, envelopeFrom string, rawMessage []byte) *Authentication

CheckAuthentication evaluates and retains the complete SPF, DKIM, and DMARC evidence for an inbound message.

func CheckAuthenticationForAuthor 

func CheckAuthenticationForAuthor(ctx context.Context, remoteIP net.IP, envelopeFrom string, rawMessage []byte, author AuthorIdentity) *Authentication

CheckAuthenticationForAuthor evaluates authentication using an AuthorIdentity that was parsed once by the caller. This keeps the header_from projection and DMARC decision on the same security-critical interpretation of From.

func CheckAuthenticationForAuthorWithHELO 

func CheckAuthenticationForAuthorWithHELO(ctx context.Context, remoteIP net.IP, envelopeFrom, heloDomain string, rawMessage []byte, author AuthorIdentity) *Authentication

CheckAuthenticationForAuthorWithHELO is CheckAuthenticationForAuthor with the connection's SMTP HELO/EHLO identity for null-reverse-path SPF.

func CheckAuthenticationWithHELO 

func CheckAuthenticationWithHELO(ctx context.Context, remoteIP net.IP, envelopeFrom, heloDomain string, rawMessage []byte) *Authentication

CheckAuthenticationWithHELO evaluates authentication with the SMTP greeting retained for RFC 7208 null-reverse-path SPF processing.

func (*Authentication) Passed 

func (a *Authentication) Passed() bool

func (*Authentication) VerifiedDomain 

func (a *Authentication) VerifiedDomain() *string

VerifiedDomain returns the RFC 5322 Author Domain only when DMARC passed. It is a convenience decision projection; DMARC still authenticates a domain, never a mailbox local part, individual human, or message content.

type AuthorIdentity 

type AuthorIdentity struct {
	Address string
	Domain  string
}

func ParseAuthorIdentity 

func ParseAuthorIdentity(rawMessage []byte) AuthorIdentity

ParseAuthorIdentity returns the single RFC 5322 author mailbox used by both public header_from projection and DMARC evaluation. Ambiguous From fields fail closed: neither repeated fields nor a multi-address field identifies a single author mailbox.

type CheckResult 

type CheckResult struct {
	Status CheckStatus `json:"status"`
	Detail string      `json:"detail,omitempty"`
}

CheckResult holds the outcome of a single authentication check.

type CheckStatus 

type CheckStatus = Status

CheckStatus is retained while legacy callers migrate to Status.

type DKIMResult 

type DKIMResult struct {
	Status   Status  `` /* 210-byte string literal not displayed */
	Domain   *string `json:"domain" nullable:"true" doc:"DKIM signing domain from the signature d= tag; null when it could not be parsed."`
	Selector *string `json:"selector" nullable:"true" doc:"DKIM selector from the signature s= tag; null when it could not be parsed."`
	Aligned  *bool   `` /* 222-byte string literal not displayed */
	Detail   string  `json:"detail,omitempty" doc:"Free-text diagnostic for humans and logs. Never parse or branch on this field."`
}

type DMARCPolicy 

type DMARCPolicy string
const (
	DMARCPolicyNone       DMARCPolicy = "none"
	DMARCPolicyQuarantine DMARCPolicy = "quarantine"
	DMARCPolicyReject     DMARCPolicy = "reject"
)

type DMARCResult 

type DMARCResult struct {
	Status Status  `` /* 290-byte string literal not displayed */
	Domain *string `` /* 126-byte string literal not displayed */
	// Closed response enum: exhaustive DMARC policy classification.
	Policy *DMARCPolicy `` /* 215-byte string literal not displayed */
	// Closed response item enum: DMARC alignment has exactly two mechanisms.
	AlignedBy []AlignmentMechanism `` /* 163-byte string literal not displayed */
	Detail    string               `json:"detail,omitempty" doc:"Free-text diagnostic for humans and logs. Never parse or branch on this field."`
}

type SPFResult 

type SPFResult struct {
	Status  Status  `` /* 146-byte string literal not displayed */
	Domain  *string `json:"domain" nullable:"true" doc:"RFC 5321 identity domain evaluated by SPF; null when no SPF identity was available."`
	Aligned *bool   `` /* 215-byte string literal not displayed */
	Detail  string  `json:"detail,omitempty" doc:"Free-text diagnostic for humans and logs. Never parse or branch on this field."`
}

type Status 

type Status string

Status is an email-authentication result. Individual mechanisms expose only the subset of these values registered for that mechanism. 

const (
	StatusPass      Status = "pass"
	StatusFail      Status = "fail"
	StatusNone      Status = "none"
	StatusNeutral   Status = "neutral"
	StatusSoftFail  Status = "softfail"
	StatusPolicy    Status = "policy"
	StatusTempError Status = "temperror"
	StatusPermError Status = "permerror"
)

type TXTResolver 

type TXTResolver interface {
	LookupTXT(ctx context.Context, name string) ([]string, error)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.