Modern email systems use a set of authentication mechanisms to help
verify that a message was sent from a legitimate source and not forged
by a spammer or attacker. The Authentication property
enables you to easily determine which of these mechanisms have passed
a check and which of them have failed. It evaluates the following
authentication information reported by the mail server:
SPF
Sender Policy Framework allows the owner of a domain to specify
which mail servers are authorized to send email on its behalf. If the
sending server is not listed in the domain's SPF record, the message
may be marked as suspicious. SPF helps prevent spoofing of the
envelope sender address, which is often used in phishing attacks.
DKIM
DomainKeys Identified Mail uses public-key cryptography to
sign specific parts of the email, such as headers and body content.
The signature is added by the sending mail server, and receiving
systems use DNS to retrieve the sender's public key to verify that
the message has not been tampered with. A valid DKIM signature
helps confirm that the message was truly sent by the claimed domain.
DMARC
Domain-based Message Authentication, Reporting, and Conformance
builds on SPF and DKIM by defining a policy for how a domain wants
email receivers to handle messages that fail authentication checks.
It also ensures that the visible From: address matches the domain
that passed SPF or DKIM (a concept called alignment). DMARC allows
domain owners to monitor abuse and enforce stronger protection against
spoofing.
Checking these authentication results can help identify spoofed or
forged messages, improve filtering decisions, and increase overall
mail security. While not every legitimate message will have all three,
failure of all mechanisms, especially from domains that publish strict
DMARC policies, should be treated as suspicious.
This property returns one or more bitflags based on the authentication
results for the current message. The following flags are defined:
| Value |
Description |
| mimeAuthNone |
The message does not contain an Authentication-Results
header or does not include any recognizable authentication types
and their associated results. |
| mimeAuthSpfPassed |
The message passed the Sender Policy Framework (SPF) check.
The sender's IP address was authorized to send mail for the
domain in the envelope sender address. |
| mimeAuthSpfFailed |
The message failed the SPF check. The sending mail server
is not authorized by the domain's SPF record to send mail
on its behalf. |
| mimeAuthDkimPassed |
The message passed the DomainKeys Identified Mail (DKIM) check.
The signature applied by the sender was successfully verified
using the domain's public key. |
| mimeAuthDkimFailed |
The message failed the DKIM check. The signature could not
be verified or did not match the message content, suggesting it
may have been altered. |
| mimeAuthDmarcPassed |
The message passed DMARC evaluation. The message aligned with a valid SPF
or DKIM result based on the sender domain's policy. |
| mimeAuthDmarcFailed |
The message failed DMARC evaluation. It did not pass SPF or DKIM
checks in a way that aligns with the domain's published policy. |
| mimeAuthTempError |
A temporary error occurred while evaluating one or more
authentication mechanisms. This may indicate a DNS lookup timeout
or other transient failure. |
| mimeAuthPermError |
A permanent error occurred during authentication checks. This
may indicate a malformed DNS record or invalid message structure
that prevents proper evaluation. |
While these authentication methods are useful signals, failing one
of them does not necessarily mean a message is malicious. Many
legitimate messages, even from well-known companies, may have
misconfigured SPF records, missing DKIM signatures, or inconsistent
DMARC policies. Conversely, a message that passes all checks could
still be unwanted or deceptive. These results should be treated as
advisory signals rather than absolute indicators of legitimacy.
Developers are encouraged to consider authentication status alongside
other factors, such as message content, sender reputation, and user
reporting.
To simplify checking authentication outcomes, the following
predefined flag combinations are also available:
- mimeAuthPassed is a combination of all passing results (SPF, DKIM, DMARC).
- mimeAuthFailed is a combination of all failing results.
- mimeAuthError is a combination of temporary or permanent errors.