Checks whether an email really came from who it says.

authenticate/2 runs every check it can:

• DKIM, always (MailAuth.DKIM)
• SPF, when the client IP is given with :ip (MailAuth.SPF). Without it, as for mail read over IMAP, SPF is :none, reason :no_client_ip
• DMARC, from the DKIM and SPF results, unless dmarc: false (MailAuth.DMARC)

result = MailAuth.authenticate(raw)

if MailAuth.Result.dmarc_pass?(result) do
  # The From: domain sent this message.
end

raw is the message exactly as stored, headers and body. Lines end in CRLF; a message with bare LF line endings is read as if each LF were CRLF.

Options for every call

• :resolver: a module implementing MailAuth.Resolver. Default MailAuth.Resolver.Inet
• :deadline: milliseconds for the whole call. Default 15000. A check still waiting on DNS at the deadline is :temperror, reason :deadline
• :timeout: milliseconds per DNS query. Default 5000
• :now: the time to check signatures against, in Unix seconds or a DateTime. Default: now

Options for authenticate/2

• :ip: the client IP, a tuple or a string, to run SPF
• :mail_from: the MAIL FROM address. Empty for a bounce
• :helo: the HELO name
• :dmarc: false to skip DMARC

and the options of MailAuth.DKIM.verify/2, MailAuth.SPF.check/4 and MailAuth.DMARC.evaluate/3.