Mail::...AuthRes(3pm)

💅 Mail::...AuthRes(3pm) — aka Mail::SpamAssassin::Plugin::AuthRes 💅

okay so bestie, this is a page from the User Contributed Perl Documentation and it's all about the plugin called Mail::SpamAssassin::Plugin::AuthRes — the one that reads those Authentication-Results header fields so your setup doesn't do the same checks twice. no cap, it's giving ✨efficiency✨. let's go 🦋

---

✨ NAME ✨

Mail::SpamAssassin::Plugin::AuthRes — uses Authentication-Results header fields 🌸

---

🌈 SYNOPSIS 🌈

💖 SpamAssassin configuration:

loadplugin     Mail::SpamAssassin::Plugin::AuthRes

authres_trusted_authserv  myserv.example.com authres_networks  all

---

🫶 DESCRIPTION 🫶

This plugin parses Authentication-Results header fields and can hand the results it found over to other plugins, so everybody stops repeating checks that somebody already did. it's called teamwork, look it up 💅

---

👑 ADMINISTRATOR SETTINGS 👑

🎀 authres_networks internal/trusted/all (default: internal)

Process Authenticated-Results headers set by servers from these networks (refers to SpamAssassin *_networks zones). Any header outside this is completely ignored (and yes, this affects all module settings, so pay attention 🔥).

• internal = internal_networks
• trusted = internal_networks + trusted_networks
• all = all above + all external

Setting "all" is safe only if your MX servers filter properly all incoming A-R headers, and you use authres_trusted_authserv to match your authserv-id. This is suitable for default OpenDKIM, for example. These settings might also be required if your filters do not insert the A-R header to the correct position above the internal Received header (some known offenders: OpenDKIM, OpenDMARC, amavisd-milter 😭).

🎀 authres_trusted_authserv authservid1 id2 ... (default: none)

Trusted authentication server IDs — that's the domain-name-like first word of the Authentication-Results field, also known as the "authserv-id" 🦋

Note that if this is set, ALL A-R headers are ignored unless a match is found. so like, don't set it and forget it, bestie 🙈

Use strongly recommended, possibly along with authres_networks all. periodt 💅

🎀 authres_ignored_authserv authservid1 id2 ... (default: none)

Ignored authentication server IDs — same deal, the domain-name-like first word of the Authentication-Results field, a.k.a. the "authserv-id".

Any A-R header is ignored if a match is found. bye 👋

---

🔮 METADATA 🔮

Parsed headers are stored in $pms->{authres_parsed}, as a hash of array of hashes where results are collected by method. For example, the header field:

Authentication-Results: server.example.com;
  spf=pass smtp.mailfrom=bounce.example.org;
  dkim=pass header.i=@example.org;
  dkim=fail header.i=@another.signing.domain.example

Produces the following structure:

        $pms->{authres_parsed} = {
          'dkim' => [
            {
              'properties' => {
                'header' => {
                  'i' => '@example.org'
                }
              },
              'authserv' => 'server.example.com',
              'result' => 'pass',
              'version' => 1,
              'reason' => ''
            },
            {
              'properties' => {
                'header' => {
                  'i' => '@another.signing.domain.example'
                }
              },
              'result' => 'fail',
              'authserv' => 'server.example.com',
              'version' => 1,
              'reason' => ''
            },
          ],
        }

Within each array, the order of results is the original, which should be most recent results first ⭐

For checking the result of methods, $pms->{authres_result} is available:

        $pms->{authres_result} = {
          'dkim' => 'pass',
          'spf' => 'fail',
        }

---

🧚 EVAL FUNCTIONS 🧚

💜 header RULENAME eval:check_authres_result(method, result)

Can be used to check results.

Reference of valid result methods and values: https://www.iana.org/assignments/email-auth/email-auth.xhtml

Additionally the result value of 'missing' can be used to check if there is no result at all 👀

  ifplugin Mail::SpamAssassin::Plugin::AuthRes
  ifplugin !(Mail::SpamAssassin::Plugin::SPF)
    header  SPF_PASS      eval:check_authres_result('spf', 'pass')
    header  SPF_FAIL      eval:check_authres_result('spf', 'fail')
    header  SPF_SOFTFAIL  eval:check_authres_result('spf', 'softfail')
    header  SPF_TEMPFAIL  eval:check_authres_result('spf', 'tempfail')
  endif
  ifplugin !(Mail::SpamAssassin::Plugin::DKIM)
    header  DKIM_VERIFIED  eval:check_authres_result('dkim', 'pass')
    header  DKIM_INVALID   eval:check_authres_result('dkim', 'fail')
  endif
  endif

---

and that's the whole page, bestie 🫶 this one shipped as perl v5.40.1 dated 2026-07-23 — iconic of Perl to timestamp it like that, we love a paper trail 💖 slay, go configure something 🌈