Enum AuthorAuthenticationOutcome

Namespace

MailFathom.Domain.Emails.Authentication

Assembly

MailFathom.Domain.dll

What the receiving mail server established about the author a message displays in its From header.

public enum AuthorAuthenticationOutcome

Fields

Authenticated = 2

The trusted receiving server established that the displayed author authenticated.

Failed = 1

The trusted receiving server evaluated the displayed author and reported that it did not hold.

Reached from Fail and nothing else, because DMARC is the one result that is about the displayed domain rather than about a transport identity. A DKIM signature that did not verify says nothing about the author, since the signature may never have belonged to them.

NotEstablished = 0

The trusted evidence is not enough to conclude either way about the displayed author.

It is deliberately not Failed. A message signed by a domain unrelated to the displayed one — a tenant's default signing domain, a delivery provider's own name, a sibling under a shared parent — with no usable DMARC result to say whether the sender's own policy permits that, is the ordinary case here: MailFathom evaluates no policy, so it does not know, and a verdict that said the author failed would be inventing a refusal the receiving server never made.

Remarks

This is a different question from SenderAuthenticationOutcome and the two routinely disagree. That one answers whether an identity authenticated, which for a relay, a mailing list, or a delivery provider is the identity of whoever handed the message over. This one answers whether the identity a mail client shows the reader is the one that authenticated, which is the question every impersonation is an attempt to have answered wrongly.

The From header takes no part in reaching it. It is attacker-controlled message content, so it says who the message claims to be from and never who it is from; what establishes the author is the trusted receiving server's own DMARC result, or an authenticated identity whose domain is the displayed one or lies with it on one branch of the naming tree.