--- a/auth.go	Tue Feb 09 21:28:13 2021 +0100
+++ b/auth.go	Tue Feb 09 23:01:02 2021 +0100
@@ -58,6 +58,8 @@
 	// an error is returned SASL authentication will be aborted and an
 	// AuthenticationError will be returned to the caller.
 	Next(challenge []byte, more bool) (response []byte, err error)
+	// Returns true if a SASL security layer was negotiated.
+	SASLSecurityLayer() bool
 }
 
 var (
@@ -114,6 +116,10 @@
 	return nil, nil
 }
 
+func (a *plainAuth) SASLSecurityLayer() bool {
+	return false
+}
+
 // PlainAuth provides an Auth implementation of SASL PLAIN authentication as
 // specified in RFC 4616 using the provided authorization identity, username
 // and password. If the identity is an empty string the server will derive an