Definition
The Authentication-Results header is an email header field added by receiving mailbox providers to document the outcome of authentication checks performed on incoming messages. Defined in RFC 8601, this header records whether the message passed or failed SPF, DKIM, and DMARC verification, along with the specific identity checked and any relevant qualifiers. It is the single most valuable diagnostic tool for troubleshooting deliverability issues because it reveals exactly how the receiver evaluated the message's authenticity.
When an email arrives at a receiving mail server, the server performs SPF verification by checking the sending IP against the domain's SPF record, DKIM verification by validating the cryptographic signature against the public key in the DNS, and DMARC evaluation by comparing the SPF and DKIM results against the domain's DMARC policy. The server then writes an Authentication-Results header that summarises these outcomes, typically following the format spf=pass, dkim=pass, dmarc=pass. Failures are indicated with fail, softfail, neutral, temperror, or permerror values.
Different mailbox providers format their Authentication-Results headers in slightly different ways. Gmail includes additional detail such as the DKIM signature domain and selector, whereas Yahoo and Outlook may use different header field names or supplementary headers. Understanding these provider-specific differences is essential for accurate diagnostics, especially when investigating why mail to one provider authenticates correctly but another shows authentication failures.
Best Practices
Always inspect Authentication-Results headers when troubleshooting deliverability issues. Raw headers contain the definitive record of how ISPs evaluated your authentication, whereas dashboard summaries may omit detail.
Authenticate every email with both SPF and DKIM, not just one. Authentication-Results headers that show only one method passing may still result in DMARC failure if strict alignment is required.
Check the Authentication-Results header for the dmarc=pass value specifically. SPF and DKIM can both pass but DMARC can still fail if alignment requirements are not met.
Compare Authentication-Results headers from successful deliveries against those from filtered or missing emails. Differences in the authentication evaluation often reveal the root cause of delivery problems.
Forwarded emails frequently show SPF and DKIM failures in the Authentication-Results header because forwarding changes the envelope sender. This is normal, but it can cause DMARC failures if the forwarder does not support ARC.
Save raw email headers as part of your QA process for every new campaign template. Historical header comparisons help identify when an infrastructure change or ISP policy update affected authentication.
Related Glossary Terms
Email Authentication Failure
Email authentication failures occur when SPF, DKIM, or DMARC checks fail, causing messages to be rejected, spammed, or quarantined by receiving mailbox providers.
Email DKIM Selector
DKIM selector management involves rotating signing keys across named selectors (default, s1, s2, 2024). Multi-selector strategies allow zero-downtime key rotation every 6-12 months for ongoing email authentication.
Email DMARC Report Analysis
DMARC aggregate report (RUA) analysis parses XML data to identify legitimate and unauthorised sending sources, assess SPF and DKIM alignment, and guide remediation.
Email DNS Records
DNS records required for email delivery: SPF, DKIM, DMARC, MX, PTR records. SPF lookup limits (10), TTL settings, propagation timing, and testing with dig and nslookup.
Email SPF Flatten
SPF flattening resolves the 10-DNS-lookup limit by expanding includes to explicit IP lists. Without flattening, complex SPF records hit the lookup limit and cause permerrors that lead to deliverability failures.
Frequently Asked Questions
In most email clients, you can view the raw message source or full headers through an option such as "Show Original" in Gmail, "View Source" in Outlook, or "View Raw Message" in Apple Mail. The Authentication-Results header appears in the header block alongside Delivered-To, Received, and Return-Path headers.
A neutral result means the SPF record exists but did not explicitly authorise or deny the sending IP, usually because the SPF record uses `?all` (neutral) rather than `-all` (fail) or `~all` (softfail). While neutral does not cause DMARC failure, it provides weaker authentication than a `pass` result.
DMARC requires domain alignment in addition to DKIM validation. This happens when the DKIM signature domain (the `d=` value) does not match the domain in the From header. For example, if a marketing platform signs with `d=sendgrid.net` but the From header shows `@yourdomain.com`, DMARC alignment fails even though DKIM validation passes.
Yahoo typically uses `dmarc=pass` and includes a `reason=` parameter. Yahoo also adds a separate `ARC-Authentication-Results` header for forwarded messages. Outlook uses the standard format but may include `compauth=pass` or `compauth=softpass` as supplementary status fields.
Not necessarily. Some smaller ISPs and mailing list servers do not add Authentication-Results headers. However, if a major provider such as Gmail or Outlook is not adding this header to your mail, it may indicate that your email is being rejected before authentication checks are completed, often due to IP reputation filtering at the connection level.