Definition
The Authentication-Results header is appended by receiving mail servers to record the outcome of authentication checks on a message. It shows whether SPF, DKIM, and DMARC passed, failed, or were not performed, and often why.
This header is the first place to look when mail is rejected, bounced, or filtered, because it tells you exactly how the receiving side judged your authentication setup.
The header records SPF, DKIM, and DMARC outcomes separately, so it pinpoints exactly which check failed and why. Reading it turns authentication from guesswork into a diagnostic you can act on. It is especially useful after DNS changes or when mail is rejected.
Reading Authentication-Results
The header appears in the raw message source, usually near the top. Each check is listed with its result, such as spf=pass or dkim=fail, and the reason.
Cross-referencing the results with your DNS records helps you pinpoint what to fix.
Why It Matters
The Authentication-Results header is the ground truth for why mail passed or failed. Learning to read it turns authentication from guesswork into a diagnostic you can act on.
Best Practices
- Inspect the header on test and live messages.
- Look for pass or fail values on SPF, DKIM and DMARC.
- Use the results to fix authentication gaps.
- Inspect the Authentication-Results header on test and live messages.
- Look for pass or fail on SPF, DKIM, and DMARC separately.
- Use the failures to identify alignment or record problems.
- Check the header after any DNS change to confirm fixes.
- Keep headers in mind when reading bounce diagnostics.
Was this useful?
Related Glossary Terms
Email Authentication Protocols
Email authentication protocols are technical standards that verify the identity of an email sender, helping mailbox providers distinguish legitimate mail from spam and phishing.
BIMI
BIMI (Brand Indicators for Message Identification) is an email standard that allows brands to display their logo next to their emails in supported email clients. It requires DMARC enforcement at quarantine or reject policy.
DKIM Alignment
DKIM alignment is the DMARC requirement that the domain in the From header matches the domain in the DKIM signature, confirming the visible sender domain is authenticated.
DKIM (DomainKeys Identified Mail)
DKIM (DomainKeys Identified Mail) is an email authentication method that uses digital signatures to verify that an email was not tampered with during transit and comes from a authorised domain.
DMARC Aggregate Report
A DMARC aggregate report is a machine-readable XML summary that receiving mail servers send to domain owners daily to show authentication results for their email traffic.
DMARC Alignment
DMARC identifier alignment determines whether the domain in the From header matches the domains used in SPF and DKIM authentication. Strict or relaxed.
Frequently Asked Questions
A header added by receiving servers that records the SPF, DKIM, and DMARC results for a message. The header records SPF, DKIM, and DMARC outcomes separately, so it pinpoints exactly which check failed and why.
In the raw headers of a delivered or bounced email, usually near the top of the message source. Reading it turns authentication from guesswork into a diagnostic you can act on.
Read which check failed, correct the SPF or DKIM record or alignment, and retest. It is especially useful after DNS changes or when mail is rejected.
Most major receiving providers add it, though the format varies slightly by provider. The header records SPF, DKIM, and DMARC outcomes separately, so it pinpoints exactly which check failed and why.
DMARC requires alignment with the From domain, so a passing SPF for the envelope can still fail DMARC. Reading it turns authentication from guesswork into a diagnostic you can act on.