Why do some emails show “Authenticated by XYZ” even with DMARC fail?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You look at an email in Gmail or Outlook, see the "Authenticated by" label, and think: great, authentication is working. But your DMARC aggregate reports show failures for the same messages. What's going on?
The "Authenticated by" label in email clients is based on the Authentication-Results header (defined in RFC 8601). That header reports individual protocol results: spf=pass, dkim=pass, dmarc=fail. Email clients typically surface whichever positive result they find first. So if SPF passed for the sending server, the UI might show "Authenticated by sendingplatform.com" even though DMARC failed because of alignment.
DMARC is alignment-based. The client UI is not. They're looking at different parts of the same header.
Here's the important distinction: the "Authenticated by" display is a mailbox provider's own interpretation of the header. It's often helpful, but it's not the same as DMARC passing. DMARC is what actually governs whether the message gets delivered, quarantined, or rejected under your policy. A nice "authenticated" label doesn't mean your DMARC is working.
To see the real picture, read the full Authentication-Results header in the raw email source. You'll see separate lines for spf, dkim, and dmarc results. DMARC alignment requires at least one of SPF or DKIM to pass for your own domain. Our free Review My Emails Email Header Analyzer shows you all of these in one place.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
