What is the Authentication-Results header?

You open an email header to figure out why a message landed in spam, and there it is: a block of text starting with Authentication-Results. It looks cryptic at first, but it's actually one of the most useful things in the entire header.

The Authentication-Results header is added by the receiving mail server after it checks the incoming message. It records whether SPF, DKIM, and DMARC passed or failed, and it stores that verdict right in the message so you (or any downstream system) can read it later.

A typical entry looks something like this:

spf=pass smtp.mailfrom=harborpost.net;
dkim=pass header.d=harborpost.net;
dmarc=pass header.from=harborpost.net

Each line names the check and its result. "Pass" means the check cleared. "Fail" means it didn't. You'll also see "softfail", "neutral", "none", "permerror", and "temperror" depending on what went wrong (or wasn't configured at all).

And the header also identifies which server ran the checks. That matters when a message passes through multiple systems before it reaches the inbox, because each hop can add its own Authentication-Results line. The one that counts is the one added by the final receiving server, not an intermediate one.

Why does this header exist at all? Because the checks themselves are invisible. SPF, DKIM, and DMARC run in the background when the message arrives. Without Authentication-Results, there'd be no record of what happened. When you're troubleshooting a delivery problem, this header tells you exactly where things broke down.

You can read Authentication-Results in any email client that exposes raw headers. In Gmail, open a message, click the three-dot menu, and choose "Show original". In Outlook, look under File > Properties. The header will be near the top of the raw source. If you'd rather not parse it manually, our free Email Header Analyzer reads it for you and flags any auth failures in plain English.