What is “Authentication-Results” and how to read it?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
When an email arrives at its destination, the receiving server checks whether it passes authentication. Those results get written into the message headers before it's delivered to the inbox. That's the Authentication-Results header, and it's the definitive record of whether your authentication worked.
A typical header looks like this:
Authentication-Results: mx.google.com;
dkim=pass header.i=@example.com header.s=selector1;
spf=pass (google.com: domain of bounce@mail.example.com
designates 192.0.2.1 as permitted sender)
smtp.mailfrom=bounce@mail.example.com;
dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=example.comBreaking it down: the first line tells you which server performed the checks. Then each subsequent line covers one protocol. SPF checks whether the sending IP is authorized for the envelope domain. DKIM verifies the cryptographic signature and tells you which selector was used. DMARC shows the combined alignment result and what policy applied.
The key values to look for are pass, fail, softfail, and neutral. A pass means the check succeeded. Anything else means it didn't, and the reason is often in the parenthetical text that follows. That text is worth reading carefully when you're debugging a delivery problem.
To find these headers, open a message in your email client and view the raw source or "show original." You can also paste raw headers into our free Email Header Analyzer to have them broken down automatically, which is faster when you're not sure what you're looking at.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
