Defaults.Exposed › Tools › Read your email's Authentication-Results header
Read your email's Authentication-Results header
Someone has forwarded you a block of machine output and asked what went wrong. The Authentication-Results header is the receiving server's own account of one message: which checks it ran, what each one returned, and which identity each result was measured against. Paste it below and every token is explained where it sits.
The short tokens carry the most. dmarc=pass says the message lined up with the domain in
the From: line. dis=none says this receiver applied no DMARC action to it, whatever the
published policy asks for. Both can appear on the same line, and reading them together is usually the
whole answer.
Of the 78,444,857 domains publishing a DMARC record in the September 2026 census, 36,602,897
publish quarantine or reject and 41,798,631 publish p=none. A dis= value only carries a
consequence for the first group, which is worth knowing before anyone reads a disposition as a verdict.
In Gmail, open the message, choose Show original, and copy the line. In Outlook, open the message properties and copy from the internet headers. Nothing you paste leaves this page.
Every token, with a permanent link
Each entry below has its own anchor, so a link to one token stays pointing at that token. The reader sends the link, the next person lands on the definition.
spf=
The receiver took the envelope sender address, the one in the SMTP MAIL FROM command rather than the From: line a reader sees, and asked whether the sending IP is listed in that domain's SPF record.
- spf=pass
- The sending IP is listed in the SPF record of the envelope sender domain. The SPF leg of DMARC can only align on the envelope domain, so a pass here still fails DMARC when that domain differs from the From: header domain.
- spf=fail
- The record ends in -all and the sending IP is not listed. The domain owner has said this sender is not authorised. Receivers are entitled to reject on it.
- spf=softfail
- The record ends in ~all and the sending IP is not listed. The owner is saying the IP is probably unauthorised and asking the receiver to accept and mark it anyway. Most receivers treat softfail and fail alike for DMARC.
- spf=neutral
- The record ends in ?all, so the owner has explicitly declined to say anything about this IP. It carries no more weight than having no record.
- spf=none
- The domain publishes no SPF record at all. Nothing was checked. Publishing one is the fastest single change on this list.
- spf=temperror
- A DNS lookup failed in a way that might work next time, such as a timeout or SERVFAIL. The receiver will usually defer the message rather than judge it. Repeated temperrors point at your own nameservers.
- spf=permerror
- The record could not be evaluated: more than ten DNS lookups, more than one SPF record on the name, or a syntax error. PermError voids the whole record, so a correctly listed sender fails the same way an unlisted one does.
dkim=
The receiver fetched the public key named by the signature, recomputed the hash over the signed headers and body, and compared it with the signature.
- dkim=pass
- A signature verified against the key published at the selector named in header.s. The domain in header.d signed this message and the signed parts were not altered in transit.
- dkim=fail
- A signature was present and did not verify. Either the body changed after signing, which a mailing list footer will do, or the key rotated.
- dkim=none
- The message carried no DKIM signature. Nothing was checked. Your sending platform may be signing with its own domain elsewhere in the header.
- dkim=neutral
- A signature was present and malformed enough that the receiver declined to judge it. Treat it as a signature that is not working.
- dkim=policy
- A signature verified and the receiver rejected it on local policy, most often a key that is too short. Re-key at 2048 bits.
- dkim=temperror
- The key lookup failed temporarily. Usually a DNS problem at the signing domain rather than at the receiver.
- dkim=permerror
- The signature or the key record is broken beyond evaluation, such as a missing selector. Find the selector the message used, then check the record at that name.
dmarc=
The receiver checked whether an SPF pass or a DKIM pass lines up with the domain in the From: header a reader sees, then applied whatever policy that domain publishes.
- dmarc=pass
- At least one of SPF or DKIM passed and aligned with the From: domain. The message is authenticated as coming from the domain it claims.
- dmarc=fail
- Neither SPF nor DKIM produced an aligned pass. What happens next is decided by the p= value in the comment. With p=none, nothing happens.
- dmarc=none
- The From: domain publishes no DMARC record, so there was no policy to apply. This is the state most domains are in.
- dmarc=temperror
- The DMARC record lookup failed temporarily. The receiver usually retries.
- dmarc=permerror
- A record exists at _dmarc and cannot be parsed, most often a typo in the policy value. A record that parses as present and does nothing is invisible to any check that only asks whether a record exists.
iprev=
The receiver looked up the PTR record of the connecting IP, then looked the resulting name back up in the forward direction to see whether it returns the same IP.
- iprev=pass
- The reverse name resolves forward to the connecting IP. A common precondition at the large mailbox providers before they will accept bulk mail.
- iprev=fail
- The reverse name does not resolve back to the same IP. Ask whoever owns the sending IP to fix the PTR record. On a shared platform that is the platform.
- iprev=temperror
- The lookup failed temporarily. No action on your side.
- iprev=permerror
- The lookup is permanently broken, usually no PTR record at all. Same fix as fail.
arc=
A chain of seals added by each hop that handled the message, so a forwarder can vouch for the authentication result it saw before it changed anything.
- arc=pass
- The chain of seals is intact. A receiver may honour an earlier hop's pass even though forwarding broke SPF. It is a courtesy, never a guarantee.
- arc=fail
- The chain is broken. The message is judged on its own SPF and DKIM alone.
- arc=none
- No ARC chain was present. Normal for mail that has not been forwarded.
compauth= (not in RFC 8601)
Microsoft 365 composite authentication. It is not in RFC 8601 and only Microsoft emits it, so treat it as that receiver's own verdict rather than a standard result.
- compauth=pass
- Microsoft accepted the message as authentic from the From: domain. The accompanying reason= number says which rule decided it.
- compauth=fail
- Microsoft judged the message as not authentic. Expect it in Junk. Fixing alignment on SPF or DKIM is what moves it.
- compauth=softpass
- Partial credit, usually from an implicit signal rather than a real pass. Delivery is at risk and one rule change at Microsoft ends it.
- compauth=none
- Microsoft could not evaluate composite authentication. Usually means no usable authentication was present.
The properties beside a result
A property says which identity the check was run against. This is where a header stops being a verdict and starts telling you which of your sending paths produced the message.
- smtp.mailfrom
- The envelope sender, from the SMTP MAIL FROM command. This is the domain SPF was checked against, and it is often your sending platform rather than you.
- smtp.helo
- The name the sending server introduced itself with. Checked when there is no envelope sender, as on a bounce.
- header.from
- The From: domain a reader sees. DMARC alignment is measured against this one and nothing else.
- header.d
- The domain that signed with DKIM. When it differs from header.from, the signature is real and it does not align.
- header.i
- The identity inside the DKIM signature, usually an address at header.d.
- header.s
- The DKIM selector. The public key sits at <selector>._domainkey.<header.d>.
- header.b
- The first few characters of the signature itself. Useful only for telling two signatures apart.
- policy.dmarc
- The action the receiver applied under the DMARC policy, reported as a property instead of inside the comment.
- policy.iprev
- The receiver's own local judgement on the reverse DNS result.
The tags inside the brackets
Anything in parentheses is a comment the receiver added for a human. Receivers put the DMARC policy and the disposition in there, which makes it the most useful part of the line and the part most often skimmed past.
- p=
- The policy the From: domain publishes for itself: none, quarantine or reject.
- sp=
- The policy that domain publishes for its subdomains. When it is absent, subdomains inherit p=.
- dis=
- The disposition, meaning what this receiver did about it. dis=none says the receiver applied no DMARC action to this message, whatever p= asks for.
- pct=
- The share of failing messages the policy is meant to apply to, from the pct= tag in the DMARC record.
- adkim=
- DKIM alignment mode: s for strict, meaning header.d must match the From: domain exactly, r for relaxed, which allows a subdomain.
- aspf=
- SPF alignment mode, the same two values applied to the envelope domain.
- reason=
- A receiver-specific code explaining the verdict. Microsoft's compauth numbers are the ones seen most.
Read next
What DMARC does, and what p= changes · The all qualifier: why softfail is not a soft no · Finding the DKIM selector a message used
Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.