How to Read Email Headers: SPF, DKIM and DMARC Results Explained

Where the results actually live

The two lines that matter are Authentication-Results and Received-SPF. The receiving mail server (Gmail, Microsoft, your own MX) appends them after it checks the incoming message. A typical block looks like this:

Authentication-Results: mx.google.com;
  spf=pass smtp.mailfrom=example.com
  dkim=pass header.d=example.com
  dmarc=pass header.d=example.com action=none

Three tokens, three checks. If you only remember one thing: the domain after each check must match the From header for the email to count as properly authenticated.

SPF: did the sending IP have permission?

spf=pass means the IP that delivered the message is listed in your SPF record. spf=fail means it is not. The value after smtp.mailfrom= is the domain whose SPF was checked, which is usually the envelope sender, not the visible From address. Common variants:

pass: the IP is authorized. Good.
fail: not authorized. The receiving server should reject or filter the message.
softfail: not authorized, but the record says "be gentle." Often a sign of a misconfigured SPF with a ~all mechanism.
permerror / temperror: the SPF lookup itself broke (too many DNS lookups, malformed record). The mail is treated as unverified.

DKIM: was the message signed, and does the signature verify?

dkim=pass header.d=example.com means the message carried a DKIM signature from example.com and the public key in DNS verified it. The signature protects the content: if anyone tampers with the body or headers after signing, verification fails. Two things people miss:

dkim=none means the sender did not sign at all. That is not an error, but it means you are relying on SPF alone.
A passing DKIM from a different domain than the From header (say, header.d=mailprovider.com on an email that says "from you@example.com") is the classic pattern of a legitimate third-party tool that was not set up with DMARC alignment.

DMARC: the verdict that ties it together

DMARC requires alignment: the SPF or DKIM domain must match the From header. dmarc=pass means at least one aligned check passed and the domain has a DMARC record. The action= value tells you what the policy would do with unaligned mail:

action=none: report only. The domain wants to see what is happening but is not yet filtering.
action=quarantine: unaligned mail goes to spam.
action=reject: unaligned mail is refused outright.

If you see dmarc=fail on an email that claims to be from your domain, treat it as spoofed until proven otherwise. That is exactly the situation DMARC exists to make unambiguous.

Five things people misread in headers

Reading the Received lines top to bottom. They are appended as the mail travels, so the first Received line is the oldest hop and the last is the most recent. The route reads oldest-first, not newest-first.
Trusting the From header alone. The From field is set by the sender and costs nothing to fake. Only the authentication results are checked by the receiver.
Assuming spf=pass means the From address is real. SPF authenticates the envelope sender (the IP), not the visible From address. That gap is why DMARC alignment exists.
Ignoring permerror. A broken SPF lookup (10+ DNS lookups) makes every message from that domain look unverified. The fix is to flatten the SPF record, not to add more includes.
Stopping at one provider's results. Gmail, Microsoft and your own MX can disagree. If one shows spf=fail and another shows spf=pass, the SPF record is usually the problem, not the mail.

The one-minute spoof test

When a suspicious email lands, open the headers and answer three questions:

Does dkim=pass appear, and does header.d= match the From domain?
Does spf=pass appear, and does smtp.mailfrom= match the From domain?
Does dmarc=pass appear at all?

If all three say no, the email is unauthenticated: it may still be legitimate, but the sender gave the receiving server no reason to trust it. If it asks for money or credentials, that is your answer.

Analyze headers without doing it by hand

The email header analyzer does exactly this test for you: paste the raw headers and it reports the SPF, DKIM and DMARC results in plain English, flags domain alignment, and shows the route. It runs entirely in your browser, so nothing you paste is uploaded. For the other side of the problem, the DMARC checker and SPF checker verify your own records, and the free audit scores all seven deliverability checks at once.

Want this checked automatically every day? Inboxproof Pro monitors your domain around the clock and alerts you the moment a record breaks or an IP gets listed. See pricing →