Authentication, Troubleshooting, Deliverability
How to Read Email Headers to Check SPF, DKIM and DMARC
Every major mailbox provider writes its SPF, DKIM and DMARC verdicts into the message headers. Here is where to find them in Gmail and Outlook, and how to read the result.
6 min read
In this article
Open the full headers of a message you received and find the Authentication-Results line. It states spf=, dkim= and dmarc= verdicts as the receiving server saw them. In Gmail use the three dots menu and Show original, which also prints PASS or FAIL for each check at the top. Three passes with the right domains is a healthy message.
Where to find the headers
- Gmail: open the message, three dots menu, Show original. A summary box lists SPF, DKIM and DMARC with PASS or FAIL.
- Outlook on the web: open the message, more actions menu, View message source.
- Desktop Outlook: open the message in its own window, File, Properties, Internet headers.
- Apple Mail: View menu, Message, All Headers.
A header, line by line
A typical line looks like this: Authentication-Results: mx.google.com; dkim=pass header.i=@example.com header.s=google; spf=pass smtp.mailfrom=example.com; dmarc=pass header.from=example.com. Each part answers one question.
| Field | What it says | What to check |
|---|---|---|
| dkim=pass header.d / header.i | The signature verified. header.d is the signing domain. | Is the signing domain your own domain, or your sending tool's? |
| header.s | The DKIM selector used | It should match a record in your DNS |
| spf=pass smtp.mailfrom | The sending server is allowed by the SPF record of the envelope domain | Is smtp.mailfrom your domain, or the tool's bounce domain? |
| dmarc=pass header.from | At least one of SPF or DKIM passed AND matched the From domain | This is the verdict that decides policy |
Why pass and dmarc=fail can appear together
SPF and DKIM can pass while DMARC fails. That is the alignment rule. DMARC needs the domain that passed SPF (the envelope sender) or the domain that signed DKIM (d=) to match the domain in the visible From address. If your sending tool signs with its own domain and uses its own bounce address, both checks pass for the tool, neither matches you, and DMARC fails. The fix is the tool's custom domain or authentication set-up, not a change to your From line.
Common results and what they mean
- spf=softfail or spf=fail: the sending server is not in your SPF record, or the record ends in a way that marks it as not allowed.
- spf=permerror: the record itself is broken, often because of more than 10 lookups or two records. See the SPF permerror guide.
- spf=none or dkim=none: no record found, or no signature on the message.
- dkim=fail (body hash did not verify): something changed the message after it was signed, such as a footer added by a gateway.
- dmarc=fail with spf=pass and dkim=pass: an alignment problem, as above.
One caution: these verdicts are what one receiving server saw for one message. A forwarded message can break SPF, and that is normal. Judge a domain by several messages to several providers, not one.
Frequently asked questions
Where do I see SPF, DKIM and DMARC results for an email?
In the Authentication-Results header. In Gmail, choose Show original from the three dots menu, and the top of the page lists each check as PASS or FAIL.
Why does DMARC fail when SPF and DKIM pass?
Because of alignment. The domain that passed SPF or signed DKIM must match the domain in the From address. A sending tool that uses its own domains for both will pass its own checks and fail yours.
Is a single failed SPF in one header a problem?
Not always. Forwarding commonly breaks SPF. DKIM normally survives forwarding, which is why DMARC accepts either one.
